Privacy policy

1. Who we are

This website is run by Mountev Ltd, a company registered in England and Wales (company number 11040898). Our registered office is 86-90 Paul Street, London, EC2A 4NE. We are registered with the Information Commissioner’s Office (ICO) under registration number ZA829562.

For the personal data described in this policy, Mountev Ltd is the data controller. If you have any questions about your data, contact us at info@mountev.co.uk, call 020 7859 4682, or write to the address above.

2. What we collect and why

When you visit our website

• Usage statistics: pages viewed, how you arrived (for example, from a search engine), approximate location (town or region), device and browser type. We also count when someone sends an enquiry or clicks our phone number or email address. This tells us which pages are useful and helps us improve them. See Cookies.
• Security logs: your IP address, browser and the pages you request are checked by our firewall to block attacks and spam.

Lawful basis: our legitimate interests in running a secure website and improving it. For analytics cookies we also rely on the statistical-purposes exemption in the Privacy and Electronic Communications Regulations, and you can opt out at any time.

When you contact us

If you use our contact form, email us or call us, we collect your name, email address, any organisation or phone number you give us, the topic you choose and your message. We use this to reply, to answer your questions and to prepare any quote or proposal you ask for.

The contact form is protected by Google reCAPTCHA, which checks that submissions come from a person rather than a spam bot. reCAPTCHA collects information about your device and how you use the page. It is subject to Google’s Privacy Policy and Terms of Service.

Lawful basis: our legitimate interests in replying to enquiries, or taking steps at your request before entering into a contract.

If we contact you about our services

We sometimes write to people at organisations we think our services could help, such as charities, membership bodies and web agencies. To do this, we use business contact details that are published publicly: on the organisation’s own website, in a job advert or tender notice, or on a public register such as the Charity Commission’s. We record your name, job title, work email address, organisation and the public information that made us think we could help. We also keep a note of when we contacted you and any reply.

Every message we send explains how to tell us you don’t want to hear from us. If you ask us to stop, we will. We keep a minimal record of your email address and organisation so that we don’t contact you again by mistake.

Lawful basis: our legitimate interests in telling organisations about relevant services. We only email business addresses, and you can object at any time.

If you are a client, partner or supplier

We hold the contact details of the people we work with, along with project correspondence, agreements, quotes, invoices and payment records. We use these to deliver our services, manage the relationship, take payment and meet our accounting and tax obligations.

Lawful basis: performance of a contract, our legal obligations (for example, keeping accounting records) and our legitimate interests in running our business.

We don’t make decisions about you based solely on automated processing, and we don’t use your data for profiling or advertising.

3. Data we handle on behalf of our clients

We host, support and develop websites, CiviCRM databases and automations for our clients. When we do this, the client (for example, a charity or membership body) is the data controller and we act as its data processor. We follow the client’s instructions under a written agreement and do not use that data for our own purposes.

If your details are held by one of our clients, for example as a member, supporter or donor, that organisation’s privacy notice applies. Please contact them directly about your data. If you contact us instead, we will pass your request on to them.

4. Cookies

Cookies are small text files a website stores in your browser. We don’t use advertising or cross-site tracking cookies.

Google Analytics is set up to collect statistics only. We have not enabled advertising features, and Google Analytics does not store IP addresses. Google keeps the event-level data for up to 14 months; we see only aggregated reports.

Your choice is saved in this browser only. You can also block or delete cookies in your browser settings, or install Google’s Analytics opt-out add-on.

5. Who we share data with

We don’t sell personal data. We share it only with service providers who help us run our business. They process it on our instructions and under contracts that protect it:

• Google: business email and documents (Google Workspace), website statistics (Google Analytics) and spam protection (reCAPTCHA).
• Amazon Web Services: hosting for this website and its backups (UK data centres).
• Wordfence (Defiant Inc.): website firewall and security scanning.
• Our accounting software, accountants, bank and payment providers: for invoicing, payments and statutory accounts.

We may also share data with professional advisers, or where the law requires it (for example, with HMRC or the police), or to protect our rights. If our business were ever sold or restructured, data would transfer to the new owner under the same protections.

6. International transfers

Some of our providers, including Google and Defiant, may process data outside the UK, mainly in the United States. Where they do, the transfer is protected by UK adequacy regulations (such as the UK Extension to the EU-US Data Privacy Framework) or by the ICO’s International Data Transfer Agreement or Addendum.

7. How long we keep data

8. How we protect data

Our website is served over an encrypted connection (HTTPS) and hosted in UK data centres, with a firewall, malware scanning and regular backups. Access to personal data is limited to the people who need it and protected by strong passwords and, where available, two-factor authentication. If a data breach were likely to put you at risk, we would tell you and the ICO as the law requires.

9. Your rights

Under UK data protection law you have the right to:

• be told how we use your data (this policy);
• get a copy of the personal data we hold about you;
• have inaccurate data corrected;
• have your data deleted;
• restrict how we use your data;
• object to our use of your data. Your objection to direct marketing is absolute: if you tell us to stop, we stop;
• receive your data in a portable format, where this applies;
• not be subject to decisions based solely on automated processing.

To use any of these rights, email info@mountev.co.uk. We may need to confirm your identity. We will respond within one month, and there is normally no charge.

10. How to complain

If you’re unhappy with how we’ve handled your personal data, please tell us first. Email info@mountev.co.uk with “Data protection complaint” in the subject line, or call 020 7859 4682. We will acknowledge your complaint within 30 days, look into it properly, keep you updated and tell you the outcome without undue delay.

You also have the right to complain to the Information Commissioner’s Office, the UK data protection regulator: ico.org.uk/make-a-complaint or 0303 123 1113.

11. Changes to this policy

We will update this page when our practices change and show the date of the latest version at the top.