Privacy Policy

Last updated: January 2026

This policy explains how Scarlet Dragonfly collects and uses personal data when you visit scarlet-dragonfly.com or contact us, and the rights you have over that data. We collect as little personal data as we can, and we never sell it.

1. Who we are

The data controller for this website is Scarlet Dragonfly, based in the United Kingdom (“we”, “us”). For any question about this policy or your personal data, email info@scarlet-dragonfly.com.

2. What we collect and why

When you contact us. If you use our contact form, email or call us, we collect your name, work email, company, the service you are interested in and anything you choose to tell us. We use this to respond to your enquiry, prepare a proposal and, if you become a client, deliver our services. Our legal basis is our legitimate interest in responding to enquiries, or taking steps at your request before entering into a contract.

When you visit the site. Our hosting and security systems automatically record technical data such as your IP address, browser type and the pages requested. We use this to keep the website secure, prevent abuse and fix problems. Our legal basis is our legitimate interest in operating a secure website.

Analytics and cookies. With your consent, we use analytics to understand how the site is used, in aggregate. Essential cookies that make the site work are set without consent. You can change your choices at any time through the cookie banner. Full details are in our Cookie Policy.

We do not use your data for automated decision-making or profiling, and we do not knowingly collect data from children.

3. Who we share it with

We share personal data only with service providers who help us run the website and our business, under contracts that require them to protect it. These include:

• our website hosting provider, GoDaddy (telephone +1 480-366-3549);
• our email service provider, which receives contact form submissions;
• WordPress plugins we use for forms, security, cookie consent and statistics, some of which are provided by Automattic (Jetpack and WordPress.com statistics);
• Google Fonts, which delivers the fonts used on this site and receives your IP address when the page loads;
• TrustedSite, which displays our website security certification badge;
• Cloudflare Turnstile, which checks contact form submissions to block spam and automated abuse, and processes technical data such as your IP address and browser characteristics to do so.

We may also disclose data where the law requires it, or to protect our rights or the safety of others.

4. International transfers

Some of our providers process data outside the UK and European Economic Area, including in the United States. Where this happens, we rely on adequacy decisions (such as the UK–US Data Bridge and EU–US Data Privacy Framework) or on standard contractual clauses approved by the relevant authorities.

5. How long we keep it

We keep personal data for no longer than 2 years. Enquiries that do not lead to work are deleted within 2 years. Client records are kept for up to 2 years after our relationship ends, unless the law requires us to keep them longer. Website security logs are kept for no longer than 2 years.

6. How we protect it

As a security company, we apply the controls we recommend to our clients. These include encrypted connections (HTTPS), multi-factor authentication for site administrators, a web application firewall, restricted access to personal data and regular software updates.

7. Your rights

Under UK and EU data protection law (the UK GDPR and the EU GDPR), you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data deleted;
• restrict or object to how we use it;
• receive your data in a portable format;
• withdraw consent at any time, where we rely on consent.

To exercise any of these rights, email info@scarlet-dragonfly.com. We will respond within one month. You also have the right to complain to a data protection authority. In the UK this is the Information Commissioner’s Office (ico.org.uk). In the EU, it is the authority in the country where you live or work.

8. Changes to this policy

We may update this policy from time to time. The latest version will always be on this page, with the date it was last updated.