Legal
Privacy Policy
Last updated 5 October 2026
1. Who we are
Erbeon Ltd (trading as Erbeon, referred to here as "Erbeon", "we", or "us") is the data controller for the personal data described in this policy. We are a private company limited by shares, registered in England and Wales under company number 17220154. Our registered address is Suite 10842, 5 Brayford Square, London, E1 0SG, United Kingdom.
This policy explains what personal data we collect when you visit this site or contact us, why we collect it, and what rights you have over it. We handle personal data under the UK GDPR and the Data Protection Act 2018.
2. What we collect
We collect two kinds of data, and not much of either.
- What you send us. When you submit the contact form or email us, we receive your name, email address, phone number (if you provide one), the services you selected, and the content of your message.
- Server logs. Our web server records standard technical information for every request, including your IP address, the pages you requested, the date and time, your browser type, and your operating system. This is a normal part of running a web server and is used for security and troubleshooting.
- Anonymous usage measurement. We run our own privacy-first analytics on this site. It records which pages were viewed, how long each page was open, how far down the page was scrolled, which links and buttons were clicked and roughly where on the page they sit, the referring website, your device type, browser, operating system, screen width, and browser language. To group these into visits without identifying you, our server creates a one-way hash of your IP address and browser string using a secret that is rotated every day. Your IP address itself is never stored by the analytics, the hash cannot be reversed, and the same person appears as a different visitor the following day.
- Approximate location. We look your IP address up against a location database held on our own server to record the town or city and the country a visit came from. The lookup happens entirely on our machine, so your IP address is not sent to any location service or other company. Only the resulting place name is stored, never the IP address it came from. This tells us which regions our visitors are in. It is approximate, often only accurate to the nearest large town, and it does not identify you.
- Chat assistant. If you use the chat assistant on this site, we keep the questions you type, which topic each question was matched to, and the page you asked it on. The assistant is rule-based: your questions are not sent to an AI service or to any other company, and are processed only on our own server. These records do not contain your IP address or browser details. If you type an email address or phone number into a question, it is masked before the question is stored. To group the questions from one visit, the page uses a random number while it is open; that number is not written to your device. To prevent abuse, your IP address is held in server memory as a simple counter for at most 24 hours and is never written to disk. If you leave a message through the chat, it is handled exactly like the contact form.
- Advertising measurement, only if you consent. If you click Accept on the cookie banner, the Meta Pixel sends Meta the data described in section 4. If you do not, nothing is sent.
We do not ask for, and do not want, any special category data (such as health, ethnicity, or political opinions). Please do not include that kind of information in your message.
3. Why we use it, and our lawful basis
- To reply to you and discuss your project. The lawful basis is legitimate interests. You contacted us about our services, and answering you is the point of the form.
- To deliver work and manage contracts and invoices, if we go on to work together. The lawful basis is performance of a contract.
- To keep the site secure and working. The lawful basis is legitimate interests.
- To answer questions in the chat assistant and improve its answers. The lawful basis is legitimate interests. We look at which questions it could not answer so we can add those answers to the site.
- To understand how the site is used and improve it. The lawful basis is legitimate interests. We measure aggregate behaviour, not individuals, and we have kept the data deliberately minimal so this does not override your privacy.
- To measure the results of our advertising. The lawful basis is consent. This covers the Meta Pixel described in section 4, which only runs if you click Accept.
- To meet legal and accounting obligations. The lawful basis is legal obligation.
We do not send marketing emails to people who filled in the contact form. If that ever changes, we will ask for your consent first and you will be able to withdraw it at any time.
5. Third parties that receive data
We do not sell your data. We share data for advertising only through the Meta Pixel, and only if you consent. A small number of third parties are involved in running the site, and your IP address reaches them as a technical consequence of your browser loading the page.
- Our hosting provider. The server that runs this site and stores contact form submissions.
- Meta Platforms Ireland Limited, only with your consent. Receives the data described in section 4 through the Meta Pixel. Meta may process it outside the UK, including in the United States.
These providers process data under their own privacy policies. We do not control how they handle it.
Our analytics is not on that list on purpose. The location database we use to work out which town a visit came from sits on our own server as an ordinary file, so nothing about your visit is sent to a location provider or any other company. The database is DB-IP City Lite, used under the Creative Commons Attribution 4.0 licence.
6. Where your data goes
Our team works remotely and our servers are not all located in the United Kingdom, so your data may be transferred outside the UK. Where that happens, we rely on the safeguards available under UK data protection law, such as adequacy regulations or standard contractual clauses. If you consent to the Meta Pixel, the data it sends to Meta may be processed in the United States under the transfer mechanisms Meta relies on.
7. How long we keep it
Contact form messages are kept for as long as they are useful to the conversation they started, and no longer than three years after our last contact with you, unless we have a legal or accounting reason to keep them longer. Server logs are kept for a short period for security purposes. Analytics records are deleted automatically after 400 days. Chat assistant records are deleted automatically after 30 days. The cookie that remembers your banner choice lasts 180 days. If you consented, Meta's cookies last 90 days, and how long Meta keeps the data it receives is set by Meta's own policy. You can ask us to delete your data sooner, and we will unless the law requires otherwise.
8. Security
Data reaches us over encrypted connections (TLS) and is stored on access-controlled systems. We take technical and organizational measures to protect it. No transmission over the internet is ever completely secure, and we cannot promise otherwise.
9. Your rights
Under the UK GDPR you have the following rights.
- Ask whether we hold data about you, and get a copy of it
- Have inaccurate or incomplete data corrected
- Have your data erased
- Restrict or object to how we use it, including anything based on legitimate interests
- Receive your data in a portable format
- Withdraw consent at any time, where we relied on consent
To exercise any of these, email destek@erbeon.com. We respond within one month.
10. Complaints
If you think we have handled your data badly, please tell us first so we can put it right. You also have the right to complain to the UK's supervisory authority, the Information Commissioner's Office, at ico.org.uk.
11. Changes to this policy
We may update this policy. The date at the top always shows the current version. If we make a significant change, we will say so on the site.