Privacy notice
Last updated: 1 October 2026
Who we are
This website is run by Cairnworks Labs Ltd, trading as Cairnworks. We are registered in England and Wales, company number 17238955. Our registered office is 5th Floor, 167–169 Great Portland Street, London W1W 5PF. We are the data controller for the information described here, and we are registered with the Information Commissioner’s Office under number ZC234709.
If you have a question about your data, email michael@cairnworks.co.uk.
What we collect
We collect information in two situations, and only these.
If you fill in the contact form, we collect your name, your email address, and whatever you write in the message.
If you book a call, we collect your name, your email address, and the time you chose. Google handles the booking and holds that information as well as us.
If you simply read the site, we count the visit. We record which pages were opened, how far down each one was read, which buttons were clicked, the town or city the visit came from, and which site or link sent you. We do not record your name, your email address, or anything you type. There is no advertising code on any page, and nothing is sold or shared for anyone else’s marketing. Our host also keeps ordinary server logs, as every web host does, which include the address your request came from. If you click something in the first moment a page is loading, before measurement has started, we hold that click briefly in your browser so it isn’t lost. It’s deleted once it’s sent, or straight away if you’ve opted out. If you take the 2-minute AI check, we record which answers are picked, never your name or email; it has no boxes to type into. A link you copy to your result holds your answers in the link itself, and we never receive it.
If you click Allow on the cookie banner, Apollo.io looks up which organisation your visit came from, using the network address your request came from and its own database of companies, and tells us the organisation’s name and the pages it visited. To do that it receives the address of each page you open, the page you came from, and any campaign tags in the link. It does not tell us who you are. If you click No thanks, or don’t answer, none of this happens.
If something on the site goes wrong in your browser, we record the fault so we can fix it. That report contains the error message, the technical trace of which of our code was running, the page you were on, and your browser and operating system. It is generated by our own code failing, not by anything you do, and we do not attach what you typed or who you are. You can switch this off with the same control as everything else below.
Why we collect it, and on what basis
We use your contact details to reply to you and to have the conversation you started. The lawful basis is legitimate interests, because you approached us about a service and replying is what you would expect.
Identifying which organisation a visit came from happens only with your consent, given on the cookie banner. We use it to follow up with organisations that may be interested in our work. You can withdraw that consent at any time (see Cookies, below).
We do not sell your data, we do not share it for anyone else’s marketing, and we do not add you to a mailing list because you filled in a form.
Who else sees it
A small number of suppliers process data on our behalf, under contract, and only on our instructions:
Netlify hosts the site, and its form service receives anything you send through the contact form.
Google runs the booking calendar, and Google Workspace holds our email, so anything you send us sits in our inbox.
PostHog measures how the site is used. It processes that data only for us, on servers in the European Union, and is not permitted to combine it with anything else it holds.
Apollo.io, only if you click Allow on the cookie banner, identifies which organisation a visit came from (see Cookies, below). Apollo is based in the United States, and its own privacy policy explains how it handles this data.
How long we keep it
Enquiries that don’t lead to work are deleted after 12 months.
Where we do work together, invoices and payment records are kept for seven years, because tax law requires it. Everything else from the engagement is deleted after 24 months: notes, recordings, transcripts and working files.
Visit statistics are kept for no more than 12 months, and you can ask us to delete yours sooner.
Where a visit is matched to an organisation, we keep that organisation’s name and visit dates in our records for no more than 12 months unless we go on to work together.
Where it goes
Visit statistics stay in the European Union: PostHog holds them on EU servers, and we have not enabled any transfer out of them.
If you allow it, Apollo.io handles your visit in the United States. Apollo is certified under the UK Extension to the EU-US Data Privacy Framework (the UK-US data bridge), and its data processing terms include the UK’s International Data Transfer Addendum.
Some of our other suppliers are based outside the UK, mainly in the United States. Where that happens, the transfer is covered by the UK’s approved safeguards, which means either an adequacy decision or the International Data Transfer Addendum.
Your rights
You can ask us for a copy of what we hold about you, ask us to correct it, ask us to delete it, or object to us holding it at all. Email michael@cairnworks.co.uk and we will answer within one month.
If you are unhappy with how we have handled your data you can complain to the Information Commissioner’s Office at ico.org.uk, or on 0303 123 1113. We would rather you told us first so we can put it right.
Measurement, and how to switch it off
We measure how this site is used so we can make it better: which pages are worth keeping, which ones lose people, whether anyone reaches the prices. To do that we store a small random identifier in your browser. It lets us tell that one person read three pages, rather than counting three separate strangers. It holds no name, no email address, and nothing that identifies you to us.
We don’t ask you to accept this measurement, and that is deliberate rather than an oversight. Since 5 February 2026 the rules have allowed measurement like this without consent, provided it is only ever used as aggregate statistics to improve our own service, is never used for advertising or profiling, is never passed to anyone else for their own purposes, and provided we tell you plainly and give you a straightforward way to say no. That is what this section is.
You can turn it off right here. It takes effect immediately, it costs you nothing, and nothing on the site stops working.
JavaScript is switched off in your browser, so none of the measurement described above runs at all and there is nothing here to turn off.
The setting is remembered in your browser, so clearing your browsing data will reset it. Switching measurement back on takes effect on the next page you open.
Separately, the booking calendar is Google’s, and Google sets its own cookies inside it. It does not load until you click a button to book a call, so if you never do, nothing from Google reaches your browser.
Changes
If we change this notice we will change the date at the top. If the change is significant we will say so on the site.