Legal · Data protection

Privacy Notice

Version 1.0 · Last updated 18 August 2026 · Campley Holdings Ltd

1. Who we are

Campley Holdings Ltd ("Campley", "we", "us") is a company incorporated in England and Wales. We are the data controller for the personal data described in this notice.

Registered office: 1 Park Road, Hampton Wick, Kingston upon Thames, KT1 4AS, United Kingdom
Data-protection contact: our contact form

2. Scope

This notice covers personal data we process through this website (campley.uk) and through enquiries you send us. Our individual products and ventures operate their own privacy notices where they collect data directly; those notices govern that processing.

3. What we collect and why

Data	Source	Purpose	Lawful basis
Name, email address, message content	You, via our contact form or email	To respond to your enquiry and, where relevant, discuss working together	Legitimate interests — responding to a business enquiry you initiated
Company name, role (optional)	You	To understand the context of your enquiry	Legitimate interests
IP address, browser and device metadata, pages requested	Automatically, in server logs	Site security, abuse prevention, diagnosing faults	Legitimate interests — securing our service
Aggregate usage statistics	Analytics, only with your consent	Understanding which pages are useful	Consent

We do not collect special category data through this site, and we do not ask you for payment details here.

4. Where your data goes

We use a small number of processors, each under a data-processing agreement:

Google Cloud Platform / Firebase — hosting, logging and storage.
SendGrid — delivery of enquiry emails.

Some processors operate outside the UK. Where personal data is transferred internationally we rely on UK adequacy regulations or the International Data Transfer Addendum to the EU Standard Contractual Clauses. You can request details of the safeguards in place by emailing our contact form.

We do not sell your personal data, and we do not share it for advertising purposes.

5. How long we keep it

Enquiries: up to 24 months from your last contact with us, then deleted.
Enquiries that become a commercial relationship: retained for the duration of that relationship and for 6 years afterwards, to meet UK statutory record-keeping obligations.
Server logs: up to 90 days.

6. Your rights

Under the UK GDPR you have the right to:

be informed about how we use your data (this notice);
access a copy of the personal data we hold about you;
rectify inaccurate or incomplete data;
erase your data ("right to be forgotten") where we have no overriding basis to keep it;
restrict our processing while a concern is investigated;
data portability — receive your data in a structured, machine-readable format;
object to processing based on legitimate interests, including profiling;
withdraw consent at any time, where consent is the basis (this does not affect processing already carried out).

We do not carry out automated decision-making that produces legal or similarly significant effects on you.

To exercise any right, use our contact form. We will respond within one month. We may ask you to verify your identity first. There is no charge unless a request is manifestly unfounded or excessive.

7. Complaints

If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office: ico.org.uk, helpline 0303 123 1113.

8. Security

We apply appropriate technical and organisational measures, including encryption in transit, access control on administrative systems, and least-privilege access to data stores. No system is perfectly secure; if a breach occurs that is likely to result in a risk to your rights, we will notify the ICO within 72 hours and you directly where the risk is high.

9. Changes

If we make material changes we will update the version and date at the top of this page.