Privacy notice

Who we are

Common Mechanics Ltd is the data controller for everything described on this page. We are registered in England and Wales, company number 17385700, with a registered office at 71–75 Shelton Street, London, WC2H 9JQ.

For anything to do with privacy or your data, email privacy@commonmechanics.io.

What we process, why, and on what basis

Visiting this site

Our hosting provider receives your IP address, the page you asked for and standard request headers such as your browser and language. No website can serve or protect a connection without them, and ours is no exception. The provider processes this data at its edge on our behalf to route and deliver the page and to defend the site against attack and abuse, and retains it under its own retention schedule. Which company that is, and where it processes the data, is recorded in the sub-processor list on our data processing page.

Purpose. Delivering this website and keeping it available and secure.

Lawful basis. Legitimate interests, Article 6(1)(f) — running a site people can reach and defending it from attack.

Analytics, if you accept them

Analytics run here only if you accept them. Until you do, nothing is stored on your device and nothing is sent anywhere. If you accept, our analytics provider records the pages you open and the links and buttons you interact with, together with technical details of the visit — browser, operating system, screen size, language, the site that referred you, and an approximate location worked out from your IP address. All of it hangs off a random identifier kept in your browser rather than off your name, and we make no attempt to work out who you are from it.

Purpose. Understanding how this site is used so we can improve it, and judging whether this is analytics we would be willing to put on the sites we build for other people.

Lawful basis. Consent, Article 6(1)(a). You can withdraw it at any time and as easily as you gave it — the controls are below.

Emailing us

If you write to privacy@commonmechanics.io or to any of the team addresses published on this site, we process your email address, your name if you give it, anything else you put in the message or its attachments, and our reply.

Purpose. Receiving and responding to email queries.

Lawful basis. Performance of a contract or steps taken at your request before entering one, Article 6(1)(b), where you are asking about working with us. Otherwise legitimate interests, Article 6(1)(f) — replying to people who get in touch. If you send us a request about your own data, we handle it under our legal obligation, Article 6(1)(c).

Please do not send us special-category data — health, beliefs, anything of that kind. We have no reason to need it and would rather not hold it.

Cookies and similar technology

Delivering the page itself needs nothing stored on or read from your device. The exception is analytics, and only if you accept them: our analytics provider then sets a cookie and writes an identifier into your browser's local storage, so that the pages you open in one sitting are recognised as a single visit and a later visit is recognised as the same browser. Regulation 6 of PECR is why you are asked first rather than told afterwards.

Your answer itself is also kept in your browser's local storage — which way you answered, and when. That one we do not ask consent for, because without it we could not act on the choice you had just made, and would have to put the same question in front of you on every page. It stays in your browser.

Analytics consent

Your answer is kept in the browser you gave it in, so what follows is the answer for this browser, and changing it here changes it only here. Declining stops collection straight away and clears the identifiers analytics had stored; events already sent sit with our analytics provider, and privacy@commonmechanics.io is the way to have those deleted too.

Links out

The portfolio and team sections link to other websites, including LinkedIn and our clients' own sites. Once you click, you are on their infrastructure under their privacy policy, not ours.

Who else sees your data

• Our hosting provider — hosting and content delivery for this site, acting as our processor.
• Our email provider — stores and delivers the mail we send and receive, acting as our processor.
• Our analytics provider — measures how this site is used, acting as our processor, and only if you have accepted analytics.

Each of them is named — legal entity, function and processing locations — in the versioned sub-processor list on our data processing page. That list is where we keep the record current.

The only other circumstance in which we would disclose personal data is where the law requires us to.

Where your data goes

Our hosting provider serves this site from a global network, so your request is usually handled by whichever data centre is nearest you, which may be outside the UK. It acts as our processor, and its data protection terms rely on standard contractual clauses together with the UK International Data Transfer Addendum — the safeguard UK GDPR provides for transfers of this kind. Our email provider may process mail outside the UK under the same sort of safeguard.

If you have accepted analytics, that data is stored in the European Union. Our analytics provider is incorporated in the United States, so its own staff may reach the data from there in order to run and support the service, and its data protection terms rely on the same kind of safeguard.

Beyond that, we make no international transfers of personal data in connection with this site.

How long we keep things

• Request data. Connection and security logs are held by our hosting provider under its own retention schedule, and kept no longer than is needed to deliver and defend the site.
• Email. We do not run a deletion clock against your messages. We keep correspondence while it is live, and afterwards for as long as we could still need it to answer a question about the work — a contractual, tax, insurance or legal one — after which it goes. Ask us and we will tell you what we still hold from a particular exchange.
• Analytics. Held by our analytics provider only for as long as it is still telling us something useful about how the site is used. Withdrawing consent stops any further collection at once; ask us and we will have what was already collected deleted as well.

Your rights

Under UK GDPR you can ask us to:

• give you a copy of the personal data we hold about you, and tell you what we do with it (access);
• correct anything that is wrong or incomplete (rectification);
• delete it (erasure);
• pause what we are doing with it while a question about it is resolved (restriction);
• hand it to you, or to someone else, in a portable machine-readable format, where we hold it by consent or under a contract and process it by automated means (portability);
• stop processing it where we rely on legitimate interests (objection).

We rely on consent for one thing, analytics. You can withdraw it at any time and as easily as you gave it, using the controls above, and withdrawing does not affect anything done beforehand. There is no automated decision-making that produces legal effects concerning you or similarly significantly affects you, and no direct marketing.

To use any of these rights, email privacy@commonmechanics.io. We will reply within one month. We may need to be reasonably sure of who you are before we hand over data — replying from the address we already correspond with is normally enough. Some of these rights have limits, and if we cannot do what you have asked we will tell you plainly why.

Complaints

Come to us first if you can, at privacy@commonmechanics.io — it is usually the fastest way to get something fixed. You are not obliged to, and you can complain to the UK regulator, the Information Commissioner's Office, at any time.

• ico.org.uk/make-a-complaint
• Helpline 0303 123 1113
• Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Changes to this notice

If we add something to this site that processes personal data — a contact form, an embed, another tool — we will update this page before it goes live and change the date at the top.