Privacy Policy

1. Introduction

Kirmela respects your privacy and is committed to protecting your personal information. This policy explains how we collect, use and protect information when you use the Kirmela website (the “Website”) or contact us.

2. Who we are

Kirmela is a UK-based independent digital product and experience consultancy.

If you have questions about this policy or how your personal information is handled, contact hello@kirmela.com.

3. What personal information we collect

Depending on how you use the Website or interact with Kirmela, we may collect:

• Contact details, such as your name and email address, when you contact us
• Information you choose to provide in correspondence or an enquiry
• Information connected with a workshop, resource or service you request
• Basic technical information generated through the operation and security of the Website, where applicable

At present, Kirmela does not actively use website analytics or non-essential tracking cookies. If that changes, this policy and any required cookie or consent controls will be updated.

4. How we use your personal information

We may use personal information to:

• Respond to enquiries and communicate with you
• Provide information, resources, workshops or services you have requested
• Take steps connected with a potential or existing business relationship
• Operate, protect and improve the Website and Kirmela’s services
• Meet legal, regulatory, accounting or other obligations that apply to us

5. Lawful bases for processing

Under UK data protection law, the lawful basis depends on why we are using your personal information. Depending on the circumstances, Kirmela may rely on:

• Contract — where processing is necessary to take steps at your request before entering into a contract, or to perform a contract with you
• Legitimate interests — where processing is necessary for Kirmela’s legitimate business interests, such as responding to business enquiries, managing professional relationships, operating the Website and improving our services, provided those interests are not overridden by your rights and interests
• Consent — where we specifically ask you to make a genuine choice about a particular use of your information
• Legal obligation — where we need to process information to comply with a legal requirement

Where we rely on legitimate interests, we consider whether the processing is necessary and proportionate and balance our interests against your rights and freedoms.

6. Data sharing

We do not sell or rent personal information.

We may share information with trusted service providers where necessary to operate Kirmela, for example website hosting, email or other business technology providers. Where providers process personal information on our behalf, we expect appropriate contractual and security safeguards to be in place. We may also disclose information where required by law.

7. International transfers

Some technology or service providers may process information outside the United Kingdom. Where this applies, Kirmela will take appropriate steps required by UK data protection law to protect personal information.

8. Data retention

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, including to meet legal, accounting or reporting requirements. Retention periods may therefore vary depending on the nature of the information and our relationship with you.

9. Cookies and analytics

At present, the Website does not actively use analytics or non-essential tracking cookies. Essential technologies may be used where necessary for the Website to operate or remain secure.

If Kirmela introduces analytics, advertising or other non-essential cookies in future, we will update our privacy information and introduce any notices or consent mechanisms required by law.

10. Your rights

Depending on the circumstances, UK data protection law gives you rights including the right to:

• Ask for access to personal information we hold about you
• Ask us to correct inaccurate or incomplete information
• Ask us to delete your information in certain circumstances
• Ask us to restrict how we use your information in certain circumstances
• Object to certain processing, including processing based on legitimate interests
• Ask for certain information to be transferred to you or another organisation where the right to data portability applies
• Withdraw consent at any time where we rely on consent, without affecting processing carried out before withdrawal

To exercise a right, contact hello@kirmela.com.

11. Complaints

If you have a concern about how Kirmela handles your personal information, please contact us first so we can try to resolve it. You also have the right to make a complaint to the UK Information Commissioner’s Office (ICO), the UK regulator for data protection.

12. Data security

We take reasonable technical and organisational measures designed to protect personal information from accidental loss, misuse, unauthorised access, alteration or disclosure.

13. Changes to this policy

We may update this Privacy Policy from time to time. The latest version will be published on the Website and the date above will be updated where appropriate.

14. Contact

For questions, requests or concerns about this Privacy Policy or your personal information, contact hello@kirmela.com.