Privacy Policy

Data controller. Brainwave Asset Intelligence Ltd (registered in England and Wales, No. 17135517, registered with the Information Commissioner's Office under reference ZC224318) is the data controller for personal data processed through this website.

We are committed to protecting your personal data. Any information you provide to us via this website (for example through our contact form, chatbot, or email) will be handled in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR).

We collect only the information necessary to respond to your enquiry and will never sell your data. We may share limited data with trusted third-party service providers who help us deliver or support this website, as described in our Cookie Notice.

How we process personal data, by area. Each area below sets out what is processed, why, whether it needs your consent, and which providers act on our behalf.

1. Hosting and delivering this website (necessary, no consent).

Serving a web page requires your browser to reveal your IP address, user agent and the page requested. This data appears in standard server and network logs. Providers: Netlify (United States), which hosts the site and whose data processing agreement is at netlify.com/gdpr-ccpa; Bunny Fonts (BunnyWay d.o.o., Slovenia), which serves the typefaces and is used in place of Google Fonts precisely because it is EU-hosted and does not log IP addresses; and jsDelivr, which serves the Bootstrap framework.

2. Protecting our forms from abuse (necessary, no consent).

Our contact form is protected by hCaptcha (Intuition Machines, Inc., United States), which receives your IP address, user agent and how you interact with the challenge in order to tell human visitors from bots. The form cannot be protected against abuse without it, so it is treated as strictly necessary and loads before consent.

3. Responding to your enquiry (legitimate interests).

Whatever you send us through the contact form or by email is processed to reply to you. Form submissions are handled by Netlify.

4. The chatbot (legitimate interests).

When you use the chatbot, your messages are sent to a server-side function on Netlify and forwarded to Anthropic (United States), where the Claude model generates a reply. We do not store conversations; they exist only in your browser and are discarded when you close the page. Under Anthropic's Commercial Terms your inputs are not used to train Anthropic's models, though Anthropic may retain inputs and outputs for up to 30 days for trust, safety and abuse monitoring. Our lawful basis is our legitimate interest in providing an information assistant you have actively chosen to use. Please do not enter confidential, classified or personal data into the chatbot.

5. The Foundations First newsletter (your consent, double opt-in).

If you subscribe, your email address is passed from this website to MailerLite by a server-side function. Subscriber data is hosted in the European Union, on Google Cloud EMEA Ltd infrastructure in Ireland. No MailerLite script runs in your browser and your email address is the only field we send. MailerLite sends its own confirmation email and only confirmed addresses join the list. When we send a newsletter, MailerLite records delivery and engagement information, such as whether an email was opened or a link clicked. Every newsletter carries an unsubscribe link, which removes you from the list.

6. Managing your cookie consent (necessary, no consent).

Cookiebot, operated by Usercentrics A/S (Denmark), provides the consent banner and cookie declaration, scans this site monthly to maintain the cookie list, and stores an anonymised record of each consent event so we can demonstrate compliance.

7. Aggregate site analytics (no consent required, cookieless).

Plausible Analytics, operated by Plausible Insights OÜ (Estonia), hosted in Germany. Plausible sets no cookies, stores no personal data, does not track visitors across websites and does not fingerprint users. Unique-visit counts come from a rotating daily hash of IP and user agent that is never stored. For that reason it runs without consent under PECR and UK GDPR. See Plausible's data policy.

8. Detailed analytics (Statistics consent required).

Only if you accept Statistics cookies, we measure how the site is actually used: pages viewed, referrer, approximate location derived from IP address, device and browser information, and how you move through a page. Providers: Google Analytics and Microsoft Clarity, both deployed through the Google Tag Manager container, which is itself blocked until you consent. Clarity records anonymised session information including clicks, scroll depth and mouse movement, and does not record keystrokes entered into forms. Google's processor terms are at business.safety.google/processorterms.

9. Identifying visiting organisations (Marketing consent required).

Only if you accept Marketing cookies, we use business-to-business intelligence services that receive your IP address, user agent, referrer and page view data, and may match the visit to a business organisation record. The purpose is to understand which organisations read this site and which pages they read. These services do not identify you personally by name. Providers: Apollo.io (Apollo.io, Inc., United States) and Factors.ai (Slashbit Inc., Wilmington, Delaware, United States).

Where these providers operate. Netlify, Google, Microsoft, Apollo.io, Anthropic, hCaptcha (Intuition Machines, Inc.), Factors.ai (Slashbit Inc.) and jsDelivr are based in or operate from the United States. Cookiebot (Usercentrics A/S, Denmark), Plausible (Plausible Insights OÜ, Estonia, hosted in Germany), Bunny Fonts (BunnyWay d.o.o., Slovenia) operate within the EEA. MailerLite hosts subscriber data in the EEA. Any transfer of personal data to the United States relies on the UK International Data Transfer Addendum and Standard Contractual Clauses.

Lawful bases for processing. We rely on: (a) your consent, managed through Cookiebot, for any non-essential cookies or tracking technologies listed in our Cookie Notice; (b) your consent, given by double opt-in, for sending you the Foundations First newsletter under PECR; (c) legitimate interests for responding to enquiries you initiate, for protecting our forms from automated abuse, and for limited business-to-business research carried out in a way that respects your reasonable expectations; and (d) legal obligation where we are required to retain records.

Data retention. Personal data submitted through the contact form or by email is retained for up to 12 months from the date of your last interaction with us, after which it is securely deleted unless we have an ongoing business relationship or a legal obligation to retain it. Newsletter subscribers are retained in MailerLite until you unsubscribe, after which your address is removed from the list. Cookie consent records are retained by Cookiebot for 12 months from the date of consent, in line with ICO guidance, to demonstrate compliance. Chatbot messages are not retained after your session ends.

Your rights. You have the right to request access to, correction of, or deletion of your personal data; to object to processing; to request restriction of processing; to data portability; and to withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal. You can exercise any of these rights, or lodge a complaint, by contacting us at hello@brainwaveassetintelligence.co.uk. You also have the right to complain to the UK Information Commissioner's Office at ico.org.uk.