Privacy policy

The organisation responsible for this website, and for the enquiries sent through it, is the company that operates validativesystems.com. Under the GDPR it is the data controller; under the DPDP Act it is the data fiduciary.

Its registered details are outstanding and are listed as markers below. They will be published here, and on the legal notice, before this policy goes live.

• Needsregistered legal entity name — from Gok
• Needsregistered address — from Gok
• Needscontact email address for privacy enquiries — from Gok
• Needsname and contact details of a Data Protection Officer or Grievance Officer, or confirmation that none is appointed — from Gok

Two frameworks apply. India’s Digital Personal Data Protection Act, 2023 — the DPDP Act — applies because the company processes personal data in India. The European Union’s General Data Protection Regulation — the GDPR — applies to visitors in the EU and the European Economic Area.

Where the two differ, we follow whichever gives you more. This page is written to be read by a visitor rather than by a regulator, and it is not legal advice.

There is no tracking pixel on this site, no advertising tag and no profile built in the background. The only personal data this website receives is what you type into the enquiry form and send.

Every enquiry collects:

• Your name
• Your company
• Your business email address
• Your designation or role
• The product or service the enquiry is about
• A description of your requirement, in your own words
• A phone number — this field is optional, and blank is a complete answer
• Your agreement to the consent sentence quoted below

An enquiry about a custom test rig asks for four further details, all of them about the engineering problem rather than about you: the part or system to be tested, what has to be tested about it, the test standard if one applies, and your target timeline.

The server also records the internet protocol (IP) address the enquiry was sent from, and stores it with the enquiry. It is there for spam protection and rate limiting — it is what stops the form being used to send bulk mail — and it is not used to identify you or to build any profile.

The box is not ticked for you, and the form will not send without it. The exact wording you agreed to is stored with your enquiry, so there is a record of what was asked and what was agreed.

That sentence is the whole of the permission. We do not read it as consent to add you to a mailing list, and there is no mailing list to add you to.

I agree that Validative Systems may use the details above to respond to this enquiry.

Three things, and no fourth:

• It is emailed to our enquiry inbox, which one engineer reads and answers.
• It is stored as a record on our own server, so that an enquiry is not lost if the email fails to arrive.
• It is used to answer you, and for the conversation that follows.

It is not sold, not rented, not used for advertising, and not passed to anyone else for their own purposes.

How long a record is kept is not yet decided. The retention period is outstanding below and will be stated here before this policy goes live.

• Needsenquiry inbox address — from Gok
• Needsretention period for enquiry emails and stored enquiry records — from Gok

Website analytics on this site is Plausible Analytics, chosen for one reason ahead of the others: it is cookieless.

Plausible stores nothing on your device — no cookie, no identifier in local storage, nothing to delete afterwards. It assigns you no visitor ID, collects no personal data and does not follow you across other websites. What it reports back to us is aggregate: how many people read a page, which page or search they arrived from, which country they were in and which kind of device they used. None of that singles you out, and none of it is linked to an enquiry you may later send.

That is why this site shows no cookie banner. A banner exists to ask permission for cookies that are not strictly necessary, and this site sets none at all — not for analytics, not for advertising, and none of its own. There is nothing to ask you about, so we do not interrupt you to ask it.

• Needsconfirmation that Plausible is enabled on the production build, and the region of the Plausible account — from Gok

The typefaces this site uses are served from this site’s own server. No request goes to Google Fonts or to any other font service, so your IP address is not handed to a third party in order to draw the page. A German court has held that passing visitor IP addresses to Google Fonts without consent is unlawful; self-hosting removes the question rather than answering it.

There are no embedded social media buttons, no advertising scripts and no chat widget. If a product video is added to a page later, it loads when you choose to play it and not before.

This is a static website on shared hosting. Like any web server, it keeps access logs that include IP addresses, so that faults and abuse can be investigated. Those are the hosting provider’s standard logs and they are not combined with anything else we hold.

• Needshosting provider name and the country its servers are in — from Gok
• Needsserver access-log retention period applied by the hosting provider — from Gok

Three service providers, each doing one job:

• Our hosting provider, which operates the server the website and the enquiry records sit on.
• Our email provider, which carries the enquiry email to our inbox.
• Plausible Analytics, which receives aggregate page statistics and no personal data.

Nobody else. We use no customer relationship management system, no marketing automation tool and no advertising network on this site.

• Needsnames and locations of the hosting and email providers, for the processor list — from Gok

Enquiries are read and answered by engineering in India. If you are in the EU or the EEA, that means the details you send leave the EEA and are processed in India.

You are told this before you send anything, and the consent you give is the basis on which it happens. The formal safeguard wording that applies to the transfer is outstanding below.

• Needstransfer safeguard wording for enquiries sent from the EU or EEA — from Gok

Four kinds of data, four bases:

• The enquiry details you submit: your consent, Article 6(1)(a). You give it with the tick box, and you can withdraw it at any time.
• The IP address recorded with an enquiry: our legitimate interest in keeping the form from being abused, Article 6(1)(f).
• Server access logs: our legitimate interest in running and securing the website, Article 6(1)(f).
• Aggregate analytics: our legitimate interest in knowing which pages are read, Article 6(1)(f) — and no personal data is involved in it.

Under the DPDP Act, the basis for an enquiry is the same consent, given against the notice this page provides.

Whichever law applies to you, you can ask us to:

• tell you what we hold about you, and give you a copy
• correct it, if any of it is wrong
• delete it
• stop using it, or restrict how we use it
• honour a withdrawal of the consent you gave — we stop, although withdrawing does not undo what was already done
• give you your details in a portable form (GDPR)
• raise a grievance and have it addressed (DPDP Act)

Ask by replying to any email from us, or through the contact page. The GDPR allows us one month to answer; we aim to be much quicker than that.

If you are in the EU or the EEA and are not satisfied with our answer, you can complain to your national data protection authority. Under the DPDP Act you can bring a complaint to the Data Protection Board of India once our own grievance route has been used.

• Needscontact email address for data requests and grievances — from Gok

This is a business-to-business engineering website. We do not direct it at children and we do not knowingly collect personal data from anyone under 18. The DPDP Act treats children’s data as a special category; if you believe a child has sent us something through this site, tell us and we will delete it.

If this policy changes, the new version replaces this one on this page and the effective date changes with it. We do not change it quietly.

• Needseffective date, to be set when this policy is approved — from Gok