Privacy notice

Who we are

Common Mechanics Ltd is the data controller for everything described on this page. We are registered in England and Wales, company number 17385700, with a registered office at 71–75 Shelton Street, London, WC2H 9JQ.

For anything to do with privacy or your data, email privacy@commonmechanics.io.

What we process, why, and on what basis

Visiting this site

Our hosting provider receives your IP address, the page you asked for and standard request headers such as your browser and language. No website can serve or protect a connection without them, and ours is no exception. The provider processes this data at its edge on our behalf to route and deliver the page and to defend the site against attack and abuse, and retains it under its own retention schedule. Which company that is, and where it processes the data, is recorded in the sub-processor list on our data processing page.

Purpose. Delivering this website and keeping it available and secure.

Lawful basis. Legitimate interests, Article 6(1)(f) — running a site people can reach and defending it from attack.

Analytics, if you accept them

Analytics run here only if you accept them. Until you do, nothing is stored on your device and nothing is sent anywhere. If you accept, our analytics provider records the pages you open and the links and buttons you interact with, together with technical details of the visit — browser, operating system, screen size, language, the site that referred you, and an approximate location worked out from your IP address. All of it hangs off a random identifier kept in your browser rather than off your name, and we make no attempt to work out who you are from it.

Purpose. Understanding how this site is used so we can improve it, and judging whether this is analytics we would be willing to put on the sites we build for other people.

Lawful basis. Consent, Article 6(1)(a). You can withdraw it at any time and as easily as you gave it — the controls are below.

Emailing us

If you write to privacy@commonmechanics.io or to any of the team addresses published on this site, we process your email address, your name if you give it, anything else you put in the message or its attachments, and our reply.

Purpose. Receiving and responding to email queries.

Lawful basis. Performance of a contract or steps taken at your request before entering one, Article 6(1)(b), where you are asking about working with us. Otherwise legitimate interests, Article 6(1)(f) — replying to people who get in touch. If you send us a request about your own data, we handle it under our legal obligation, Article 6(1)(c).

Please do not send us special-category data — health, beliefs, anything of that kind. We have no reason to need it and would rather not hold it.

Working with us

When your organisation works with us, or is talking to us about it, we process information about the people involved and the project: names, work email addresses, roles and the organisation you work for, and whatever you share with us in the course of the work. That includes the answers you give through our project forms at forms.commonmechanics.io — the names you enter for yourself, your organisation and your project, and your answers to the questions.

The forms are hosted by our hosting provider, and your answers are stored in a database run by our database provider; both process them in the United Kingdom. Our hosting provider also checks that a new form is being started by a person rather than an automated script. When you send a form, our email delivery provider delivers a copy of your answers to us. Your browser keeps its own copy of your answers in its local storage, so nothing is lost if your connection drops and you can pick up where you left off; it stays there until you clear it.

Purpose. Preparing and running your project with you, and referring back to it if we work together again.

Lawful basis. Legitimate interests, Article 6(1)(f) — delivering the work your organisation has engaged us for, or is considering engaging us for. Where you contract with us in your own name, performance of a contract or steps taken at your request before entering one, Article 6(1)(b).

Cookies and similar technology

Delivering the page itself needs nothing stored on or read from your device, with two exceptions. Our project forms keep a copy of your answers in your browser's local storage, which is strictly necessary to provide the form you are filling in and so needs no consent. The other is analytics, and only if you accept them: our analytics provider then sets a cookie and writes an identifier into your browser's local storage, so that the pages you open in one sitting are recognised as a single visit and a later visit is recognised as the same browser. Regulation 6 of PECR is why you are asked first rather than told afterwards.

Your answer itself is also kept in your browser's local storage — which way you answered, and when. That one we do not ask consent for, because without it we could not act on the choice you had just made, and would have to put the same question in front of you on every page. It stays in your browser.

Analytics consent

Your answer is kept in the browser you gave it in, so what follows is the answer for this browser, and changing it here changes it only here. Declining stops collection straight away and clears the identifiers analytics had stored; events already sent sit with our analytics provider, and privacy@commonmechanics.io is the way to have those deleted too.

