Privacy notice.
This notice explains how Natcroft Ltd (“Natcroft”, “we”, “us”) collects, uses, and protects your personal data when you use our website or contact us. We take this seriously, and we have written this in plain English rather than legalese.
1. Who we are
Natcroft Ltd is a company registered in England & Wales (company number: 17165895), with its registered office at 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. For data-protection matters we act as the data controller of the personal data described below. You can reach us at office@natcroft.com.
2. What data we collect
We only collect the data you give us directly, plus a minimal amount of technical data from your browser.
2.1. Data you provide via the contact form
- Your name
- Your email address
- Your company (optional)
- The nature of your inquiry and the message you send
2.2. Data your browser sends automatically
- IP address (used transiently by our hosting provider and spam-protection service)
- Browser type and version
- Pages visited and timestamps (aggregated, non-identifying server logs)
We do not use advertising cookies, tracking pixels, or third-party analytics that profile individual visitors. See our cookie notice for details.
3. Why we use it (lawful basis)
Under the UK GDPR we rely on the following lawful bases:
- Consent: when you tick the consent box on the contact form, we use your data to reply to your inquiry.
- Legitimate interests: to operate and secure this website, and to keep records of business communications we have received.
- Legal obligation: where we are required to retain records (for example, for HMRC or Companies House purposes).
4. Who we share it with
We do not sell your data and we do not share it with advertisers. We do use a small number of processors to operate the site:
- Cloudflare, Inc.: hosts this website, runs the contact-form endpoint, and provides bot protection (Cloudflare Turnstile). Cloudflare may process your IP address and a minimal interaction signal to distinguish humans from bots. See Cloudflare's privacy policy.
- Resend, Inc.: delivers the email containing your inquiry from our contact form to our inbox. Submissions are transmitted over HTTPS. See Resend's privacy policy.
- Google Fonts: web fonts are loaded from Google's CDN. Google may receive your IP address as part of serving the font files. See Google's privacy policy.
- Google Workspace: used to receive, deliver, and store correspondence related to your inquiry on our side.
We may also disclose personal data where we are legally required to do so.
5. How long we keep it
- Contact-form inquiries that do not lead to an engagement: up to 12 months, then deleted.
- Correspondence related to a client engagement: for the duration of the engagement and up to 7 years afterwards, in line with UK tax record-keeping requirements.
- Server logs: typically up to 30 days before rotation.
6. International transfers
Some of our processors (for example, Cloudflare, Resend, and Google) may process data outside the United Kingdom. Where that happens, we rely on the UK Government's adequacy decisions, standard contractual clauses, or the UK International Data Transfer Addendum as appropriate.
7. Your rights
Under UK GDPR you have the right to:
- Access the personal data we hold about you
- Ask us to correct inaccurate data
- Ask us to delete your data (where we have no continuing lawful basis to keep it)
- Restrict or object to our processing
- Port your data to another controller
- Withdraw your consent at any time (for processing we carry out on the basis of consent)
To exercise any of these rights, email office@natcroft.com. We aim to respond within 30 days.
8. Complaints
If you are unhappy with how we handle your personal data, you can complain to the UK Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would, of course, prefer it if you came to us first.
9. Changes to this notice
We may update this notice from time to time. Material changes will be flagged on this page with a new “last updated” date.