This Privacy Policy explains how fabrik5 Ltd ("we", "us", or "our") collects, uses, and protects your personal data when you visit our website, submit our contact form, or subscribe to our updates.
We are committed to protecting your privacy and processing your personal data transparently and lawfully in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations (PECR), and applicable EU GDPR requirements where relevant.
1. Data Controller
fabrik5 Ltd71–75 Shelton Street
Covent Garden
London
WC2H 9JQ
United Kingdom
Company Registration Number: 16868900
Contact email: contact@fabrik5.com
Scope: This Privacy Policy covers this website and enquiries you send us. For data that customers enter into the fabrik5 platform (object, asset, and report data), the customer remains the controller; fabrik5 processes such data solely on their documented instructions under a data processing agreement pursuant to Art. 28 GDPR.
2. Personal Data We Collect
2.1 Data you provide directly
- When you submit our contact form: your first name, last name, email address, your phone number if you choose to give it, how many properties you rent out, and the content of your message (along with anything else you choose to put in it). Also whether the box about the free trial was left ticked.
- Evidence of your consent to email: if you tick the box allowing us to email you, we additionally record the exact wording you agreed to, the time and IP address of the submission, and the time you confirmed (Section 2.2).
2.2 Double opt-in for email
We only email you if you ticked the box on the form and then confirmed the address. How it works:
- The box on the form is ticked by default. On its own it is not consent to anything — it only triggers the confirmation request. Untick it and we send you nothing at all.
- You get a single email containing a confirmation link.
- Your consent takes effect only when you click that link. That click is the unambiguous affirmative act required by UK GDPR Art. 4(11) — the pre-ticked box is not.
- If you never confirm, you get no further email from us. Your details simply sit with us as an unconfirmed enquiry.
This is what stops anyone being signed up with someone else's address, and it is how we meet the requirement in UK GDPR Art. 7(1) to be able to demonstrate your consent. HubSpot runs and sends this process for us as our data processor (Section 4.1).
You can withdraw your consent at any time, with effect for the future, using the unsubscribe link in any email or by writing to contact@fabrik5.com. That does not affect the lawfulness of anything processed beforehand. Withdrawing does not touch the details of your enquiry or your trial: we process those without relying on consent (Section 3).
2.3 Data collected automatically (hosting, security & analytics)
We use Cloudflare Web Analytics, a privacy-focused analytics service, to understand aggregate website usage such as page views, referrer, approximate location (derived from IP address), and browser and device type. Cloudflare Web Analytics does not use cookies or any other client-side storage, does not use persistent identifiers, and does not track you across different websites. We use no advertising or marketing tracking tools, and we set no non-essential cookies. Web fonts are served from our own origin rather than a third-party font network, so your IP address is not passed to any font provider.
However, as with any website, limited technical data is processed to deliver and secure the site. Our hosting and content-delivery provider, Cloudflare, automatically processes technical information such as your IP address, browser and device type, and request metadata (date/time and pages requested) in server and security logs. This is used to serve the website, protect it against attacks (for example DDoS), and maintain availability. See Sections 4 and 5.
3. Purpose and Legal Basis for Processing
| Purpose | Data processed | Legal basis |
|---|---|---|
| Deal with your enquiry and prepare your free trial | Name, email address, phone number (optional), number of properties, message | Taking steps at your request prior to entering into a contract (UK GDPR Art. 6(1)(b)); for enquiries unrelated to our products, legitimate interests in answering them (Art. 6(1)(f)) |
| Send the confirmation email and later messages about the launch and the free trial | Email address, first name | Consent (UK GDPR Art. 6(1)(a)) |
| Demonstrate your consent, and its withdrawal if you withdraw it | Consent wording, the times it was given and confirmed, the IP address used | Legal obligation to be able to demonstrate consent (Art. 6(1)(c) with Art. 7(1)) |
| Manage and maintain our email distribution list | Email address | Legitimate interests (maintaining our subscription list) |
| Prevent abuse of the form | IP address, time of submission, form content | Legitimate interests (blocking spam and automated sign-ups) |
| Host, deliver, and secure our website | Technical data (IP address, request metadata, security logs) | Legitimate interests (network and information security, site availability, and prevention of fraud or abuse) |
| Spot faults and improve what we offer, through anonymised analysis | Usage and fault data, before it is anonymised | Legitimate interests (a stable product that keeps getting better) |
| Understand aggregate website usage and performance (via Cloudflare Web Analytics) | Technical data processed in aggregate (page views, referrer, approximate location derived from IP address, browser/device type); no cookies or persistent identifiers are used | Legitimate interests (understanding and improving website usage and performance) |
The anonymised analysis serves statistics only: how often faults occur, where they cluster, which features get used. The results are aggregated so that they cannot be traced back to you or to your properties, and from that point on they are no longer personal data. We do not use these analyses for advertising, and we do not sell them.
You may withdraw your consent at any time by clicking "unsubscribe" in any email or by contacting us at contact@fabrik5.com.
4. Service Providers (Data Processors)
4.1 HubSpot — contact management and email
We manage contact-form enquiries, the contact details that come with them, and the sending of the confirmation email and later messages in HubSpot. HubSpot acts as our data processor.
- When you submit the form, the data you provide (name, email address, phone number, number of properties and message), plus the record of your consent where you gave one, is stored in HubSpot's systems.
