Legal
Privacy statement
This site collects very little. There is no analytics, no advertising and no tracking. This page sets out exactly what is collected, why, and what you can ask us to do about it.
Who we are
Firette Ltd is the data controller for personal data collected through firette.com. We are registered in England and Wales, company number 14228074, registered office 128 City Road, London EC1V 2NX.
For anything in this statement, email info@firette.com.
What we collect
Nothing at all unless you use the contact form. Browsing the site does not create a record we hold about you beyond the standard server logs described below.
When you send us a message
The contact form asks for your first name, surname, email address and message, and optionally your telephone number and company. All of it is sent straight to us by email. It is not written to a database, and the website itself keeps no copy.
Technical data
- Your IP address, hashed. To stop the contact form being abused we limit submissions to five per hour. To do that without holding your IP address, we store only a SHA-256 hash of it alongside the times you submitted. These records are deleted automatically once they are more than an hour old.
- Server logs. Our hosting provider records requests to the site — IP address, time, page requested, browser user-agent — as a normal part of running a web server, for security and diagnostics.
- Anti-spam checks. The contact page uses Google reCAPTCHA v3, which is described under cookies and third parties below.
Why we are allowed to hold it
- To answer you. When you send an enquiry we process it on the basis of our legitimate interests — you have asked us a question and we need your details to reply, and to keep a record of the conversation.
- To protect the site. The rate limit, the anti-spam check and the server logs rest on our legitimate interest in keeping firette.com working and free of abuse.
We do not use your details for marketing, and we will not add you to a mailing list because you contacted us.
Who else sees it
- Google. The contact page loads Google reCAPTCHA, which sends technical information about your device and behaviour on that page to Google so it can judge whether you are a person or a bot. This is governed by Google's privacy policy, and may involve processing outside the UK.
- Our hosting and email providers, who process data on our instructions in order to run the site and deliver our mail.
We do not sell personal data, and we do not share it with anyone else unless the law requires it.
How long we keep it
- Contact form messages: approximately 6 months, after which they are deleted from our mailbox.
- Hashed IP records: one hour.
- Server logs: as set by our hosting provider's standard retention.
Keeping it safe
The site is served over HTTPS only, with HSTS and a content security policy. The session cookie is marked HttpOnly, Secure and SameSite. IP addresses used for rate limiting are hashed rather than stored. Configuration containing credentials is held outside the public web root.
Your rights
You can ask us to give you a copy of the personal data we hold about you, correct it if it is wrong, delete it, restrict what we do with it, or object to us holding it at all. You can also ask for it in a portable format. Write to info@firette.com and we will respond within one month.
If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk, or by calling 0303 123 1113. We would rather you raised it with us first so we can put it right.
Changes to this statement
If we change how the site handles personal data we will change this page and update the date at the top of it.