This notice covers the personal data Hugo Signal collects through this website. It is written to be read rather than to be defensible, which matters more than usual when the people reading it work in information governance.
What we collect, and only when you send it
Nothing on this site collects personal data until you submit a form. There are no advertising pixels, no third-party trackers and no cross-site identifiers.
- Enquiry form: your name, work email, organisation and its type and size, website, role, the service you are interested in, your budget range and timeframe, the procurement route where you have told us you are a public body, how you heard about us, and whatever you write in the free-text field.
- Scorecard form: your name, work email, organisation and organisation type.
Why we hold it
To reply to you, and to deliver the thing you asked for. Our lawful basis is legitimate interest — you contacted a business about its services, and answering you is the reasonable expectation.
Marketing email is separate and requires its own consent. That is the second, unticked checkbox on the scorecard form. Ticking the first does not opt you into the second, and we do not add enquirers to a mailing list.
Analytics
We use Cloudflare Web Analytics, which is cookieless and does not fingerprint visitors or build a profile across sites. There is no consent banner on this site because there is nothing on it that requires one.
Where it goes
Submissions are stored in private object storage in the UK/EU and delivered by email through Resend, our email provider. That is the complete list of processors. We do not sell personal data, we do not share it with advertising networks, and we do not pass it to partners.
How long we keep it
Enquiries that do not become engagements are deleted after 24 months. Where an enquiry becomes a client relationship, records are retained for the duration of the engagement plus six years for tax and contractual purposes. Scorecard requests are deleted after 24 months, or sooner if you unsubscribe.
Your rights
Under UK GDPR you can ask for a copy of what we hold, ask us to correct or delete it, object to processing, or ask for it in a portable format. Email hello@hugosignal.org and we will respond within one month. If you are not satisfied you can complain to the Information Commissioner's Office at ico.org.uk.
Client data during engagements
Data we handle inside a client engagement is governed by the contract and data processing agreement for that engagement, not by this notice. Where we build systems that touch personal data, the design, the lawful basis and the retention rules are agreed in writing before anything is built.
Changes
If this notice changes materially we will update the date at the top. Questions go to hello@hugosignal.org.