- The form itself is served from our own origin, not by HubSpot. Your data is passed on only once you submit it, and only server to server. Your browser never connects to HubSpot, so HubSpot sets no cookies on this site and receives nothing from you if you simply read the page.
- Our HubSpot account runs in HubSpot's EU region and your data is stored there. Supporting processing outside the EU or UK — during support, for instance — remains possible. Such transfers are protected by Standard Contractual Clauses (SCCs) together with HubSpot's Data Processing Agreement and security measures.
- You can view HubSpot's privacy practices here: https://legal.hubspot.com/privacy-policy
4.2 Cloudflare — hosting, content delivery, and security
Our website is hosted and delivered through Cloudflare (Cloudflare, Inc., including Cloudflare Pages). Cloudflare acts as our hosting, content-delivery, and security processor.
- Cloudflare processes technical data (such as IP address, request metadata, and security signals) in order to host, deliver, and protect the website, including DDoS mitigation and web application firewall functions.
- We also use Cloudflare Web Analytics to measure aggregate website traffic and performance. It does not use cookies, local storage, or any other client-side tracking technology, and data is processed and reported only in aggregate.
- Cloudflare may set strictly necessary security cookies (for example to distinguish genuine visitors from bots — see Section 5).
- Cloudflare may process data on servers located outside the UK or EU; such transfers are protected by SCCs and supplementary security measures.
- You can view Cloudflare's privacy policy here: https://www.cloudflare.com/privacypolicy/
4.3 Google Workspace — business email
We run our business email on Google Workspace (Google Cloud EMEA Limited, Velasco, Clanwilliam Place, Dublin 2, Ireland). Google acts as our processor under its Cloud Data Processing Addendum.
- When you write to us through the contact form or by email, your message and your contact details are stored and processed in our Google Workspace mailboxes.
- Processing by Google LLC in the United States is possible. Those transfers rely on the EU-US Data Privacy Framework and its UK Extension, to which Google is certified, supported by Standard Contractual Clauses.
- You can view Google's privacy policy here: https://policies.google.com/privacy
5. Cookies and Similar Technologies
We do not use advertising or marketing cookies, and Cloudflare Web Analytics does not set any cookies. The only cookies that may be set are strictly necessary cookies required to deliver and secure the website. Our contact form needs none:
- Cloudflare may set security and bot-management cookies (for example
__cf_bm,cf_clearance). These are essential for protecting and delivering the site and do not require consent. - Cloudflare Web Analytics sets no cookies and uses no client-side storage; it collects aggregated, anonymised usage statistics only.
If we introduce cookie-based analytics or other non-essential cookies in the future, we will ask for your consent, provide appropriate controls, and update this policy accordingly.
6. Data Sharing
We do not sell or rent your personal data. We share data only with:
- HubSpot (managing contacts and form enquiries, sending email)
- Cloudflare (website hosting, content delivery, and security)
- Google Cloud EMEA Limited (business email through Google Workspace)
- Other service providers required to operate the website
- Regulatory or legal authorities where required by law
All processors are bound by contractual obligations (data processing agreements) to protect your data.
Should we in future offer you additional services from third parties, insurance for example, we will pass your data to that third party only if you have given your explicit consent beforehand. Without it, such a provider learns nothing about you.
7. Data Retention
- Newsletter email address: kept until you unsubscribe, or until we determine that the mailing list is inactive.
- Sign-ups you never confirmed: if you do not click the confirmation link, we do not use your address for email.
- Evidence of your consent: kept for as long as the consent lasts and for three years after you withdraw it. That period follows the ordinary limitation period, so we can show the consent for as long as it could be disputed.
- Contact-form submissions and the related email correspondence: kept for as long as necessary to handle your enquiry and for a reasonable period afterwards for our business records, after which they are deleted or anonymised.
- Server and security logs: retained by Cloudflare for a limited period in line with its standard retention practices.
After you unsubscribe, your data will be deleted or anonymised within a reasonable timeframe.
8. Your Rights
Under the UK GDPR and EU GDPR, you have the following rights:
- Right to access your personal data
- Right to rectify inaccurate data
- Right to erase your data ("right to be forgotten")
- Right to restrict processing
- Right to withdraw consent at any time
- Right to data portability
- Right to object to processing
- Right to lodge a complaint with a supervisory authority
UK supervisory authority: Information Commissioner's Office (ICO) — www.ico.org.uk
If you are in the EU, you may contact your local data protection authority.
9. International Data Transfers
Because HubSpot, Cloudflare, and Google may process data outside the UK or EU your data may be transferred internationally. These transfers are protected by:
- Standard Contractual Clauses (SCCs)
- The EU-US Data Privacy Framework and its UK Extension, where the recipient is certified
- Supplementary security measures required by UK GDPR
10. Security
We take appropriate technical and organisational measures to protect your personal data, including:
- Secure hosting
- Access controls
- Encryption where appropriate
- Data minimisation
However, no method of transmission or storage is fully secure, and we cannot guarantee absolute security.
11. Children's Privacy
Our website is not intended for children under 16, and we do not knowingly collect data from them.
12. Updates to This Policy
We may update this Privacy Policy from time to time. The latest version will always be available on this page. If changes are significant, we will notify subscribers via email.
13. Contact Us
If you have questions about this Privacy Policy or how your data is handled, please contact us at: contact@fabrik5.com
← Back to home