Privacy notice — DevForm

Who we are

DevForm LTD is the data controller for personal data collected through this site. Registered in England and Wales, company number 17407475, registered office 167-169 Great Portland Street, 5th Floor, London, W1W 5PF. For anything in this notice, write to [email protected].

What we collect

Only what you type into a form, and what you provide when you book a consultation. Depending on which form you use, that is your name, work email address, phone number, employer, job title, and whatever you write in the free-text fields — which may include details about your systems, your projects and your colleagues. We also record the time of submission, the reference number issued, and the page the form was sent from. A booking records the slot you chose and the contact details you enter on the calendar.

We run first-party, cookieless analytics on this site using self-hosted Umami. That records page views (path, referrer, browser, country) without advertising identifiers and without setting a cookie. We do not run advertising trackers. Web fonts are served by Google Fonts, which means your browser makes a request to Google when you load a page.

The consultation calendar is an embed of our self-hosted Cal.com instance. Completing a booking is processed on infrastructure we control (Hetzner, Falkenstein), not on Cal.com’s public SaaS.

Why we use it, and our lawful basis

To answer your enquiry and, where relevant, prepare a proposal — legitimate interests, or steps towards a contract
To schedule a discovery consultation — steps towards a contract
To manage change requests, support tickets and access requests under an existing engagement — performance of a contract
To keep accounting and billing records — legal obligation
To keep a record of who asked for what access and when — legitimate interests in security
To understand which pages are used, so we can keep the site usable — legitimate interests

We do not sell personal data, and we do not use what you send here for marketing to third parties.

Where it goes

Form submissions are passed from this website to our self-hosted Perfex CRM instance, which runs on infrastructure we control at Hetzner Cloud, Falkenstein (fsn1), Germany. The website itself is hosted on Cloudflare Pages. Transactional email is sent through Zoho Mail / ZeptoMail in the EU. Consultation bookings are stored in our self-hosted Cal.com instance on the same Hetzner server. Page-view analytics are stored in self-hosted Umami on that server. Cloudflare, Hetzner and Zoho act as processors under contract and do not use your data for their own purposes.

How long we keep it

Enquiries that do not become clients — 24 months from last contact
Client records, change requests and tickets — the engagement, plus 6 years
Accounting records — six years from the end of the accounting period, as required by law
Access request records — 24 months from expiry
Consultation bookings — 24 months from the appointment, unless they become a client record
Analytics page views — 24 months

Your rights

Under UK GDPR you can ask for a copy of the personal data we hold about you, ask us to correct it, ask us to delete it, object to processing based on legitimate interests, or ask us to restrict what we do with it. Email [email protected] and we will respond within one month.

If you are not satisfied with how we have handled it, you can complain to the Information Commissioner's Office at ico.org.uk, though we would rather you told us first so we can put it right.

Security

The site is served over HTTPS. Submissions travel to our CRM through a server-side relay, so no CRM credential is ever present in your browser. Access to the CRM is restricted to named DevForm staff and is reviewed quarterly.

Please do not send credentials, secrets or bank details through any form on this site. If we need those, we will agree a secure channel with you directly.

Changes

If this notice changes materially we will update the date at the top and, where the change affects an active engagement, tell you directly.