Legal / Privacy Policy
Privacy Policy
What personal data we collect, why, how long we keep it, who can see it and how you can control it. Written to meet the EU General Data Protection Regulation (GDPR).
Last updated:
01Summary
- We collect only what you send us, plus basic technical data needed to run a secure website.
- We do not use advertising cookies, analytics trackers or social media pixels.
- We never sell your data, and we do not use it for automated decision-making.
- The Website, its server and our email are hosted in the European Union.
- You can ask to see, correct or delete your data at any time by writing to privacy@ultrania.com.
02Who is responsible for your data
Ultrania is the data controller for personal data processed through ultrania.com and our business email addresses.
| Controller | Ultrania |
| Website | ultrania.com |
| Privacy contact | privacy@ultrania.com |
| General contact | info@ultrania.com |
We are not required to appoint a Data Protection Officer. Please send all privacy questions and requests to the privacy contact above.
03What we collect
Information you give us. When you use the contact form or a meeting request form, we receive your name, company (optional), work email address, area of interest and your message. If you used the “Plan your next move” tool, the goals you selected are added to your message. If you email us directly, we receive your email address, your message and any attachments.
Technical data. Like every website, our server automatically records basic information about each request: IP address, date and time, the page requested, browser type and the referring page. This is needed to deliver the pages and to protect the Website against attacks.
What we do not collect. We do not ask for, and ask you not to send, special-category data such as health information, or identity documents, through the Website. The “Plan your next move” tool runs entirely in your browser and sends nothing to us unless you choose to send it through the contact form.
04Why we use it and our legal basis
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Answering your enquiry or meeting request | Form and email data | Steps at your request before a contract (Art. 6(1)(b)) and our legitimate interest in replying (Art. 6(1)(f)) |
| Preparing and performing a client engagement | Contact and business details | Performance of a contract (Art. 6(1)(b)) |
| Keeping the Website secure and working | Technical data and server logs | Legitimate interest in security and reliability (Art. 6(1)(f)) |
| Preventing spam and abuse of our forms | Form timing, IP address | Legitimate interest (Art. 6(1)(f)) |
| Meeting legal obligations, e.g. accounting | Business correspondence and invoices | Legal obligation (Art. 6(1)(c)) |
We do not send marketing emails. If we ever want to, we will ask for your consent first, and you can withdraw it at any time.
05Who can see your data
Your data is seen only by the people at Ultrania who need it to respond to you or to deliver our services. We share it outside Ultrania only in these cases:
- Service providers (processors) who host the Website and our email and provide IT support, under written data processing terms and only on our instructions.
- Specialist partners engaged to deliver part of a client engagement, only when you are a client, only what they need, and under confidentiality obligations.
- Professional advisers and authorities such as accountants, lawyers or regulators, where the law requires it or to protect our legal rights.
We never sell or rent personal data.
06Where your data is stored
The Website and our mailboxes run on servers located in the European Union (Germany). We do not transfer your personal data outside the European Economic Area. If that ever becomes necessary, we will use a lawful transfer mechanism, such as the European Commission’s Standard Contractual Clauses, and update this policy.
07How long we keep it
| Data | Retention |
|---|---|
| Enquiries and meeting requests that do not lead to an engagement | Up to 24 months after our last contact |
| Client correspondence and contract records | For the engagement and then as long as required by tax and company law (normally up to 7 years) |
| Server access logs | 30 days, then deleted automatically |
| Form rate-limiting records (hashed IP address) | Up to 1 hour |
08How we protect it
- All connections to the Website are encrypted with TLS (TLS 1.3 supported), and browsers are told to always use HTTPS (HSTS).
- Security headers protect against common web attacks, and the server is monitored and kept up to date.
- Our email domain is protected with SPF, DKIM and DMARC to reduce spoofing.
- Access to personal data is limited to people who need it, using individual accounts.
- Confidential client information is handled under NDA and agreed security measures.
09Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and receive a copy;
- rectify data that is inaccurate or incomplete;
- erase your data, where there is no reason for us to keep it;
- restrict how we use your data in certain cases;
- data portability, receiving data you gave us in a common machine-readable format;
- object to processing based on our legitimate interests;
- withdraw consent at any time, where we rely on consent.
To use any of these rights, write to privacy@ultrania.com. We will reply within one month, and we may ask you to confirm your identity first. Using your rights is free of charge.
You also have the right to complain to a data protection authority, in particular in the EU country where you live or work, or where you believe an infringement took place. For example: in Cyprus, the Commissioner for Personal Data Protection (dataprotection.gov.cy); in Italy, the Garante per la protezione dei dati personali (garanteprivacy.it); in Greece, the Hellenic Data Protection Authority (dpa.gr). We would appreciate the chance to address your concern first.
10Automated decisions and profiling
We do not make decisions about you based solely on automated processing, and we do not profile visitors.
11Children
The Website is intended for businesses and is not directed at children under 16. We do not knowingly collect data from children.
12Changes to this policy
We will update this policy when our practices change. The date at the top shows the latest version. If a change is significant, we will make it clear on the Website.
All legal documents