What happens when we contact each other.
This notice covers carefully targeted business outreach, website enquiries, calendar bookings and optional local campaign attribution. Processing inside a client engagement is governed separately by that engagement's service agreement and data-processing documents.
Page effective · 18 August 2026 · outbound business-contact section approved; source-disabled browser measurement reviewed 18 August 2026
Who is responsible for your information
Mach Lilies Limited (company number 14149947, registered in England & Wales, registered office 22 Lanchester Close, Birmingham, B12 9AG, United Kingdom) is the controller for the personal information described on this page. Write to hey@machlilies.com about access, correction, deletion or any other privacy question.
The short contact form asks for your name, work email, practice name and a one-sentence workflow description. If you allow analytics, it can also carry the first and most recent bounded campaign labels and build-defined landing classifications described below. We use those details to read the enquiry, decide whether to reply and arrange a useful next step. Submitting the form does not subscribe you to marketing.
The readiness scorecard calculates its result in your browser. Its closed answers, current step and whether the result was shown stay only in session storage in that tab. Nothing answer-derived is sent unless you explicitly submit the single optional result-email form. That request includes your email, a transactional acknowledgement, fit tier, assessment version, stable reason codes and fixed form/offer identifiers. If you allow analytics, it can also include a bounded source plus the first and most recent campaign and landing classifications. It does not send raw answer bands, the bottleneck label, your name, practice, role, phone, full page URL or referrer. We use the submitted information to send the one result email and respond about the next step you requested; it does not subscribe you to marketing.
The complete first-party storage allowlist, including every active key, purpose, field and lifetime, is published in the cookie and browser-storage notice.
Do not send client records, tax data, credentials, special-category information or system access details through the website.
When we contact a business
Public availability is not consent. We use a small, checked business record to decide whether a one-to-one introduction is relevant.
We may use a company's name, number, active status and legal form, official website, publicly described record-chasing process, a published company-domain work email, a work name or title where necessary, the source and retrieval date, and our evidence-based relevance score. Sources are Companies House and pages published by that company on its official website. The first email identifies the source and links to this notice.
We use this information to identify UK accountancy limited companies and LLPs that may benefit from a controlled client-record chasing workflow, prepare a relevant introduction, answer replies, avoid unwanted repeat contact, and understand whether the introduction leads to a website visit or booked assessment. Our lawful basis is legitimate interests in proportionate business-to-business marketing, after assessing purpose, necessity and impact.
We do not buy prospect lists, guess named addresses, probe mail servers, use tracking pixels, or target sole traders, general partnerships, personal or free-mail addresses, uncertain legal forms, or non-UK recipients through this workflow. We do not intentionally collect home addresses, dates of birth, family information, special-category data, criminal-offence data or protected-trait inferences.
You have an absolute right to object to direct marketing. Reply “no”, “stop” or “unsubscribe”, or write to hey@machlilies.com. We pause the whole account on any reply and retain only the minimum suppression marker needed to prevent recontact after an objection.
What we use it for, and the lawful basis
Each business-contact and website processing activity relies on one of the UK GDPR Article 6 bases below.
| Activity | Purpose | Lawful basis |
|---|---|---|
| Targeted corporate business outreach | Assess relevance, prepare and send a one-to-one introduction, handle replies and prevent unwanted recontact. | Legitimate interests (proportionate direct marketing to a verified corporate subscriber), subject to our balancing assessment and your absolute right to object. |
| Contact-form enquiry | Read the enquiry, reply, and arrange the next step you asked for. | Legitimate interests (running the business and answering people who contact us); steps taken at your request prior to a contract where the enquiry concerns the service. |
| Scorecard submission | Send the one requested result email and respond about the next step you asked for. | Legitimate interests; steps taken at your request prior to a contract. |
| Calendar booking | Schedule and hold the assessment you booked through the external Cal service. | Steps taken at your request prior to a contract; legitimate interests. |
| Optional campaign attribution | After you choose “Accept optional”, keep the first and most recent bounded campaign labels and build-defined landing classifications for the fixed period below. Only the five most recent campaign labels may decorate the booking handoff. Browser Google Analytics measurement is source-disabled and receives no page-use or interaction event in this release. | Consent. You can reject or withdraw it at any time through “Cookie preferences” in every page footer. |
| Email correspondence and business records | Respond to you and keep an accurate record of pre-contract discussions. | Legitimate interests; legal obligation where record-keeping rules apply. |
We do not sell personal information or use it for automated decision-making with legal or similarly significant effects. A website enquiry does not subscribe you to marketing; the separately controlled one-to-one corporate outreach described above uses legitimate interests and always includes an immediate opt-out.
