Privacy notice

01. Who is responsible for your data

The controller is Fortune Tavern Ltd, company number 17090115, registered in England and Wales. Registered office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. For any question about your data, write to [To be completed: email address].

EU representation, where required under Article 27 of the EU GDPR: [To be completed: EU representative details or confirmation that no representative is required].

02. What data we collect

Through the request form: your name, company name, phone number (including a WhatsApp number), email address and the text of your message. Only your name and a way to contact you are required; everything else is optional.

Together with a request, we store technical details of its submission: your IP address, browser identifier (user agent) and the time. We need them to limit automated spam submissions.

If you write to us on WhatsApp or by email or call us instead of using the form, we receive the data contained in that message or call.

When you open the website, the server records standard access logs: IP address, page address, time, browser identifier. Hosting provider and how long these logs are kept: [To be completed: hosting provider, server location and log retention period].

We do not buy data about you or collect it from other sources.

03. Why we process it and on what legal basis

To reply to your request, discuss your task and, if we agree, prepare and perform a contract — Article 6(1)(b) GDPR (steps taken at your request before entering into a contract, and performing it).

To reply to general questions that are not aimed at a contract — Article 6(1)(f) GDPR: our legitimate interest in answering people who contact us.

To protect the form from automated abuse (IP address, browser identifier, time) and to operate and secure the website (access logs) — Article 6(1)(f) GDPR: our legitimate interest in a working and secure website.

To keep contract and accounting documents for as long as the accounting and tax laws that apply to us require — Article 6(1)(f) GDPR: our legitimate interest in complying with those laws.

We do not use the form data for newsletters or advertising, and we do not make decisions about you by automated means, including profiling. Providing data is voluntary, but without a name and a way to contact you we cannot reply.

04. Who receives it

We do not sell your data or pass it to third parties for their own purposes. Only staff who reply to requests have access to it.

Notifications about a new request reach us through Telegram (Telegram Messenger Inc.) and by email through Mailgun (Mailgun Technologies, Inc., USA). Both are used only as a channel for delivering the message to us.

The website and the request service are hosted by: [To be completed: hosting provider and server location].

We may disclose data to public authorities only where we are legally required to.

05. Where your data is processed

Our company is registered in the United Kingdom. This does not determine where the website, request service or notification providers store and process data.

[To be completed: countries where request data is stored or accessed, notification providers and safeguards for transfers outside the UK or EEA, as confirmed for the deployed service]

06. How long we keep it

Request data, including the technical details stored with it, is kept while the conversation continues and there is mutual interest in working together, but no longer than three years after your last contact with us.

If we sign a contract, contract documents and related data are kept for as long as the laws that apply to us require: [To be completed: retention period for contract and accounting documents].

07. Your rights

You have the right to access your data, to have it corrected or deleted, to restrict its processing and to receive it in a portable format (Articles 15–18 and 20 GDPR).

Where we process data on the basis of our legitimate interest, you have the right to object at any time on grounds relating to your particular situation (Article 21 GDPR).

To exercise your rights, write to [To be completed: email address]. We will reply within one month and tell you what we have done.

You can raise a concern with the UK Information Commissioner's Office (ICO). Where the EU GDPR applies, you can also complain to the relevant EU supervisory authority.

08. Cookies and analytics

This website does not set cookies, does not store anything in your browser and uses no analytics, tracking pixels or third-party embeds. Fonts are served from our own server. That is why there is no cookie banner here.

If we ever add tools that need your consent, we will ask for it before they run and update this notice.

09. Links to other websites

The website links to WhatsApp, to our products' websites and to publications about us. When you follow such a link, the other website's own privacy policy applies; your browser may tell it which page you came from.

10. How we protect your data

The connection to the website is encrypted. Requests are stored on a server with restricted access, and the request service runs in isolation without access to other data on the server.