In short: this website sets no cookies and runs no analytics. Apart from the connection data needed to deliver pages, which we do not keep, we collect personal data only when you contact us. We use it to answer you and to protect the form from abuse, and we delete form records automatically after 12 months. We never sell your data or add you to a marketing list.
1. Scope
This notice explains how eprojac Ltd (“eprojac”, “we”, “us”) collects, uses and protects personal data through the website at eprojac.com, including www.eprojac.com and its feedback form (the “website”). eprojac is the controller of that personal data.
Messages you send through the website are covered by this notice, whatever they are about. The notice does not cover our products — SeeCodes, Local pDigger and SCADA pDigger — or their websites, which have their own privacy notices (see the Legal notice). Nor does it cover the Service Level Agreement at sla.eprojac.com, which is hosted separately.
2. Who we are
The controller is eprojac Ltd, a private limited company registered in England and Wales under company number 16877519.
Registered office: 17 Drakes Close, Esher, Surrey, United Kingdom, KT10 8PQ
Privacy contact: admin@eprojac.com
eprojac is not required to appoint a data protection officer, because none of the conditions in Article 37 of the UK GDPR or the EU GDPR applies to it.
eprojac has no establishment in the EU and has not appointed a representative there. For the processing in this notice, it relies on the exemption in Article 27(2)(a) of the EU GDPR. Messages from people in the EU are occasional and small in scale, and involve no large-scale processing of special categories of data or criminal-offence data. Given their nature, context, scope and purposes, they are unlikely to result in a risk to people’s rights and freedoms. We review this position as the company grows, and will list a representative here if one is appointed.
ICO data protection fee. Through this website, eprojac processes personal data only to answer messages about its own business and products, and to protect the form from abuse. That is marketing and public relations for its own business, which is exempt processing under the Data Protection (Charges and Information) Regulations 2018. eprojac is not required to pay the data protection fee to the Information Commissioner’s Office (ICO) and is not on the register of fee payers. We will review this position if our processing changes.
3. Data we collect
When you browse the website
Each request your browser makes goes to our content delivery network, Amazon CloudFront. It carries your IP address, the page or file requested, and standard technical details such as your browser type. AWS processes this data transiently to deliver the website and protect it from attacks. We have not enabled CloudFront access logs, so we keep no per-visit log of our own.
The website sets no cookies, runs no analytics and loads nothing from other websites. If you use the Lights switch, your theme choice is stored in your browser and never sent to us (see section 14).
When you send a message through the feedback form
From you:
- your name, if you give it (it is optional)
- your email address
- the topic you choose
- your message
- the path of the page you sent it from, for example
/feedback/
From our content delivery network, when the form is sent:
- the country your request came from, as a two-letter code that CloudFront works out from your IP address
- a one-way hash of your IP address (for IPv6, of its network part), combined with a random key that changes every day. We use it only for abuse limits: each network can send 5 messages an hour. It is kept in a short-lived counter, not with your message. It cannot be reversed to reveal your IP address, and the form never stores or logs the IP address itself. Each daily key is deleted after about 3 days; after that, the hash can no longer be matched to any IP address, even by us.
When your message is stored, we also record a reference number (shown to you after sending), the date and time, and whether our notification email was sent. The message is saved in our database and emailed to our own mailbox, admin@eprojac.com, so that we can answer it.
Two hidden checks catch automated spam: a field that people cannot see and so leave empty, and the time taken to fill in the form. Submissions that fail them are discarded without being stored, although they still count towards their network’s hourly limit. If you think a genuine message was lost, email us.
Please leave out sensitive information, such as health details, and other people’s personal data unless your message needs them.
When you email us
If you email admin@eprojac.com directly, we receive your email address, the name shown with it, and whatever you write or attach. It is kept in our Google Workspace mailbox with our replies.
4. Sources of data
We get personal data from three places:
- from you, when you send a message through the form or by email;
- from our content delivery network, which supplies the country code and the address used for the hashed network identifier; and
- from the website itself, which generates the reference number, the date and time, and the email delivery status.
We do not buy personal data or obtain it from data brokers.
5. Purposes and lawful bases
Reading and answering your message. We use your message and contact details to read it, reply to you from admin@eprojac.com, and follow up on what you asked about, such as a product question, a demo or a partnership. Lawful basis: legitimate interests — responding to people who contact us about our company, products and research.
Preventing abuse of the form. We use the hashed network identifier, the rate limits (5 messages an hour per network, 100 a day in total) and the hidden checks to keep the form available and free of spam. Lawful basis: legitimate interests — protecting the form from abuse.
Delivering and securing the website. AWS processes connection data to serve pages and protect the website from attacks; our own operational logs hold no personal data. Lawful basis: legitimate interests — running a secure website.
Handling data-protection requests. If you ask to exercise your rights, we use the details you give us to confirm your identity and answer the request. Lawful basis: legal obligation.
Where we rely on legitimate interests, you can object at any time (see section 11). We never add people who contact us to a marketing list. We do not sell personal data or share it for cross-context behavioural advertising.
6. Sharing and processors
We disclose personal data only to the processors below, who handle it on our instructions; where the law requires it, for example under a court order; or when you ask us to. The current list, with contracting entities and transfer mechanisms, is on the Processors page. In summary:
- Amazon Web Services, Inc. (United States,
us-east-1; CloudFront edge locations worldwide) — delivering the website, running the feedback form, storing feedback records and their backups, sending notification emails to our mailbox, and operational logs. - Google Cloud EMEA Limited, with Google LLC and its affiliates as subprocessors — Google Workspace, the mailbox that receives notifications and emails and from which we reply.