The providers in the website journey
These are the website's own providers. The supplier list for a client engagement is set out separately in that engagement's data-processing documents.
- Companies House and Brave Search · prospect research
- Companies House is the authoritative source for company identity, active status and legal form. Brave Search helps locate a candidate official company website. We retain only bounded attributable evidence needed for the relevance decision, not search-result profiles or cached page copies.
- Zoho Mail EU and private Postgres · business outreach
- Prepared drafts and replies are handled in the Mach Lilies Zoho Mail EU account. A private access-controlled Postgres ledger holds the minimum prospect, evidence, message-state and suppression data needed to operate the workflow. The system cannot send an email; a person reads the draft and clicks Send.
- Formspree · website forms
- Form entries are sent to Formspree for delivery to Mach Lilies. A browser-visible Formspree response is not authoritative proof of durable receipt. Formspree says submissions are saved in its inbox and that its service is hosted on AWS in the United States. Read Formspree's privacy policy and security information.
- Cal · booking
- Opening the booking calendar leaves this website. If you allow analytics, only the five bounded labels from the most recent campaign touch are added to that link. First-touch landing data and internal identifiers are not sent to Cal. The booking details you enter are handled through the external Cal service and the calendar owner. The initial booking form asks only for your name and email. Do not share client records, credentials, confidential information or system-access details. The first-party preparation page does not prove that a booking exists and never uses or reflects provider query values. When JavaScript is available, it removes them before optional measurement runs; disabling Cal's parameter forwarding remains the primary control. Read the provider privacy policy before submitting.
- Google Analytics 4 · source-disabled candidate
- The repository contains a reviewed Basic Consent Mode candidate for bounded website measurement, but it is not activated in this release. No page contains its tag template, the production Content Security Policy permits no Google browser origin, and accepting optional processing does not make a Google request or set a Google Analytics cookie. The candidate remains covered by the removal-only cookie inventory and isolated tests. Any later activation requires separate approval, updated notices and a fresh choice. Google Ads and Meta are also source-disabled.
- Netlify · hosting
- The website is served from Netlify's hosting and content-delivery network. Like any web host, Netlify processes visitor IP addresses and request metadata in its infrastructure and service logs to deliver pages and protect the service. The browser removes unknown query parameters and later captures or discards recognised campaign labels, but it cannot undo the initial query-bearing request already received by the host; that request may remain in host logs under Netlify's controls. Read Netlify's privacy policy.
- Company mailbox · replies
- Enquiries, form notifications and follow-up conversations are held in the Mach Lilies business mailbox at hey@machlilies.com and in the associated calendar, and are covered by the retention schedule below.
Where information leaves the UK
Zoho Mail for this workflow uses the EU service endpoint. Formspree currently states that its service is hosted on AWS in the United States. Cal's current privacy notice says personal data may be transferred to and processed in the United States. Browser Google Analytics, Google Ads and Meta are source-disabled, so this release sends them no website measurement. Brave Search and every other prospect-processing provider must pass the documented processor, location and UK transfer review before production use. Provider locations, terms and certifications can change.
Evidence status · third-party provider statements, checked 18 July 2026. The provider documents linked above are the current sources. The applicable UK transfer mechanism must be confirmed from the current provider terms and Mach Lilies' agreement for that service; this summary does not assert that one named safeguard applies in every case. Email us if you want the current detail before submitting anything.
How long we keep it
The deletion schedule below applies to business outreach, website enquiries, scorecard submissions and booking records.
