Privacy Policy

1. Who We Are

Embli Solutions Ltd is the data controller for personal data collected through this website.

• Company name: Embli Solutions Ltd
• Trading name: Embli
• Address: Romsley Point, Bromsgrove, Worcestershire, United Kingdom
• Email: info@embli.co.uk
• Telephone: 020 4551 8822

If you have any questions about this policy or how we handle your data, please contact us using the details above.

2. What Personal Data We Collect

We collect personal data only when you actively provide it to us through forms on our website. We do not use third-party tracking, advertising cookies, or analytics platforms.

Contact & Enquiry Forms

When you submit a general contact or service enquiry, we collect:

• First and last name
• Email address
• Telephone number (optional)
• Organisation name
• Message content

Network Assessment Tool

When you submit a network assessment, we collect:

• Name and contact details
• Organisation name and sector
• Responses to assessment questions relating to your network environment

Synapse Programme Enquiries

When you enquire about the Synapse AI Pathway Programme, we collect:

• Name and contact details
• Organisation name and sector
• Details of your AI use case or challenge

CSOC Vulnerability Reports (NetHub)

When you submit a vulnerability impact report via NetHub, we collect:

• Name, email address, and telephone number (optional)
• Organisation name
• Technical details relating to the vulnerability report

Automatically Collected Data

Our web server may automatically log standard technical data including your IP address, browser type, referring URL, and pages visited. This data is used solely for security monitoring and server diagnostics and is not used for profiling or marketing purposes.

3. How We Use Your Personal Data

We use the personal data you provide for the following purposes:

• To respond to your enquiry or service request
• To provide an assessment of your network environment or AI readiness
• To investigate and act upon vulnerability reports submitted to our CSOC
• To follow up on proposals, quotations, or engagement discussions
• To fulfil our contractual obligations where a services engagement is established
• To comply with legal obligations applicable to us

We do not use your data for automated decision-making, profiling, or unsolicited marketing communications.

4. Lawful Basis for Processing

We rely on the following lawful bases under UK GDPR Article 6 to process your personal data:

• Legitimate interests (Article 6(1)(f)): To respond to enquiries and assess potential service engagements, which is a legitimate business interest that does not override your rights.
• Contract performance (Article 6(1)(b)): Where processing is necessary to fulfil a contract you have entered into with us, or to take pre-contractual steps at your request.
• Legal obligation (Article 6(1)(c)): Where we are required to process data to comply with a legal or regulatory obligation.

5. How We Share Your Data

We do not sell, rent, or share your personal data with third parties for marketing purposes.

We use the following third-party service to process form submissions on our behalf:

• Netlify, Inc. — our website hosting and form processing provider. Form data submitted through our website is transmitted to and stored by Netlify. Netlify acts as a data processor on our behalf and their data processing is governed by their Privacy Policy. Netlify is certified under EU-US and UK-US data transfer frameworks.

We may disclose personal data where required by law, court order, or to protect the rights, property, or safety of Embli Solutions Ltd, our clients, or the public.

6. Data Retention

We retain personal data for as long as is necessary to fulfil the purposes for which it was collected, and in accordance with our legal and regulatory obligations:

• Enquiries that do not proceed to engagement: up to 12 months from the date of submission
• Enquiries that progress to a client relationship: for the duration of the engagement and up to 7 years thereafter, in line with UK financial and contractual record-keeping requirements
• CSOC vulnerability reports: up to 3 years, for audit and security analysis purposes

After the applicable retention period, data is securely deleted or anonymised.

7. Your Rights Under UK GDPR

Under UK GDPR, you have the following rights in relation to your personal data:

• Right of access: to request a copy of the personal data we hold about you
• Right to rectification: to request correction of inaccurate or incomplete data
• Right to erasure: to request deletion of your data where there is no compelling reason for us to continue processing it
• Right to restrict processing: to request that we limit how we use your data in certain circumstances
• Right to data portability: to receive your data in a structured, machine-readable format where processing is based on consent or contract
• Right to object: to object to processing based on legitimate interests
• Right not to be subject to automated decision-making: we do not carry out automated decision-making or profiling

To exercise any of these rights, please contact us at info@embli.co.uk. We will respond within one calendar month of receiving your request.

8. Cookies

Our website uses only technically necessary cookies required for basic site functionality. We do not use advertising, analytics, or tracking cookies. No consent banner is required under the UK PECR for strictly necessary cookies.

If this changes, we will update this policy and introduce an appropriate consent mechanism.

9. International Data Transfers

Our website is hosted by Netlify, which may process data on servers located outside the UK. Netlify operates under the UK Extension to the EU-US Data Privacy Framework and applies appropriate Standard Contractual Clauses where required. We do not otherwise transfer personal data outside the UK.

10. Data Security

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. These measures include secure HTTPS transmission, access controls, and regular security reviews of our website and data handling processes.

While we take all reasonable steps to protect your data, no method of transmission over the internet is completely secure. If you have concerns about a specific submission, please contact us directly.

11. How to Complain

If you are unhappy with how we have handled your personal data, please contact us in the first instance at info@embli.co.uk so we can attempt to resolve the matter.

You also have the right to lodge a complaint with the UK's supervisory authority:

• Information Commissioner's Office (ICO)
• Website: ico.org.uk
• Telephone: 0303 123 1113

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. The "last updated" date at the top of this page will reflect the most recent revision. We encourage you to review this page periodically.