Privacy Policy

Syntax Hive Technologies, trading as Syntax Hive, operates this website. In this policy “we”, “us” and “our” mean Syntax Hive. Where data protection law applies, we are the controller of the personal data described below — we decide why it is processed and how.

Our registered details — legal form, registered address, registration number and the people legally responsible for the entity — are published on the Imprint page at /imprint. Where that page shows a detail as outstanding, it has not been supplied yet rather than withheld; we would rather print nothing than print an invented company number.

This policy covers this website. If we go on to work together, the handling of data inside a project is governed by the agreement we sign for that engagement rather than by this page.

Personal data reaches us in exactly two places. There is no third place, and nothing is being collected quietly in the background while you read.

The first is the contact form at /contact. Nothing is collected until you submit it, and the form asks for:

• Your name — required, so we know who we are replying to.
• Your email address — required, and the only way we have of answering you.
• Your company — optional.
• Your website — optional.
• The service closest to your need, an indicative project budget range and a timeline — each chosen from a fixed list of options.
• A free-text description of your project. What goes in that box is entirely your choice.

The form posts to this site’s own API route. There is no third-party form widget, embedded chat tool or survey script sitting between you and us.

The second is technical request data, which is a consequence of how the web works rather than something we ask you for:

• A rate-limiting key derived from your IP address, read from the x-forwarded-for or x-real-ip header. It exists only to count contact form submissions, is held in server memory for a fixed ten-minute window, and is never written to a database or to disk.
• Standard server request logs produced by our hosting provider — the ordinary record of requests, timestamps, paths and status codes that every web server keeps in order to stay secure and diagnosable.

What you send through the form is read by a person on our team and used to answer you. That is the whole of it. Specifically, we use personal data to:

• Read your enquiry, reply to it, and ask the follow-up questions we need in order to give you a useful answer.
• Work out whether we are the right team for what you are trying to do, and scope the work if we are.
• Keep the contact form usable by preventing automated abuse of it.
• Keep the site secure, available and diagnosable when something breaks.
• Meet a legal obligation, in the uncommon event that one applies to us.

Sending an enquiry does not subscribe you to anything. There is no marketing list, no newsletter and no automated sequence — we reply to what you asked about, and if the conversation ends there, it ends there.

Under the UK GDPR and the EU GDPR every act of processing needs a lawful basis. Ours are set out below in full — there is nothing happening that is not in this table.

Where we rely on legitimate interests we have weighed those interests against your rights. The processing is limited to what the purpose needs, none of it is used to build a picture of you, and you can object to any of it — see “Your rights” below.

We do not currently rely on consent for anything on this website, which is why you are never asked for any. If that changes, we will ask properly rather than assume.

That is a statement about the code rather than an aspiration. It was established by auditing the source of this site, and it means the following, precisely:

• No cookies. Nothing in this site writes to document.cookie — not for preferences, not for sessions, not for anything.
• No local storage and no session storage. Nothing is left behind in your browser between visits.
• No analytics of any kind. There is no Google Analytics, Tag Manager, Meta pixel, Hotjar, PostHog, Plausible, Segment, Mixpanel or Clarity. There are no third-party script tags on this site at all.
• No tracking pixels or beacons — no invisible image whose only job is to record that you opened a page.
• No advertising, no remarketing, no audience building and no conversion tracking.
• No profiling and no automated decision-making. Nothing about you is scored, segmented or decided by a machine.
• No sale, rental or sharing of personal data for advertising, and no data brokers. The site has no mechanism for it and we have never done it.
• No third-party fonts. Typefaces are self-hosted and served from this site’s own domain, so your browser never requests a file from Google Fonts or any other font CDN and no font provider is handed your IP address.

The practical consequence: if you read this site and never use the contact form, the amount of personal data you have given us is none. The Cookie Policy at /cookies covers the browser-storage side of this in more detail.

We keep the list of recipients as short as running a website allows. Two providers process personal data on our behalf, under our instructions:

Vercel Inc.

Hosting, global edge delivery and server logs. Every request to this site passes through their infrastructure, so they necessarily handle the technical request data described above.

Our email delivery provider

Contact form submissions are passed to an email delivery provider so that your enquiry actually arrives in our inbox. They transmit the message on our behalf; they do not use its contents for their own purposes.

We may also disclose personal data where we are legally required to — for example in response to a lawful request from a court or a competent authority, or where it is necessary to establish, exercise or defend a legal claim. In that situation we disclose what is required and nothing beyond it.

There are no other recipients. Your data is not sold, rented or shared for advertising, and it is not passed to a partner network.

Our hosting and email providers operate internationally, so your data may be processed on servers outside the country you are reading this from — most commonly in the United States.

Where a transfer takes personal data out of the UK or the European Economic Area, we rely on the safeguards available for that transfer: any adequacy decision covering the destination and, otherwise, the standard contractual clauses contained in the provider’s data processing terms together with the additional measures those terms require.

If you want to know which safeguard applies to a particular provider, ask us using the contact details at the end of this policy and we will tell you.