Evidence status · published first-party retention commitment. The periods below are maximums Mach Lilies commits to operate. The owner must keep the analytics setting and deletion-review cadence aligned with them; they are not a statement that a provider deletes every backup immediately.
| Record | Kept for | Then |
|---|---|---|
| Business prospect not contacted | Up to 28 days from research. For a cancelled unresolved Zoho create/delete outcome only, the exact recipient, subject, canonical body digest, provider selector or attempt state, and recovery timestamps may remain for up to 12 months. | At 28 days, other personal contact, research and message content is deleted and the account remains non-sendable. At 12 months, the recovery recipient and provider state are removed and the account and domain are permanently suppressed. Company-only facts may remain under a separate company-research policy. |
| Contacted business prospect | Normally 12 months from the last substantive interaction | Work identifiers and reply excerpts are deleted or anonymised unless a non-cancelled future booking remains or our privacy owner has recorded an explicit legal hold. Automated replies and delivery or bounce events do not extend this period. A client engagement follows the retention terms agreed for that engagement. |
| Outbound delivery, approval and compliance audit | Up to 24 months | Deleted on the automated retention cycle. The minimum suppression marker needed to honour an objection or invalidate a hard-bounced address remains while we may otherwise market to it. |
| Enquiries, scorecard submissions and bookings that do not lead to an engagement | Up to 12 months from our last substantive contact with you | Deleted from the Formspree inbox, mailbox and calendar on our periodic review cycle. |
| Enquiries that become part of a client engagement | The engagement, plus up to 6 years after it ends | Deleted. The longer period reflects UK limitation and record-keeping rules for business contracts. |
| Optional campaign attribution (after opt-in only) | Each first or most-recent touch for no more than 30 days from its capture; visits do not extend it | Removed from local storage when the stored schema is malformed, both touches expire, consent is invalid, or sooner on rejection, withdrawal or a material policy change. |
| Google Analytics candidate data | None is created by this source-disabled release. A later approved candidate would be capped at 14 months, with its two first-party cookies expiring 420 days after the first visit without renewal. | The candidate retention settings remain documented and tested, but activation requires a new notice and fresh choice. |
This is a public operating commitment, not proof that deletion jobs or provider settings have been independently audited; legal duties and provider backup cycles can limit or delay erasure.
Consent preference: kept for 180 days from the decision without extending on visits. It then expires and the site asks again. A material provider, purpose, category, data, retention or cross-site-processing change also requires a new choice.
Consent and attribution are active only after the optional choice. Google Analytics browser measurement and its cookies are source-disabled; the figure of 420 days from the first visit describes the reviewed candidate, not storage this release creates. Any provider activation requires a new policy version, a fresh choice and separate review.
You can ask for deletion at any time before those periods end — email hey@machlilies.com. Provider backup cycles or a legal duty to keep a record can delay or limit full erasure; if a limit applies to your request, we will explain it when responding.
Your rights and choices
Under UK data-protection law you can ask us for access to the information we hold about you, correction, deletion, restriction of processing, a portable copy, or to object to processing based on legitimate interests. Where processing relies on consent — the optional campaign attribution — you can withdraw it at any time. Email hey@machlilies.com and we will respond within one month.
- Use email instead of the website form if you do not want to use Formspree.
- Use the scorecard without submitting its optional result-email form if you want the on-device result without sending anything answer-derived to Mach Lilies or Formspree.
- Do not open the external booking calendar if you do not want to use the Cal service; ask to arrange a time by email.
- Use “Cookie preferences” in every page footer to accept, reject, manage or withdraw optional campaign attribution. Withdrawal saves the denied choice, clears the consent-bound first/last attribution record and retired source keys, restores undecorated Cal links and removes precisely registered removal-only optional cookies. Browser Google Analytics is source-disabled, so withdrawal makes no vendor call and does not reload the page.
- Read the cookie and browser-storage notice for the complete active storage inventory and fixed consent-record lifetime. Advertising is not in use and stays off.
- You can also raise a concern with the UK Information Commissioner's Office at any time.
Client engagements and changes to this notice
If an enquiry becomes a service discussion, the engagement's service agreement and data-processing documents identify the workflow's data, suppliers, processing locations or transfers, retention, deletion, access and incident contacts before processing begins. See the data-safety controls for the standard framework and document pack.
When this notice changes materially, we update the date at the top of the page and, where the change affects information already submitted, tell affected people directly where we reasonably can.