Privacy notice

Controller

Elephant and Rope Limited is the data controller for the website, direct enquiries and business outreach described here. It is registered in England and Wales under company number 15491091. Registered office: 66 Paul Street, London, United Kingdom, EC2A 4NA. Contact: info@elephantandrope.com.

Website analytics

Google Analytics is optional and remains off until you select Accept analytics. If accepted, the site may process a cookie identifier, approximate location, device and browser information, referrer and page interactions so we can understand aggregate website use. The lawful basis is consent. User-level event data is retained for no more than 14 months, and Google Analytics cookies may remain for up to two years unless you withdraw consent or delete them. The Cookie choices control in the footer lets you accept, reject or withdraw consent at any time.

Booking a call

The booking calendar is supplied by Cal.com and loads only when you choose Load booking calendar. Cal.com receives the name, email address, time zone, selected time and answers you enter. The expected lawful basis is taking steps at your request before a possible contract and, where relevant, legitimate interests in responding to business enquiries. Booking information is kept for no more than 24 months after the meeting unless it is needed for an active client relationship or legal record.

Email

If you email us, Elephant and Rope Limited and Google Workspace process your name, email address, message and any attachments. The expected lawful basis is taking steps at your request before a possible contract and legitimate interests in handling business correspondence. Enquiry email is kept for no more than 24 months after the last meaningful contact unless it is needed for an active client relationship or legal record.

Business outreach

We research businesses that may have a relevant need for engineering support, including building and maintaining software. Research records may include a person's name, business role, published work email address, company, public source URL and relevant professional business context. Sources include company websites and other legitimate public professional sources, such as business directories and professional announcements. We also record contact dates, replies and outreach preferences. These records are held in a local spreadsheet.

Initial outreach uses published business contact addresses for corporate businesses in the UK and the United States, including named work contacts where their role is relevant to the proposed services. Before contacting a business in an EU country, we check that country's rules and the contact's eligibility. We do not guess email addresses, buy personal email lists, use email tracking pixels or automate LinkedIn activity.

Where UK data protection law applies, we rely on legitimate interests in finding relevant business clients and offering useful engineering services for this research and outreach. Before each campaign, we document why the processing is necessary and balance that interest against people's rights, reasonable expectations and the likely impact on them. We use this basis only where that assessment supports it and applicable electronic marketing rules permit the contact. A publicly available address does not itself give permission to send marketing.

We use Google Workspace for email and scheduled assistance from OpenAI's Codex to research relevance, draft messages and help handle replies within campaign limits we set, with a preview before sending. OpenAI may process relevant public professional information, the parts of outreach replies needed for the task, such as a request not to be contacted, and necessary correspondence metadata, such as sender, date, subject and reply status. Access is limited to the relevant outreach correspondence; this does not involve uploading an entire mailbox. We do not use automated decisions that have legal or similarly significant effects on you.

An outreach sequence has one initial email and at most one follow-up, and stops when you reply. The initial email explains why we are contacting you, identifies the public source and links to this notice. You can object to direct marketing at any time, without giving a reason: reply to the email or select Stop business outreach to email info@elephantandrope.com. We stop marketing to you and add your address to a suppression record as soon as an objection is received.

Outreach records and retention

Unsent prospect records and records without meaningful engagement are deleted or stripped of identifying details within 90 days of collection. If a conversation becomes a meaningful business enquiry, the 24-month limit after the last meaningful contact described under Email applies, unless the information is needed for an active client relationship or legal record.

To honour an objection, we retain only the email address, objection date and reason needed to prevent further outreach for as long as we continue business outreach. This suppression record is used to respect your choice, not to market to you. Local outreach backups are kept for no more than 30 days, and suppression is reapplied before any restored records are used. Provider retention and deletion arrangements are described in the terms linked below; the local backup limit does not describe their backup systems.

Recipients and international transfers

Google Analytics, Google Workspace, Cal.com and OpenAI receive information for the purposes described above. Elephant and Rope Limited does not sell personal data. These providers may process information outside the UK, including in the United States. Their roles, processing locations, retention and transfer arrangements depend on the service and terms that apply.

A restricted transfer requires an applicable adequacy regulation or appropriate safeguards, such as the UK International Data Transfer Agreement or the UK Addendum to standard contractual clauses. The provider documents below describe their arrangements; linking to a business data processing agreement does not mean it applies to every service or account. You can contact us for information about the arrangements and safeguards applicable to your data, including how to obtain a copy.

Read the Google privacy notice, Google Workspace data processing terms, Cal.com privacy notice, OpenAI privacy notice and OpenAI business data processing terms for details. OpenAI's privacy notice covers its consumer services; content processed on behalf of business customers is covered by the applicable business agreement.

Your rights

Depending on the circumstances, you may ask for access, correction, deletion, restriction, objection or data portability. You may withdraw analytics consent without affecting earlier processing. Email info@elephantandrope.com to exercise a right. You may also complain to the Information Commissioner's Office at ico.org.uk.