Privacy

Who we are

This website is run by Grafty Ltd, a company registered in England and Wales under company number 14663094. Our registered office is 163 Fairview Road, Stevenage, SG1 2NE. KK Digital is a trading name of Grafty Ltd.

We’re the controller of the personal data described on this page, which means we decide how it’s used and we’re responsible for it. Our registration number with the Information Commissioner’s Office is ZB549510.

To ask anything about your data, email hello@grafty.uk or write to us at the registered office.

What this covers

This notice covers grafty.uk, the demo request form on it and the emails you send us.

It doesn’t cover the Grafty software that customers log in to. A trade business that uses Grafty is the controller of its own customers’ details. We handle those details on its behalf, under the separate subscription terms each customer is given before they sign up.

What we collect

Demo requests

The form on our demo page asks for your first name, business name, trade and email address. You can add a phone number if you want to.

We use those details to reply to you, arrange the demo and keep a record of what was said. Your request is saved as a contact record in our CRM platform.

You don’t have to give us any of this. Without a name, a business, a trade and an email address we can’t set a demo up.

Asking for a demo doesn’t put you on a mailing list.

Emails you send

If you email us, we keep your message, your email address and anything else you choose to tell us. That’s so we can answer you and keep track of the conversation.

Site analytics

We use Fathom Analytics to count visits and see which pages get read, so we can improve the site. Fathom doesn’t use cookies and doesn’t build a profile of you across other websites.

To count visitors, Fathom briefly processes your IP address and your browser’s user agent. It turns them into a one-way hash that only works on this site and is built with a salt that changes every day. Fathom says the analytics records it stores hold that hash and have no field for your raw IP address. Those records also hold the page you viewed, the site that sent you, your browser and device type, a rough location and any campaign tags in the link. You can read the detail in Fathom’s data journey.

These figures don’t tell us who you are and we don’t try to work it out. The law can still treat a hash like this as personal data, which is why it’s listed here.

The bot check

The demo form uses Cloudflare Turnstile to tell people apart from bots. It loads when you first touch the form. Cloudflare says Turnstile looks at signals such as your IP address, your browser’s user agent and a TLS fingerprint. It also says it can’t directly identify you from those signals and that Turnstile doesn’t read what you type into the form.

Cloudflare uses the same signals to improve Turnstile’s bot detection. For that purpose it acts as a controller in its own right under its Turnstile privacy addendum.

Server logs

Cloudflare hosts this site and runs the endpoint the demo form posts to. Like any host, it logs each request, including the IP address, the page asked for, the time and the browser type. Those logs are there to keep the site running and secure.

What we leave out

This site has no advertising pixels, no Google Analytics, no tag manager and no chat widget. Its fonts are served from grafty.uk, so loading a page doesn’t contact a font provider.

Our lawful bases

Data protection law says we need a lawful basis for each use of your data. These are ours.

We don’t rely on consent for anything on this site. If that ever changes we’ll ask you first and you’ll be able to withdraw it at any time.

Who sees it

We don’t sell your data and we don’t pass it to anyone for their own marketing.

These companies handle it for us as our processors.

• Cloudflare hosts the site, runs the form endpoint and provides the Turnstile bot check.
• Our CRM platform provider stores demo requests as contact records in our account. It’s based in the United States.
• Fathom Analytics produces the site statistics.
• Our email provider carries and stores the emails you send us.

The full list of processors is available on request. Email hello@grafty.uk and we’ll send it.

We’ll also share data where the law requires it, for example with a court or a regulator.

Data outside the UK

Our CRM platform provider is based in the United States, so your demo request is stored there.

Cloudflare and Fathom Analytics both run international networks, so some of the data they handle for us may be processed outside the UK as well.

Where personal data leaves the UK, we rely on the safeguards in each provider’s data processing terms. Those are the UK International Data Transfer Addendum or the UK extension to the Data Privacy Framework.

Ask us and we’ll tell you which safeguard covers a transfer and how to get a copy of it.

How long it’s kept

• Demo requests that don’t lead to you becoming a customer are deleted 12 months after our last contact with you.
• If you become a customer, your details become part of your customer record. The subscription terms you’re given before sign-up say how long that’s kept.
• We keep emails for as long as we need them to deal with what you asked and to keep a record of our dealings with you, and we review what we hold once a year.
• Server logs and bot check signals are held by Cloudflare for the periods set out in its own privacy policy. We don’t keep a copy of them.
• Analytics records hold no name and no contact details. They stay in our Fathom account as visit statistics until we delete them or close the account.

Your rights

Data protection law gives you rights over your personal data. You can ask us to:

• give you a copy of it
• correct it if it’s wrong or incomplete
• delete it
• limit how we use it
• send it to you or to another company in a format that can be reused

There’s also a right to object to any use that rests on our legitimate interests. That covers most of what’s on this page, including the analytics.

To use any of these rights, email hello@grafty.uk. It’s free in almost every case and we have one month to reply. A complicated request can take longer and we’ll tell you if yours will.

Some of these rights only apply in certain situations. We’ll explain why if one doesn’t apply to your request.

Making a complaint

If you’re unhappy with how we’ve handled your data, tell us at hello@grafty.uk. We’ll acknowledge your complaint within 30 days, look into it and tell you the outcome without undue delay.

You can also complain to the Information Commissioner’s Office, the UK’s data protection regulator, at ico.org.uk/make-a-complaint. There’s no need to come to us first.

No automated decisions

We don’t make decisions about you by automated means alone and we don’t profile you.

The Turnstile bot check is automatic. All it decides is whether the form accepts a submission. If it blocks you by mistake, email us and we’ll book your demo that way.

Changes to this notice

We’ll update this page whenever what we do with data changes. The date at the top shows the latest version. If we plan to use details you’ve already given us in a new way, we’ll tell you before we start.