We collect what we need to answer you. Nothing else.

This policy is issued by InterfaceBeam Ltd (“InterfaceBeam”, “we”, “us”), registered in England and Wales under company number 15482549. We are the data controller for the personal data described in this policy.

Data protection enquiries go to hello@interfacebeam.com. We answer within five working days and resolve rights requests within one calendar month.

We are registered with the Information Commissioner's Office. We are not required to appoint a Data Protection Officer, and have not appointed one; enquiries are handled by a company director.

This policy applies to interfacebeam.com and to the services we deliver to clients. It does not cover sites we build for clients once those sites are handed over and running under the client's own control.

When you submit the contact form or request a call, we collect the fields on that form:

• Contact form — your name, email address, subject line and message.
• Call request — your name, email address, business name, the time you'd prefer, and what you want to achieve.

When you email us or we work together on a project, we collect what passes through that correspondence: your contact details, the business context you share, invoicing and payment details, and the credentials or access you choose to grant us for a project.

Our hosting provider records standard server logs for every visit — IP address, request time, requested page, referring page, and browser user-agent. These exist to keep the site available and to spot abuse.

We do not run analytics or advertising trackers on this website at the date of this version. If we add them, we will update this policy and ask for your consent before they load. See the cookie policy for the live position.

We do not knowingly collect data from anyone under 18, and we do not process special category data (health, ethnicity, political opinion and the like). Please do not send it to us.

To reply to an enquiry and to prepare a quote. Lawful basis: steps taken at your request before entering a contract (UK GDPR Article 6(1)(b)).

To deliver and support work you have engaged us for, including project correspondence, access management and handover. Lawful basis: performance of a contract.

To issue invoices, take payment, and keep accounting records. Lawful basis: legal obligation under the Companies Act 2006 and tax law.

To keep the site secure, prevent spam submissions, and investigate misuse. Lawful basis: our legitimate interest in running a service that works.

To send occasional updates to existing clients about the work we do. Lawful basis: legitimate interest under the soft opt-in, and you can stop it with one reply. We do not send marketing to people who only ever sent an enquiry and did not become a client.

To load analytics or advertising tools, if we ever add them. Lawful basis: your consent, given through the cookie banner and withdrawable at any time.

Enquiries submitted through this site are passed from our web host to our own enquiry-handling system over an authenticated connection. They are not routed through a third-party form service.

We use a small number of processors to operate: a web host and content delivery network, an email provider, an accounting and invoicing provider, and a cloud platform for internal tooling. Each is bound by a written data processing agreement.

This site loads typefaces from Google Fonts. That means Google receives your IP address and user-agent as part of the request. No cookie is set by it.

We will disclose data where the law requires it — to HMRC, a regulator, or in response to a valid court order — and to our professional advisers where needed to take advice or defend a claim.

If the business is ever sold or restructured, client records may transfer to the buyer. We would tell affected clients before that happened.

Our hosting and primary storage are located in the UK or the EEA, where transfers are covered by UK adequacy regulations.

InterfaceBeam operates from the United Kingdom and Sri Lanka. Sri Lanka is not covered by a UK adequacy decision, so access from there is governed by the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment we review annually.

You can request a copy of the safeguards applied to those transfers by emailing hello@interfacebeam.com.

Enquiries that do not become projects: 12 months from the last message, then deleted.

Client project records and correspondence: for the duration of the engagement plus six years, matching the limitation period for contract claims in England and Wales.

Invoices, payment records and accounting data: seven years from the end of the relevant accounting period, as required by HMRC.

Your cookie choice: stored in your own browser until you clear it or change it. It is not sent to us.

Server logs: retained by our host on a rolling short-term basis for security and diagnostics, then overwritten.

Under UK GDPR you have the right to be told what we hold, to get a copy of it, to have mistakes corrected, to have it erased, to restrict or object to how we use it, to receive it in a portable format, and to withdraw any consent you have given.

To exercise any of these, email hello@interfacebeam.com with what you want. There is no charge. We respond within one calendar month and will tell you in advance if a complex request needs longer.

We may ask you to confirm your identity before releasing data, so that we do not hand your records to someone else.

We do not use automated decision-making or profiling that produces legal or similarly significant effects.

If you are unhappy with how we have handled your data, tell us first so we can put it right. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

All traffic to this site is served over HTTPS. Enquiry data is transmitted over authenticated, encrypted connections.

Access to client data is limited to team members working on that engagement, protected by multi-factor authentication on the accounts that support it.

Credentials and access you share with us are held in a dedicated password manager and revoked at the end of an engagement. We will ask you to rotate anything sensitive at handover.

No system is perfect. If a breach occurs that is likely to risk your rights and freedoms, we will report it to the ICO within 72 hours and tell you without undue delay.

The version number and in-force date at the top of this page tell you which edition you are reading.

Material changes — a new category of data, a new purpose, a new country — take effect from the in-force date of the new version. Clients on an active engagement are notified by email.

Superseded versions are kept on file. Email us if you need the edition that applied on a particular date.