We keep personal data for no longer than we need it for the purpose it was collected for. In practice that works out as follows:

Rate-limiting data

Discarded within the ten-minute window it belongs to. It lives in server memory, expired entries are cleared automatically, and no copy is written to a database or to disk. Nothing survives a restart.

Enquiry correspondence

Kept for as long as the enquiry, and any engagement that comes out of it, needs it. If a conversation goes nowhere we delete it once it is clear it has ended. If we do work together, the correspondence becomes part of the project record and is kept for the engagement and for as long afterwards as we reasonably need it for our business records and for any legal claim that could still be brought.

Server logs

Retained by our hosting provider for the limited operational period their service applies, then rotated out. We do not maintain a separate long-term archive of them.

We have deliberately not printed a precise number of years for enquiry correspondence. A retention period we could not honour, or could not justify, would be worse than an honest description of the test we actually apply.

If you would like your enquiry deleted sooner, ask us. We will do it, unless we have a legal reason to keep it — in which case we will tell you what that reason is.

If the UK GDPR or the EU GDPR applies to you, you have the rights below. Several of them exist in similar form under other privacy laws, and we have no intention of making you prove which regime you fall under before we help you.

Access

Ask whether we hold personal data about you and, if we do, get a copy of it together with an explanation of what we are doing with it.

Rectification

Have inaccurate data corrected and incomplete data completed.

Erasure

Ask us to delete your data where we no longer need it for the purpose it was collected for, or where you have successfully objected to the processing.

Restriction

Ask us to pause processing — while we check an accuracy complaint or consider an objection, for example — so that the data is stored but not otherwise used.

Portability

Receive the data you gave us in a structured, commonly used, machine-readable format, where the processing is based on consent or a contract and is carried out by automated means.

Objection

Object to processing we base on legitimate interests, on grounds relating to your situation. We will stop unless we can show compelling legitimate grounds that override your rights, or we need the data for a legal claim. Since we do no direct marketing, there is no marketing to opt out of.

Withdrawal of consent

Where we ever rely on consent you can withdraw it at any time, and withdrawing it does not affect processing carried out before you did. As set out above, we do not currently rely on consent for anything on this site.

To exercise any of these, write to us using the contact details at the end of this policy and say which right you are exercising. We may need to ask a question to satisfy ourselves that you are the person whose data it is — usually confirming the email address the enquiry came from — and we will not ask for more identification than the request requires.

We answer within one month. If a request is complex, or you have made several, we may extend that; we will tell you within the first month that we are doing so and why. Exercising your rights is free. We would only charge for a manifestly unfounded or excessive request, and we would explain the charge before applying it.

You also have the right to complain to a data protection supervisory authority — generally in the country where you live, where you work, or where the problem happened. The authority competent for us is named on the Imprint page at /imprint. We would rather you raised it with us first, because most problems are quicker to fix directly, but nothing here requires you to.

No system is perfectly secure and we are not going to tell you otherwise. What we can tell you is what has actually been implemented on this site:

• HTTPS is enforced, with HSTS set to a max-age of 31536000 seconds, includeSubDomains and preload — so a browser that has seen this site once will refuse to load it over plain HTTP.
• X-Frame-Options is set to DENY, so the site cannot be embedded in a frame and used for clickjacking.
• X-Content-Type-Options is set to nosniff, so browsers do not second-guess the content type we declare.
• Referrer-Policy is set to strict-origin-when-cross-origin, so full URLs are not leaked to other origins.
• Permissions-Policy denies camera, microphone and geolocation outright.
• Every contact form field is validated against a schema on the server. Client-side validation exists only to give you fast feedback and is never trusted as the authority.
• The form is protected by a hidden honeypot field that a genuine visitor never sees, a minimum completion-time check, and a limit of five submissions per IP address in any ten-minute window.
• Rate-limiting data is held in memory only and is never persisted.

These are measures we have taken, not a guarantee of outcome. We hold no security certification, we have not been audited against a security standard, and we make no claim to one. If that changes, this section will say so plainly rather than by implication.

This website is aimed at organisations looking for engineering work. It is not directed at children, nothing on it is designed to appeal to them, and we do not knowingly collect personal data from them.

If you believe a child has sent us personal data through the contact form, tell us and we will delete it.

When what we do changes, this policy changes with it. Every version carries an effective date and a last-updated date at the top of the page, so you can see at a glance whether you are reading something current.

If we ever add a cookie, an analytics tool, a third-party script or a new recipient, this policy will be updated to describe it and the “What we do not do” section will stop saying what it says today. We will not leave a statement standing after it has stopped being true.

Material changes will be signalled on the page itself rather than slipped in quietly. Continuing to use the site after a change means the updated policy is the one that applies.

Questions about this policy, a request to exercise one of the rights above, or a correction to something we have got wrong — all of it goes to the same place, and a person reads it.

Our registered details, and the supervisory authority competent for complaints about us, are published on the Imprint page at /imprint.