Privacy Policy

This policy explains how Elevelay (“we”, “us”) handles personal data collected through this website. We are committed to protecting your privacy and complying with the UK General Data Protection Regulation (UK GDPR), the EU GDPR where applicable, and equivalent data-protection laws.

The data controller responsible for your personal data is Elevelay Ltd, a company registered in Scotland (SC898093), trading as Elevelay. You can reach us about any privacy matter at privacy@elevelay.com.

What We Collect

Information you give us. Through the contact / enquiry form: your name, email address, optional company name, the topic you select, and the content of your message. We do not collect special-category data (such as health, ethnicity, or political opinions), and you should not submit it through this form.

When you request a guide or resource. To send you a gated resource, we ask for your email address and, optionally, your name and company. Separately and optionally, you choose whether we may also send you related marketing. We use these details to deliver the resource you asked for and, only if you opt in, to send you occasional related updates.

Information collected automatically. Like any website, ours receives technical data from your browser when you visit - including your IP address, which pages you view, and general device and browser information. We use this in two ways: to keep the enquiry form working (see Security and Anti-Spam below) and for aggregated analytics (see Analytics below). This happens on every visit, whether or not you use the enquiry form.

By default the site sets no analytics or advertising cookies. We set one strictly necessary cookie only to remember your cookie choice, and - if you accept - analytics cookies. Full details, and how to change your choice, are in our Cookie Policy.

How We Use It

• To respond to your enquiry and arrange a discovery call.
• To provide the information or services you have asked about.
• To keep a record of our correspondence.
• To send you a resource you requested, and to record that request.
• If - and only if - you tick the optional marketing box, to send you occasional related guidance. You can withdraw that consent at any time using the unsubscribe link in those emails or by contacting us.

Our lawful basis is your consent (which you give by submitting the form and ticking the consent box) and our legitimate interest in responding to business enquiries. We do not use your enquiry details for marketing without your separate, explicit consent.

Analytics

We use privacy-friendly, aggregated analytics (Vercel Analytics) to understand how the site is used and to improve performance. These are cookieless - they store nothing on your device - and they do not track you across other websites or build a personal profile of you. Our lawful basis for this is our legitimate interest in understanding and improving how the site performs. Because the data is aggregated and does not identify you, it is not linked to you as an individual.

We may also use Google Analytics, which does set cookies. It runs only if you accept analytics cookies in the consent banner - it is off until then, and consent is our lawful basis for it. You can change or withdraw your choice at any time from our Cookie Policy. If you would rather no analytics were collected at all, you can also use any browser or extension that blocks analytics scripts.

Security and Anti-Spam

To stop automated abuse of the enquiry form, we use Cloudflare Turnstile, a privacy-focused alternative to traditional CAPTCHAs. When you submit the form, your IP address and a verification token are sent to Cloudflare so it can confirm the submission is not automated. Cloudflare does not use this to build an advertising profile of you.

We also apply a short-lived rate limit, which holds your IP address in memory for a few minutes so a single sender cannot flood the form. It is never written to disk.

Sharing and Processors

We use trusted service providers to operate the site and handle enquiries. We do not sell your personal data. Our processors are:

• Vercel - hosting and analytics. Receives technical data from every visit, and operational logs.
• Resend - transactional email. Receives the contents of your enquiry to deliver it to us, and your email address to deliver any resource you request.
• Cloudflare - bot protection (Turnstile). Receives your IP address and a verification token when you submit the form.
• Brevo - customer relationship management (CRM) and email marketing. When you submit the contact form or request a resource, receives your email address, any name and company you provided, the topic or resource you asked about, and whether you opted in to marketing, so we can follow up. You are only added to a marketing list if you gave the separate marketing opt-in.
• Google - analytics (Google Analytics), only if you accept analytics cookies. Receives usage data such as the pages you view and general device information, with your IP address anonymised.

These providers process data on our behalf under appropriate agreements.

Operational Logging

If we cannot deliver your enquiry by email - for example because our email provider is unavailable or misconfigured - our server records the failure so we can follow it up. That record contains your email address, the reason for the failure, and a short reference code. It does not contain your message, your name, or your company. We use it only to make sure an enquiry that failed to reach us is not lost, and these logs are retained by our hosting provider for a limited period and then automatically deleted.

International Transfers

Vercel, Resend, Cloudflare, and Google are US-headquartered and may process data outside your country. Brevo is headquartered in the European Union (France). Where any provider processes data outside your country, we rely on appropriate safeguards (such as Standard Contractual Clauses) to protect your information.

Retention

We keep enquiry correspondence for up to 12 months after our last contact with you about it - long enough to pick up the conversation if you get back in touch - and then delete it. The operational logs described above are kept only for the short period set by our hosting provider before they are automatically removed.

If you request a resource, we keep the resulting lead record in our CRM until it is no longer needed to follow up with you, or until you ask us to delete it. If you opt in to marketing, we keep that consent until you withdraw it or unsubscribe.

Your Rights

You have the right to access, correct, or delete your personal data, to object to or restrict processing, to data portability, and to withdraw consent at any time. To exercise any of these rights, contact us at privacy@elevelay.com. You also have the right to complain to your local data-protection authority (in the UK, the Information Commissioner’s Office).

Contact

For any privacy question, email privacy@elevelay.com.