Clear handling. Minimal data.

Last updated · 29 August 2026

Who is responsible

Helmframe is the controller of personal information collected through this website and related business enquiries. Privacy requests may be sent to conversation@helmframe.uk.

Information we collect

If the secure enquiry route is active and you submit the form, we ask for your name, work email, organisation, service interest, current challenge and privacy acknowledgement. You may also provide your role, desired outcome and timeframe. Do not include credentials, health information or other highly sensitive material.

How we use it

We use enquiry information to understand and respond to your request, assess whether Helmframe can help and maintain reasonable business correspondence. The expected lawful basis is legitimate interests in operating and developing the consultancy and responding to prospective clients. Where a different basis is required, it will be stated at the point of collection.

How the secure form works

Cloudflare Turnstile checks the submission before it is accepted. A successful enquiry is stored in a restricted Cloudflare D1 database configured for European Union jurisdiction. During the current storage-only intake stage, no automated email alert is sent; an authorised person reviews the protected enquiry desk directly. Submitted names, email addresses and enquiry text are not written to application logs.

The protected enquiry desk uses Cloudflare Access and a separate active administrator role. Replies are prepared and explicitly confirmed by an authorised person. The reply recipient is taken from the stored enquiry rather than supplied by the browser. Email acceptance means the provider has accepted the message for delivery; it is not proof that the recipient received or read it.

Service providers and transfers

Cloudflare supports website hosting, security verification, restricted database storage, protected administrator access and operational measurement. Microsoft 365 provides the Helmframe shared mailbox for business correspondence. These providers may process information outside the UK using their applicable legal safeguards. If an approved scheduling provider is added later, its identity and privacy information will be published before activation.

Retention and sharing

Non-spam enquiry records are scheduled for redaction 12 months after the last recorded activity. Records marked as spam are scheduled for redaction after 30 days. Redaction removes the contact details, enquiry narrative and reply content while retaining a minimal operational audit record. Residual copies may remain temporarily in Cloudflare recovery systems until the applicable recovery window expires.

Information is not sold and is not used for advertising. It may be shared with professional advisers or authorities where required by law. If an enquiry becomes a client engagement, necessary correspondence may be retained separately for contractual, legal, accounting or claims purposes.

Your rights

UK data-protection law may give you rights to access, correct or erase your information; restrict or object to processing; and complain to the Information Commissioner’s Office. Contact conversation@helmframe.uk to make a privacy request.

Analytics and cookies

The website uses Cloudflare Web Analytics for aggregate operational measurement and does not use advertising trackers. If non-essential tracking is added later, this notice and the consent experience will be updated first.