Effective date: 1 September 2026

Operator: HD2.ai (“we”, “us”, “our”). Operating from Huddersfield, United Kingdom. Contact: [email protected].

1. Scope

This policy covers the personal data we collect through this website at hd2.ai. It does not cover data we process on behalf of clients under an MSA. If you are a client or end user of an HD2-deployed system, the controller for your data is the client, and you should refer to their privacy policy.

2. What we collect

Contact form submissions. If you fill in the contact form, we collect the name, email, organisation, phone number, project details, and any attachments you send. We use this information to respond to your enquiry and to consider whether HD2.ai is the right team to help.

Server logs. Our hosting provider records your IP address, browser type, referring page, and pages visited. Logs are retained for up to 30 days for security and operational purposes, then deleted.

Cookies. The site uses a small number of essential cookies to keep the site working (for example, to remember form state). We do not currently use analytics or advertising cookies. If we add them later, we will update this policy and request consent where required.

3. How we use it

We use the data we collect to:

• Respond to enquiries you submit through the contact form
• Operate, secure, and improve the site
• Comply with legal obligations

We do not sell personal data. We do not share it with third parties for their own marketing purposes.

4. Where the data goes

Form submissions are delivered to our internal email and stored in our customer relationship management system. Server logs are stored by our hosting provider (currently Cloudflare for the edge layer, with origin hosting in the United Kingdom).

Where a subprocessor handles personal data on our behalf, we use only providers that offer adequate safeguards under UK GDPR. A current list of subprocessors is available on request.

5. How long we keep it

Contact enquiries: retained for 24 months from the date of submission, after which they are deleted unless an active commercial relationship is in place.

Server logs: 30 days, then deleted.

Backups: up to 35 days, then rotated out.

6. Your rights

Under the UK General Data Protection Regulation, you have the right to:

• Request a copy of the personal data we hold about you
• Request that we correct inaccurate data
• Request that we delete your data, subject to legal retention requirements
• Object to or restrict certain processing
• Request portability of your data in a machine-readable format
• Withdraw consent where we rely on it
• Lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk

To exercise any of these rights, email [email protected] with the subject line “Privacy request”. We will respond within one calendar month.

7. Security

We use transport encryption (HTTPS) for all traffic to the site. Form submissions are transmitted over TLS. Access to our internal systems requires multi-factor authentication. Despite these measures, no system is perfectly secure, and we cannot guarantee absolute security of data in transit or at rest.

8. International transfers

The site is operated from the United Kingdom. Where personal data is transferred outside the UK (for example, to a subprocessor in another jurisdiction), we rely on UK adequacy regulations or standard contractual clauses to ensure the transfer is lawful under UK GDPR.

9. Children

This site is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has submitted personal data through this site, contact [email protected] and we will delete it.

10. Changes to this policy

We may update this policy from time to time. The effective date at the top of this page reflects the most recent revision. Material changes will be announced on the site.

11. Contact

For any privacy-related question, email [email protected] with the subject line “Privacy”.