What we collect,and what wenever do with it.

• We collect what you type into the contact form, and nothing else about you personally.
• We use it to reply to you. We do not add you to a list, run you through a sequence, sell you, or share you with advertisers.
• We do not use tracking cookies or advertising pixels on this site.
• You can ask us to delete everything we hold about you at any time, and we will.

The data controller for this site is the business operating Past 7PM. For any privacy question, or to exercise any right described below, contact hello@past7pm.com. A named contact and registered address are provided on request and in any contract we sign with you.

When you contact us. Your name, email address, and — if you choose to provide them — company name, website, the service you are interested in, and whatever you write in the message field. These are the fields on the form; there are no hidden ones, apart from a spam trap that only automated submissions fill in.

When you browse. Our hosting provider records standard server request data — IP address, time, page requested, user agent — for security and to keep the site running. This is ordinary server logging, retained briefly, and not used to build a profile of you.

What we do not collect. We do not run advertising pixels, cross-site trackers, session recording, heatmaps, or any cookie that is not strictly necessary. That is why there is no cookie banner on this site: there is nothing to consent to.

Where the UK GDPR or EU GDPR applies, our lawful bases are:

• Steps prior to entering a contract (Art. 6(1)(b)) — replying to an enquiry you sent us.
• Legitimate interests (Art. 6(1)(f)) — keeping the site secure and available, and keeping a record of business correspondence. We have considered your interests and rights, and these uses are ones you would reasonably expect.
• Legal obligation (Art. 6(1)(c)) — retaining invoices and records where tax law requires it.

We use a small number of service providers to operate the site and our email. They process data only on our instructions, under written terms, and cannot use it for their own purposes. These currently cover website hosting, transactional email delivery, and our business email. A current list of named sub-processors is available on request, and is set out in full in any contract we sign with you.

We do not sell personal data, and we do not share it with advertisers or data brokers. If we are ever legally compelled to disclose something, we will tell you unless we are prohibited from doing so.

We work with clients internationally, and our providers may process data outside the country you are in — including outside the UK and EEA. Where that happens for data protected by the UK or EU GDPR, transfers are covered by the appropriate safeguards under Chapter V, ordinarily the Standard Contractual Clauses or the UK Addendum, together with technical measures such as encryption in transit and at rest.

• Enquiries that do not become clients: deleted within 24 months, or immediately if you ask.
• Client correspondence and records: kept for the life of the relationship and then as long as tax and limitation periods require.
• Server logs: a short rolling window, typically no more than 30 days.

Depending on where you live, you have some or all of the following rights over the data we hold about you. Where the UK or EU GDPR applies, you have all of them:

• Access — ask for a copy of what we hold.
• Rectification — have anything inaccurate corrected.
• Erasure — ask us to delete it.
• Restriction — ask us to pause processing while something is disputed.
• Portability — receive it in a machine-readable format.
• Objection — object to processing based on legitimate interests.
• Complaint — raise it with your supervisory authority. In the UK that is the Information Commissioner's Office; in the EU it is your national data protection authority.

California residents have equivalent rights under the CCPA/CPRA, including the right to know, delete, and correct, and the right not to be discriminated against for exercising them. We do not sell or share personal information as those terms are defined there.

To exercise any of these, email hello@past7pm.com. We respond within 30 days and we do not charge for it.

This notice covers this website. When we build a system for a client, that client is the controller of their customers' data and we act as their processor under a separate written data processing agreement. Everything we build is deployed into accounts owned by the client, which means their customer data stays under their control and is not pooled with anyone else's.

If you are a customer of one of our clients and want your data removed, contact that business directly — they control it, and we will assist them promptly on request.

This site is for businesses and is not directed at children. We do not knowingly collect data from anyone under 16. If you believe we have, tell us and we will delete it.

If we change this notice materially we will update the date at the top and, where the change affects data we already hold about you, tell you directly. We will not quietly broaden what we do with data you have already given us.