This policy explains exactly what personal data Gradio Safety LTD collects, why we collect it, how long we keep it, who we share it with, and what rights you have over it. It covers our use of secure payment processors, cookies, analytics, and international data transfers.
1. Who we are and how to contact us2. What this policy covers3. Personal data we collect4. How we use your personal data5. Legal bases for processing6. Payment processing and transaction data7. Sub-processors and third-party services8. International data transfers9. Data retention10. Security measures11. Cookies and tracking technologies12. Your rights under GDPR and UK GDPR13. Children's privacy14. Changes to this policy15. Complaints and regulatory authority
Gradio Safety LTD ("we", "us", "our") is a company registered in England and Wales, Company No. 17456330. Our registered office is at 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ. We are the data controller responsible for your personal data processed through this website and during the delivery of our services.
You can contact us about any privacy or data protection matter using the following details:
We will respond to all data protection enquiries within 30 days, in accordance with Article 12 of the GDPR.
This Privacy Policy applies to all visitors, users, and clients of the Gradio Safety LTD website located at gradiosafetyltd.com (the "Site") and to all personal data we process in connection with the services we provide, including consultation, architecture reviews, stack recommendations, and security audits.
It does not apply to third-party websites or services that we link to. If you follow a link to another website, you should read and consider their privacy policy separately.
We collect personal data in the following categories. We only collect data that is necessary for the purpose for which it is processed.
| Data category | Examples | When collected |
|---|---|---|
| Identity and contact | Full name, email address, phone number, company name, job title | Contact form, email enquiry, consultation booking, service purchase |
| Project information | Project description, technical requirements, architecture details, codebase access details | Consultation, architecture review, security audit engagement |
| Payment information | Billing name, billing address, invoice details, VAT/Tax ID, payment method metadata (last 4 digits of card, card brand, transaction ID) | When you purchase a service through card payment or bank transfer |
| NDA and contract data | Signed NDA, engagement letter, signed contract, scope of work | Before any engagement that requires codebase access or sensitive information |
| Communications | Email content, call notes, meeting recordings (with consent), chat messages | When you email us, book a call, or participate in a consultation |
| Data category | Examples | How collected |
|---|---|---|
| Technical data | IP address, browser type and version, operating system, device type, screen resolution | Automatically when you visit the Site (server logs, cookies) |
| Usage data | Pages visited, time spent on pages, referring URL, click paths, exit pages | Cookies and analytics tools (see Section 11) |
| Location data | Approximate location derived from IP address (country, region, city) | Server logs and analytics |
| Cookie data | Cookie identifiers, consent preferences, session tokens | Cookies and local storage (see Section 11) |
When you make a payment, we receive limited metadata about the transaction. We do not receive or store your full card number, CVV, or banking credentials. See Section 6 for full details.
We process your personal data for the following specific purposes:
| Purpose | Description | Legal basis |
|---|---|---|
| Service delivery | Providing consultations, architecture reviews, stack recommendations, and security audits you have requested | Performance of a contract (Art. 6(1)(b)) |
| Payment processing | Processing payments, issuing invoices, managing refunds and chargebacks via authorized payment processors | Performance of a contract (Art. 6(1)(b)) |
| Responding to enquiries | Answering your emails, form submissions, and contact requests | Legitimate interests (Art. 6(1)(f)) |
| Client communication | Sending project updates, deliverables, follow-up questions, and support responses | Performance of a contract (Art. 6(1)(b)) |
| Website analytics | Understanding how visitors use our Site to improve content, navigation, and performance | Consent (Art. 6(1)(a)) / Legitimate interests (Art. 6(1)(f)) |
| Security and fraud prevention | Monitoring for suspicious activity, preventing fraud, protecting against unauthorised access | Legitimate interests (Art. 6(1)(f)) |
| Legal compliance | Maintaining financial records, tax records, and complying with regulatory obligations | Legal obligation (Art. 6(1)(c)) |
| Marketing (opt-in only) | Sending the Gradio Safety LTD newsletter and insights articles, only if you have explicitly opted in | Consent (Art. 6(1)(a)) |
We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects.
Under the GDPR and UK GDPR, we must have a legal basis for processing your personal data. The legal bases we rely on are:
We use authorized payment processors and regulated banking partners to accept payments for our services. Payment processors act as independent data controllers for the personal data they collect from you during checkout. We act as a data controller solely for the limited transaction metadata we receive from them.
When you pay by card, payment is processed on PCI-DSS Level 1 compliant infrastructure. We receive the following transaction metadata:
When you pay via domestic or international bank transfer, we receive the following confirmation metadata:
If you request a refund, initiate a chargeback, or dispute a payment, we will process the relevant transaction data with the payment processor to resolve the matter. This may include sharing your name, email, transaction details, and correspondence related to the dispute with the processor and, if necessary, with the card-issuing bank or dispute resolution network.
