1. Who we are
This Privacy Policy explains how Aristral Ltd (“Aristral”, “we”, “us”, or “our”) collects, uses, and safeguards personal data when you use aristral.com or engage our services. We are the data controller for the personal data described below. Full controller details are in the card at the top of this page.
2. What we collect
- Contact details you provide via the contact form or booking flow (name, email, phone, company, message content).
- Booking metadata when you schedule a call via Google Calendar Appointment Scheduling (name, email, chosen time, timezone, and answers to any booking-form questions).
- Usage data collected by Google Analytics 4 (pages viewed, referrer, approximate location, device and browser), and by Microsoft Clarity session replay if you accept marketing cookies.
- Cookie identifiers: Google Analytics cookies, which run by default outside the EU, EEA and Switzerland and which you can opt out of in one click; marketing cookies only after you accept them in the banner.
- Engagement records from any project you commission (project briefs, deliverables, invoices, correspondence).
3. Lawful basis
We rely on the following lawful bases under UK GDPR Article 6:
- Consent: marketing cookies (Meta Pixel, Microsoft Clarity), analytics cookies for visitors in the EU, EEA and Switzerland, and marketing emails. You can withdraw at any time.
- Legitimate interest: Google Analytics 4 site statistics. Under the UK statistical purposes exception (PECR as amended by the Data (Use and Access) Act 2025) these cookies need no prior consent. We use them only to see how the site is used and improve it, never for advertising; Google processes the data for us, with Google signals and ad personalisation off. You can opt out free at any time.
- Legitimate interest: responding to enquiries, securing the site, basic server logs, fraud prevention.
- Contract: delivering services you have commissioned and the related billing.
- Legal obligation: accounting records, tax filings, and statutory retention.
4. Third-party processors
We share personal data with the following processors strictly to deliver the services they support. International transfers are protected by Standard Contractual Clauses (SCCs) where applicable.
| Processor | Purpose | Transfer |
|---|---|---|
| Google Analytics 4 | Aggregated traffic analytics | USA (SCCs) |
| Google Tag Manager | Tag orchestration for analytics and marketing | USA (SCCs) |
| Meta Pixel (Facebook) | Conversion measurement and remarketing | USA (SCCs) |
| Microsoft Clarity | Session replay and heatmap analytics | USA (SCCs) |
| Google Calendar (Appointment Scheduling) | Booking and scheduling for strategy calls | USA (SCCs) |
| Cloudflare | Edge delivery, DDoS protection, and bot management | Global edge network |
| Contabo GmbH | Server hosting for the client inbox | EU (France) |
| Meta Platforms (WhatsApp Business Platform) | Sending and receiving WhatsApp messages for client businesses | USA/EU (Meta terms, SCCs) |
See our Cookie Policy for the specific cookies each tool sets.
5. WhatsApp customer inbox
Aristral runs a self-hosted Chatwoot inbox at inbox.aristral.com for client businesses that use the WhatsApp Business Platform. The inbox may contain a customer's name, WhatsApp phone number and profile name, message content, photos and files they send, delivery status, timestamps, and notes or labels added by the business.
The client business uses this information to reply to enquiries, provide quotes, and run jobs. Aristral processes the information only on that business's instructions, under our written agreement with them. The client business is the data controller. Meta is an independent provider of the WhatsApp Business Platform and processes messages under its WhatsApp Business terms.
The inbox is hosted on an Aristral-managed server provided by Contabo GmbH in an EU data centre in France. Meta processes WhatsApp messages under its WhatsApp Business terms.
Inbox data is kept for as long as the client business uses the service. After the engagement ends, we delete it within 30 days, or sooner following a valid deletion request, unless the business is required by law to keep it.
Security measures include TLS encryption in transit, access limited to the business's authorised staff and Aristral administrators, and a default-deny firewall. To request deletion, see our Data Deletion page.
6. Retention
- Enquiry and booking data: 24 months from last contact, unless we begin a paid engagement.
- Client project and billing records: 6 years from end of engagement (HMRC requirement).
- Analytics data: retention defaults of each platform (typically 14 to 26 months for GA4).
- Session-replay recordings (Microsoft Clarity): 30 days.
- Marketing email lists: until consent is withdrawn.
7. Your rights
Under UK GDPR you have the following rights. To exercise any of them, email [email protected]. We will respond within one calendar month.
Right of access
Request a copy of the personal data we hold about you.
Right to rectification
Ask us to correct inaccurate or incomplete data.
Right to erasure
Request deletion of your data where there is no overriding lawful basis to retain it.
Right to restrict processing
Limit how we use your data in certain circumstances.
Right to data portability
Receive your data in a structured, machine-readable format.
Right to object
Object to processing based on legitimate interest, including direct marketing.
Right to withdraw consent
Where we rely on consent, you can withdraw it at any time without affecting prior lawful processing.
8. Complaints
If you are unhappy with how we handle your data, please contact us first at [email protected]. You also have the right to lodge a complaint with the UK's data-protection regulator, the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint.
9. Security
We use industry-standard technical and organisational measures including TLS 1.3 in transit, encrypted storage, role-based access controls, and least-privilege principles. We are hosted on Cloudflare's edge network with managed DDoS and WAF protection. Where engagements involve sensitive data we agree bespoke security controls in the engagement contract.
10. Changes to this policy
We may update this policy from time to time. Material changes will be notified by email where we hold one, or via a prominent notice on the site. The “last updated” date at the top of this page always reflects the current version.