7. International transfers
eprojac is in the United Kingdom. The feedback form and its database run in the United States (AWS us-east-1). Pages are delivered from CloudFront edge locations worldwide, normally one near you, and Google processes email in its global infrastructure. Personal data you send us is therefore transferred outside the UK and the EEA.
We rely on these transfer mechanisms:
- AWS — certified under the EU-US Data Privacy Framework, including the UK Extension. The AWS Data Processing Addendum also incorporates the EU Standard Contractual Clauses and the UK Addendum.
- Google — the EU-US Data Privacy Framework, including the UK Extension, and the Standard Contractual Clauses and UK Addendum in Google’s Cloud Data Processing Addendum.
- EEA to UK — transfers from the EEA to eprojac in the UK rely on the European Commission’s adequacy decision for the United Kingdom.
You can ask us for more detail about a transfer at admin@eprojac.com.
8. Retention
| Data | Where | How long |
|---|---|---|
| Feedback records: name, email address, topic, message, page path, country code, reference number, date and time, email status (the hashed network identifier is not stored with your message) | Amazon DynamoDB (AWS, us-east-1) |
Deleted automatically 12 months after submission (deletion can take a few days) |
| Database backups (point-in-time recovery) | Amazon DynamoDB (AWS) | 7 days, on a rolling basis; deleted records then cannot be recovered |
| Rate-limit counters: a hashed network identifier and a count | Amazon DynamoDB (AWS) | 2 days |
| Daily hashing key | Amazon DynamoDB (AWS) | Deleted after about 3 days |
| Operational logs: technical details such as request ID, status and timing, with no personal data | Amazon CloudWatch Logs (AWS) | 14 days |
| Notification emails, emails you send us, and our replies | Google Workspace mailbox (admin@eprojac.com) | As long as we need them to deal with your message; deleted within 24 months |
| Connection data: IP address and request details | Amazon CloudFront (AWS) | Processed transiently; access logs are not enabled, so we keep none |
Your theme choice (eprojac-theme) |
Your browser | Until you clear site data for eprojac.com |
If you ask us to delete your data sooner, we will, unless the law allows or requires us to keep it. Where we need a record to meet a legal obligation or to establish or defend a legal claim, we may keep it for longer.
9. Security and breaches
We use technical and organisational measures designed to protect personal data. They include HTTPS (TLS 1.2 or higher), a form backend that accepts only requests signed by our content delivery network, encryption at rest in AWS, and permissions that let the form send email only to our own mailbox. The Security page explains more.
If a personal-data breach affects you and the law requires it, we will notify the ICO within 72 hours of becoming aware of it and tell you without undue delay.
10. Automated decision-making
We do not make decisions about you by automated means that have legal or similarly significant effects. The rate limits and spam checks apply mechanically to every submission and have no such effect: at most, a message is not accepted, and you can still email us.
11. Your rights
Under the UK GDPR, and the EU GDPR where it applies, you have the right to:
- access the personal data we hold about you and receive a copy
- have inaccurate or incomplete data corrected
- have your data deleted
- restrict how we use it
- object to how we use it, since we rely on legitimate interests for everything in section 5 except data-protection requests
- data portability, where it applies
- complain to the ICO (see section 16)
Some rights have conditions and exceptions. We do not rely on consent for anything in this notice, so there is no consent to withdraw.
To exercise a right, follow the steps on the Data requests page or email admin@eprojac.com. Requests are free in most cases, and we respond within one month. If you live in the US, section 12 also applies.
12. Information for US residents
eprojac is based in the United Kingdom. It does not meet the thresholds, such as annual revenue or the number of consumers whose personal information it processes, at which the California Consumer Privacy Act and other US state privacy laws apply, so those laws do not currently apply to it. This section describes our practices in the categories they use.
Categories of personal information. Identifiers (your name if you give it, your email address, and a one-way hash of your IP address); internet or network activity (the page path you sent the form from); approximate location (country only); and the content of your message.
What we do not do. We do not sell personal information, share it for cross-context behavioural advertising, or disclose it to third parties for their own direct marketing. We do not ask for sensitive personal information; if you include some in a message, we use it only to answer you. We do not discriminate against anyone for exercising privacy rights.
Opt-out preference signals. Because we do not sell or share personal information, a signal such as Global Privacy Control has nothing to switch off on this website.
Requests. You can ask what personal information we hold about you, or ask us to correct it, delete it or give you a copy, as described in section 11. We answer every request, and if a US state privacy law does apply to you, we respond within the period it sets.
13. Children
The website is for adults and is not directed at anyone under 18. We do not knowingly collect personal data from children. If you believe a child has sent us personal data, email admin@eprojac.com and we will delete it.
14. Cookies and similar technologies
The website sets no cookies and uses no analytics, advertising or tracking technologies. The only thing it stores on your device is your theme choice: “light” or “dark”, in your browser’s localStorage under the key eprojac-theme, and only after you use the Lights switch. It stays in your browser and is never sent to us. See the Cookie notice.
15. Changes
We may update this notice to reflect changes to the website, the law or our practices. We will post the updated version on this page with a new effective date. If a change is material and we are in contact with you, we may also tell you by email. We give at least 14 days’ notice on the Processors page before adding or replacing a processor for the website.
16. Contact and complaints
Email admin@eprojac.com or write to eprojac Ltd, 17 Drakes Close, Esher, Surrey, United Kingdom, KT10 8PQ.
If you are unhappy with how we have handled your personal data, you can complain to the Information Commissioner’s Office. If the EU GDPR applies to you, you can also complain to your local supervisory authority. We would welcome the chance to put things right first.