We do not collect, store, or transmit cardholder data. All card data is tokenised and processed directly by our authorized payment gateway through their hosted payment pages or embedded iframe fields. We do not fall within the scope of PCI DSS self-assessment because we never handle raw card data.
We use the following third-party services to operate our business. Each acts as a data processor on our behalf (unless noted otherwise as an independent data controller). We have data processing agreements (DPAs) in place with all processors where required by Article 28 of the GDPR.
| Provider | Service | Role | Data shared | Processing location |
|---|---|---|---|---|
| Card Payment Gateway Partner | Card payment processing | Independent controller | Card metadata, billing name, billing address, transaction amount | UK, EU, and global secure payment regions |
| Commercial Banking Partner | International payments, bank transfers, SEPA | Independent controller | Payer name, payment method, bank reference, transaction amount | UK, EU, and regulated financial regions |
| Google LLC | Analytics (if enabled), email (Google Workspace) | Processor / Controller | Usage data, IP address, email content (for business email) | USA, EU (Ireland) |
| Vercel Inc. | Website hosting and CDN | Processor | Server logs, IP addresses, request metadata | USA, EU (Frankfurt), and global edge network |
| Cloudflare, Inc. | DNS, DDoS protection, WAF | Processor | IP addresses, request metadata, security event logs | Global edge network |
| GitHub, Inc. | Source code hosting, CI/CD | Processor | Repository access, commit metadata, deployment logs | USA |
| Notion Labs, Inc. | Project documentation and client deliverables | Processor | Project notes, deliverables, client-provided documentation | USA, EU (Frankfurt) |
We do not sell your personal data to any third party. We do not share your personal data with advertising networks. We do not use your data to train machine learning models or artificial intelligence systems.
Some of our sub-processors and payment processors process personal data outside the United Kingdom and the European Economic Area (EEA). When this happens, we ensure that appropriate safeguards are in place to protect your data in accordance with Chapter V of the GDPR and UK GDPR.
For transfers to countries without an adequacy decision (particularly the United States), we conduct Transfer Impact Assessments in accordance with the Schrems II ruling (CJEU Case C-311/18). These assessments evaluate whether the laws of the receiving country could undermine the safeguards provided by the SCCs or IDTA, and whether supplementary measures are needed.
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying legal, accounting, or reporting requirements. After this period, data is deleted or irreversibly anonymised.
| Data type | Retention period | Reason |
|---|---|---|
| Client contract and engagement records | 7 years after contract end | Legal obligation — Limitation Act 1980, tax records |
| Payment and transaction records (card / bank transfer) | 7 years after transaction date | Legal obligation — HMRC tax record requirements |
| Invoices and billing records | 7 years after invoice date | Legal obligation — HMRC, Companies Act 2006 |
| NDA documents | 7 years after engagement end | Contractual and legal protection |
| Project deliverables and client-provided documentation | 2 years after engagement end, or per client agreement | Contract performance; client may request earlier deletion |
| Email and communication records | 3 years after last interaction | Legitimate interest — dispute resolution, reference |
| Contact form submissions (non-client) | 12 months after last interaction | Legitimate interest — responding to enquiries |
| Website analytics data | 26 months (rolling) | Legitimate interest — trend analysis, site improvement |
| Server logs and technical data | 90 days | Security, debugging, fraud prevention |
| Marketing consent records | Until consent is withdrawn, plus 3 years for audit | Consent management — proof of consent |
| Cookie consent preferences | 12 months or until you clear cookies | Consent management — PECR compliance |
When the retention period expires, we either permanently delete the data or anonymise it so that it can no longer be linked to you. Anonymised data may be retained indefinitely for statistical and research purposes, as it is no longer personal data under the GDPR.
We implement appropriate technical and organisational security measures to protect your personal data against unauthorised access, loss, destruction, or alteration. These measures are reviewed regularly and adjusted in response to emerging threats.
