Privacy Policy

1. Scope and responsibility

This Privacy Policy explains how Grelmont Architecture handles personal information in connection with our website, business enquiries and remote technology services. It covers information communicated to us, information needed to manage client relationships and limited technical information associated with operating the website. It does not replace a separate data processing agreement where we process information solely on a client’s instructions.

Grelmont Architecture provides IT solutions, software architecture and technology consulting. Our contact details appear at the end of this policy. The application of privacy rights depends on your location, the nature of the information and the laws that apply to a particular activity. We do not use this policy to claim a legal certification or to suggest that every privacy law applies to every interaction.

2. Information you provide

Information you communicate during an enquiry or engagement may include your name, business email address, company name, telephone number, requested service and the details you choose to share about a project. During a paid engagement, we may also need billing information, business contact records, agreed requirements, project correspondence and information necessary to deliver the contracted work.

Please provide only the information relevant to the discussion. A general website enquiry should not contain passwords, authentication secrets, full payment card information, government identification documents, health information or sensitive production datasets. Where an engagement requires confidential access or personal data, the parties should agree on the purpose, permissions and suitable transfer channels before that material is provided.

3. Technical information and website operation

The hosting platform and related infrastructure may process technical information such as an IP address, browser and device characteristics, requested pages, timestamps and diagnostic records to deliver the website, maintain security and investigate errors. Some information may be processed through cookies or similar technologies depending on the active Shopify configuration, theme and installed services.

Our Cookie Policy explains the purposes of these technologies and the available controls. We do not treat a published policy as consent to optional tracking. Where consent is required, optional technologies should be used only according to the preferences recorded through the relevant privacy controls. Technical information associated with a website visit is different from the project details you choose to communicate to us.

4. Why information is used

We use relevant information to understand enquiries, discuss requirements, prepare proposals, communicate with business contacts and administer agreed services. Client information may be used to schedule work, maintain project records, provide technical support, issue invoices and address questions or disputes. Limited technical information helps deliver the website, identify failures, prevent misuse and protect the reliability of the service.

We may also retain or disclose information where reasonably necessary to meet legal obligations, maintain accounting records, establish or defend legal claims and protect people or systems from harm. We do not use an enquiry as blanket permission for unrelated marketing. Any marketing communications must have an appropriate basis, and you may ask us to stop them. Operational communications concerning an active engagement may still be necessary.

5. Legal grounds where required

Where applicable law requires a legal basis, processing may be necessary to take steps at your request before a contract or to perform an agreement with you. Some processing may be necessary for legitimate business interests, such as responding to business enquiries, maintaining service records or protecting systems, provided those interests are not overridden by your rights. Other processing may be required by law.

Where consent is the appropriate basis, you may withdraw it using the relevant control or by contacting us. Withdrawal does not affect the lawfulness of processing that took place before it and does not automatically require deletion of records that must be kept for another valid reason. We assess the applicable basis against the purpose and context rather than relying on the same basis for every activity.

6. Service providers and other disclosures

Information may be shared with service providers that support website hosting, business communications, document management, accounting, payment administration or the delivery of contracted technical services, but only as relevant to those functions. Shopify supplies the website hosting platform and may process technical information in accordance with its role and applicable terms. Additional tools used for a client project will depend on its agreed scope.

We may disclose information to professional advisers where necessary, in response to a valid legal requirement, to protect legal rights or in connection with a genuine business reorganization subject to appropriate safeguards. We do not authorize service providers to use confidential project information for unrelated purposes merely because they assist us. We do not use our service pages to sell personal information or run targeted advertising.

7. Client systems and project data

Consulting and implementation may require access to a client’s applications, configuration files, logs or datasets. The proposal and any required data processing agreement should establish the roles of the parties, permitted purposes, access controls and instructions. Clients are responsible for identifying the information involved and confirming that they have authority to provide it for the agreed work.

Where we act as a service provider or processor, we handle project personal data according to the applicable agreement and instructions rather than using it for independent marketing. Access should be limited to the systems and information necessary for the engagement. Where practical, testing should use minimized or representative data. Please discuss special categories of data, regulated information or confidentiality requirements before sharing them.

8. Security and access management

Appropriate safeguards depend on the information, the systems involved and the engagement. They may include access restrictions, individual accounts, secure communication channels, confidentiality obligations and controls over the retention of project materials. Clients should use the agreed channels for credentials and revoke temporary permissions when they are no longer required.

No website, communication method or storage system can be guaranteed completely secure. If you suspect that information relating to an engagement has been exposed or sent to the wrong recipient, contact us promptly with enough detail to investigate, without repeating sensitive content unnecessarily. We will assess incidents and any notification duties in accordance with applicable requirements and the relevant agreement.

9. Retention and deletion

We retain personal information for as long as reasonably necessary for the purpose for which it is held, taking into account an active enquiry or engagement, accounting obligations, recordkeeping requirements, security needs and potential legal claims. An unanswered or closed enquiry generally requires less retention than a signed project agreement, invoice or material delivery record.

Retention periods can differ across records and service providers. Information that is no longer needed should be deleted, anonymized or otherwise handled according to the applicable agreement and operational process. A deletion request may not result in immediate removal from every backup or legally required record. Where we retain information after a request, we will explain the relevant reason when the law requires us to do so.

10. International processing

Remote services and hosted business tools may involve processing in more than one jurisdiction. A recipient’s location can depend on the platform, the client’s chosen systems and the infrastructure used to deliver the service. Privacy laws and government access rules may differ between those locations.

Where applicable law restricts international transfers, the relevant parties must use the required transfer mechanism or other lawful basis and any appropriate supplementary safeguards. We do not assume that a website visit or a general enquiry removes those obligations. Contact us if the location of project data or a specific transfer restriction is material to your proposed engagement so that it can be addressed before access is granted.

11. Your choices and privacy requests

Depending on applicable law, you may have rights to request access to personal information, correction of inaccurate records, deletion, restriction, portability or an objection to certain processing. You may also have rights concerning optional tracking, targeted advertising or the sale or sharing of personal information if those activities and the relevant law apply. You can use available website privacy controls and contact us for assistance with a rights request.

We may ask for information reasonably necessary to verify your identity and authority before disclosing or changing records. Authorized representatives may need to show permission. We will respond within the timeframe required by applicable law and explain any lawful limitation or refusal. Where a right of appeal applies, you may ask us to review the decision. You may also contact the competent privacy regulator where that right is available. We do not penalize you for exercising applicable privacy rights.

12. Children, external services and policy changes

The website and services are intended for business use and are not directed to children. Do not submit a child’s personal information as part of a general enquiry. If you believe such information has been provided inappropriately, contact us so that we can assess and address it.

Third-party platforms used in an engagement may have their own privacy notices and responsibilities. Review those notices where relevant; this policy does not control an independent provider’s activities. We may update this policy when our practices, services or legal obligations change. The effective and updated dates shown above identify the current version. Material changes will be communicated when required. For privacy questions or requests, use the contact details below and identify the information or interaction concerned without sending unnecessary sensitive data.