Links out

The portfolio and team sections link to other websites, including LinkedIn and our clients' own sites. Once you click, you are on their infrastructure under their privacy policy, not ours.

Who else sees your data

• Our hosting provider — hosting and content delivery for this site, acting as our processor.
• Our email provider — stores and delivers the mail we send and receive, acting as our processor.
• Our database provider — stores the answers you give through our project forms, acting as our processor.
• Our email delivery provider — delivers your form answers to us when you send them, acting as our processor.
• Our payment processor — handles payment of our invoices. It also uses payment details for its own purposes, such as preventing fraud and meeting its legal obligations, as a controller in its own right.
• Our domain registrar — registers domain names on our clients' behalf. The registrant's contact details go to the registrar and the domain registry, which act as controllers in their own right.
• The tools we run projects in — shared documents, messaging, project tracking and design — which hold project information while we work together, acting as our processors.
• Our analytics provider — measures how this site is used, acting as our processor, and only if you have accepted analytics.

Those that also handle personal data on our clients' behalf are named — legal entity, function and processing locations — in the versioned sub-processor list on our data processing page.

The only other circumstance in which we would disclose personal data is where the law requires us to.

Where your data goes

Our hosting provider serves this site from a global network, so your request is usually handled by whichever data centre is nearest you, which may be outside the UK. It acts as our processor, and its data protection terms rely on standard contractual clauses together with the UK International Data Transfer Addendum — the safeguard UK GDPR provides for transfers of this kind. Our email provider may process mail outside the UK under the same sort of safeguard. Answers to our project forms are stored in the UK, but our email delivery provider handles the copy it delivers to us in the United States, and several of the tools we run projects in process project information there too, each under the safeguard recorded for it in the sub-processor list.

If you have accepted analytics, that data is stored in the European Union. Our analytics provider is incorporated in the United States, so its own staff may reach the data from there in order to run and support the service, and its data protection terms rely on the same kind of safeguard.

Beyond that, we make no international transfers of personal data in connection with this site or our project forms.

How long we keep things

• Request data. Connection and security logs are held by our hosting provider under its own retention schedule, and kept no longer than is needed to deliver and defend the site.
• Email. We do not run a deletion clock against your messages. We keep correspondence while it is live, and afterwards for as long as we could still need it to answer a question about the work — a contractual, tax, insurance or legal one — after which it goes. Ask us and we will tell you what we still hold from a particular exchange.
• Project information and form answers. Kept with our records of your project while we work together, and afterwards so we can come back to them if we work together again, or answer a contractual, tax, insurance or legal question about the work. Ask us and we will delete your form answers, unless we still need them for one of those questions.
• Analytics. Held by our analytics provider only for as long as it is still telling us something useful about how the site is used. Withdrawing consent stops any further collection at once; ask us and we will have what was already collected deleted as well.

Your rights

Under UK GDPR you can ask us to:

• give you a copy of the personal data we hold about you, and tell you what we do with it (access);
• correct anything that is wrong or incomplete (rectification);
• delete it (erasure);
• pause what we are doing with it while a question about it is resolved (restriction);
• hand it to you, or to someone else, in a portable machine-readable format, where we hold it by consent or under a contract and process it by automated means (portability);
• stop processing it where we rely on legitimate interests (objection).

We rely on consent for one thing, analytics. You can withdraw it at any time and as easily as you gave it, using the controls above, and withdrawing does not affect anything done beforehand. There is no automated decision-making that produces legal effects concerning you or similarly significantly affects you, and no direct marketing.

To use any of these rights, email privacy@commonmechanics.io. We will reply within one month. We may need to be reasonably sure of who you are before we hand over data — replying from the address we already correspond with is normally enough. Some of these rights have limits, and if we cannot do what you have asked we will tell you plainly why.

Complaints

Come to us first if you can, at privacy@commonmechanics.io — it is usually the fastest way to get something fixed. You are not obliged to, and you can complain to the UK regulator, the Information Commissioner's Office, at any time.

• ico.org.uk/make-a-complaint
• Helpline 0303 123 1113
• Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Changes to this notice

If we add something to this site that processes personal data — a contact form, an embed, another tool — we will update this page before it goes live and change the date at the top.