We use cookies and similar technologies (local storage, session storage) on our Site. Under the Privacy and Electronic Communications Regulations (PECR) and the ePrivacy Directive, we must obtain your consent before placing non-essential cookies. Our cookie banner allows you to accept or decline non-essential cookies. Your preference is stored in local storage for 12 months.
| Cookie name | Category | Purpose | Duration | Essential? |
|---|---|---|---|---|
| gradio-cookie-consent | Functional | Stores your cookie consent preference (accepted / declined) | 12 months (local storage) | Yes |
| payment_security_token | Payment security | Fraud prevention and session state on payment pages | Session / 1 year | Yes (on payment pages) |
| _ga, _ga_* | Analytics | Google Analytics — distinguishes unique users, session tracking | 2 years / 26 months | No — requires consent |
| _gid | Analytics | Google Analytics — distinguishes users within a session | 24 hours | No — requires consent |
| __cf_bm | Security (Cloudflare) | Bot management and DDoS protection | 30 minutes | Yes |
| cf_clearance | Security (Cloudflare) | Clearance cookie for verified users behind challenge pages | 1 year | Yes |
You can manage or delete cookies at any time through your browser settings. Each browser has different procedures for managing cookies — see the help menu in your browser for instructions. Note that disabling essential cookies may affect the functionality of the Site, particularly payment pages.
If you decline non-essential cookies, we will not place analytics cookies on your device. You can change your preference at any time by clearing your local storage and revisiting the Site, which will display the cookie banner again.
Our Site respects Do Not Track signals. If your browser sends a DNT header, we will not place non-essential cookies or enable analytics tracking, regardless of whether you have interacted with our cookie banner.
Depending on your location and the applicable law, you have the following rights regarding your personal data:
| Right | Description | How to exercise |
|---|---|---|
| Right to be informed | You have the right to be informed about how we use your data. This Privacy Policy fulfils that obligation. | Read this policy |
| Right of access (Art. 15) | You can request a copy of all personal data we hold about you, along with details of how it is processed. | Email info@gradiosafetyltd.com with "Subject Access Request" |
| Right to rectification (Art. 16) | You can request correction of inaccurate or incomplete personal data. | Email us specifying the data to correct |
| Right to erasure (Art. 17) | You can request deletion of your personal data, subject to legal retention obligations (e.g., tax records for 7 years). | Email us with "Right to Erasure Request" |
| Right to restrict processing (Art. 18) | You can request that we restrict processing of your data in certain circumstances, such as during a rectification dispute. | Email us with "Restriction Request" |
| Right to data portability (Art. 20) | You can receive your personal data in a structured, machine-readable format (e.g., JSON, CSV) and transmit it to another controller. | Email us with "Data Portability Request" |
| Right to object (Art. 21) | You can object to processing based on legitimate interests or for direct marketing. We will stop processing unless we have compelling legitimate grounds. | Email us with "Objection to Processing" |
| Rights related to automated decision-making (Art. 22) | You have the right not to be subject to decisions based solely on automated processing. We do not use automated decision-making. | N/A — we do not use automated decision-making |
| Right to withdraw consent (Art. 7(3)) | Where processing is based on consent (e.g., marketing, non-essential cookies), you can withdraw consent at any time. | Unsubscribe link in emails, or email us |
To exercise any of these rights, email info@gradiosafetyltd.com with a clear description of your request. We will respond within one month of receiving your request, as required by Article 12(3) of the GDPR. In complex cases, this period may be extended by two further months, in which case we will inform you of the extension within the first month.
We may need to verify your identity before responding to a request. This is to protect your data from unauthorised access. We will only ask for information necessary to confirm your identity.
If you believe we have not handled your personal data in accordance with this policy or applicable law, you have the right to lodge a complaint with the relevant supervisory authority. In the UK, this is the Information Commissioner's Office (ICO):
If you are in the EEA, you can lodge a complaint with your local Data Protection Authority. A list of EEA supervisory authorities is available at https://edpb.europa.eu.
You can lodge a complaint with a supervisory authority before contacting us, but we encourage you to contact us first so we can address your concerns directly.
Our services are intended for businesses and professionals. We do not knowingly collect personal data from children under 16 (the age of digital consent in the UK under the Data Protection Act 2018). If you believe we have collected personal data from a child under 16, please contact us immediately at info@gradiosafetyltd.com and we will delete the data without undue delay.
Our payment processors and banking partners also do not process payments from minors. Payment pages require the cardholder or account holder to be 18 or older.
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or the services we offer. When we make material changes, we will:
We encourage you to review this page periodically. Continued use of the Site after changes are posted constitutes acceptance of the updated policy, where consent is the legal basis for processing.
If you have a complaint about how we handle your personal data, please contact us first at info@gradiosafetyltd.com. We take all complaints seriously and will investigate and respond within 30 days.
If you are not satisfied with our response, or if you believe we have breached data protection law, you have the right to complain to the Information Commissioner's Office (ICO) in the UK, or to your local supervisory authority if you are in the EEA. Contact details for the ICO are provided in Section 12.2.
Gradio Safety LTD is registered with the ICO. Our registration can be verified on the ICO's public register.
v2.0 2026-08-28 Full rewrite — added payment processing, sub-processors, retention schedule, security measures, cookie table, TIA/Schrems IIv1.0 2026-08-27 Initial Privacy Policy