Privacy Policy

1. Who we are

Bundlespoppi Interface Labs Ltd ("Bundlespoppi", "we", "us") is the data controller for personal data processed through this website. We are registered in England and Wales under company number 14827391, with a registered office at 27 Kingsland Road, Unit 4B, London E2 8AA, United Kingdom. You can reach us at [email protected].

2. What data we collect

We collect three categories of personal data. Data you give us: when you complete the contact form, we receive your name, email address, the enquiry type you select, the message you write and any optional organisation name. Data collected automatically: when analytics consent is given, we record page addresses viewed, referring page, approximate region derived from a truncated IP address, device type, browser family and screen size band. Data stored on your device: consent state and, with functional consent, the arrangement of blocks and options you set in the component canvas. Canvas layouts stay in your browser's local storage and are not transmitted to us.

We do not knowingly collect data from children under 16, we do not process special category data, and we do not use the site for automated decision-making or profiling.

3. Why we process it and on what legal basis

• Responding to enquiries — legal basis: legitimate interests (answering people who contact us), or steps prior to entering a contract where you are requesting a quote.
• Site security and abuse prevention — legal basis: legitimate interests in keeping the service available and free of spam.
• Analytics — legal basis: consent, given through the cookie banner and withdrawable at any time.
• Functional preferences — legal basis: consent, given through the cookie banner.
• Accounting and statutory records — legal basis: legal obligation, where a commercial engagement follows.

4. Cookies and similar technologies

Essential storage runs without consent because the site cannot function without it — this covers your cookie choice itself and basic session integrity. Analytics and functional storage only run after you press "Accept All" or enable the category under "Preferences". A full itemised list, including names, durations and purposes, is in our Cookie Policy. You can change or withdraw your choice at any time by clearing the site's storage in your browser settings, after which the banner reappears on your next visit.

5. Third-party processors

We keep the processor list deliberately short. Personal data may be handled by our website hosting provider (server logs and content delivery), our email provider (receipt and storage of enquiry correspondence), and, where you have consented, a privacy-focused analytics provider that aggregates traffic without cross-site tracking. Each processor acts only on our documented instructions under a written data processing agreement. We do not sell personal data, and we do not share it with advertising networks or data brokers.

Where a processor stores data outside the UK or the European Economic Area, the transfer is covered by UK International Data Transfer Agreement provisions, the European Commission's Standard Contractual Clauses, or an applicable adequacy decision.

6. Retention

Contact form correspondence is retained for 24 months from the last message in the thread, then deleted, unless it forms part of a commercial engagement, in which case related records are kept for six years to meet UK accounting requirements. Server logs are retained for 30 days. Aggregated analytics data, which contains no direct identifiers, is retained for 14 months. Consent records are retained for 12 months so we can demonstrate the basis on which storage was used.

7. Your rights

If you are in the UK or the EEA, the UK GDPR and EU GDPR give you the right to access a copy of your data, to have inaccurate data corrected, to request erasure, to restrict or object to processing, to data portability, and to withdraw consent at any time without affecting processing already carried out. You also have the right to complain to a supervisory authority — in the UK, the Information Commissioner's Office.

If you are a California resident, the CCPA as amended gives you the right to know what personal information is collected, disclosed or sold, the right to delete it, the right to correct it, the right to opt out of any sale or sharing, and the right not to be discriminated against for exercising those rights. We do not sell or share personal information as those terms are defined under the CCPA.

To exercise any right, email [email protected]. We respond within one month, extendable by two further months for complex requests, and we will tell you if an extension applies. We may ask for information to verify your identity, and we will only use that information for verification.

8. Security

The site is served over TLS. Access to enquiry mailboxes is limited to staff who need it and protected by multi-factor authentication. We review access rights periodically and apply the principle of least privilege. No system is perfectly secure; if a breach occurs that is likely to result in a risk to your rights, we will notify the relevant supervisory authority within 72 hours and inform affected individuals where the risk is high.

9. Data protection contact

We are not required to appoint a statutory Data Protection Officer, but we have a named privacy contact who performs the equivalent role. Write to the Privacy Contact, Bundlespoppi Interface Labs Ltd, 27 Kingsland Road, Unit 4B, London E2 8AA, United Kingdom, or email [email protected].

10. Changes to this policy

When we change this policy we update the date at the top of the page. Material changes — a new processor, a new purpose, a longer retention period — will also be signalled on the home page for at least 30 days. Continuing to use the site after a change takes effect indicates that you have had the opportunity to review it.