What happens when we contact each other.
This notice covers website enquiries, requested result emails, direct correspondence and optional analytics and campaign attribution. Processing inside a client engagement is governed separately by that engagement's service agreement and data-processing documents.
Page effective · 30 August 2026 · consent-gated Google Analytics 4 activated
Who is responsible for your information
Mach Lilies Limited (company number 14149947, registered in England & Wales, registered office 22 Lanchester Close, Birmingham, B12 9AG, United Kingdom) is the controller for the personal information described on this page. Write to hey@machlilies.com about access, correction, deletion or any other privacy question.
The short contact form asks for your name, company name, email address and one topic selected from the list shown on the form. If you allow analytics, it can also carry the first and most recent bounded campaign labels and build-defined landing classifications described below. We use those details to read the enquiry, decide whether to reply and arrange a useful next step. Submitting the form does not subscribe you to marketing.
The readiness scorecard calculates its result in your browser. Its closed answers, current step and whether the result was shown stay only in session storage in that tab. Nothing answer-derived is sent unless you explicitly submit the single optional result-email form. That request includes your email, a transactional acknowledgement, fit tier, assessment version, stable reason codes and fixed form/offer identifiers. If you allow analytics, it can also include a bounded source plus the first and most recent campaign and landing classifications. It does not send raw answer bands, the bottleneck label, your name, practice, role, phone, full page URL or referrer. We use the submitted information to send the one result email and respond about the next step you requested; it does not subscribe you to marketing.
The complete first-party storage allowlist, including every active key, purpose, field and lifetime, is published in the cookie and browser-storage notice.
Do not send client records, tax data, credentials, special-category information or system access details through the website.
What we use it for, and the lawful basis
Each website and correspondence processing activity relies on one of the UK GDPR Article 6 bases below.
| Activity | Purpose | Lawful basis |
|---|---|---|
| Contact-form enquiry | Read the enquiry, reply, and arrange the next step you asked for. | Legitimate interests (running the business and answering people who contact us); steps taken at your request prior to a contract where the enquiry concerns the service. |
| Scorecard submission | Send the one requested result email and respond about the next step you asked for. | Legitimate interests; steps taken at your request prior to a contract. |
| Optional analytics and campaign attribution | After you choose “Accept optional”, measure page use and registered interactions through Google Analytics 4 and keep the first and most recent bounded campaign labels and build-defined landing classifications for the fixed period below. Only the five most recent campaign labels may be carried into website forms. | Consent. You can reject or withdraw it at any time through “Cookie preferences” in every page footer. |
| Email correspondence and business records | Respond to you and keep an accurate record of pre-contract discussions. | Legitimate interests; legal obligation where record-keeping rules apply. |
We do not sell personal information or use it for automated decision-making with legal or similarly significant effects. A website enquiry or requested result email does not subscribe you to marketing.
The providers in the website journey
These are the website's own providers. The supplier list for a client engagement is set out separately in that engagement's data-processing documents.
- Formspree · website forms
- Form entries are sent to Formspree for delivery to Mach Lilies. A browser-visible Formspree response is not authoritative proof of durable receipt. Formspree says submissions are saved in its inbox and that its service is hosted on AWS in the United States. Read Formspree's privacy policy and security information.
- Google Analytics 4 · optional website measurement
- If you choose “Accept optional”, Google Analytics 4 measures page use and registered interactions and sets the two first-party cookies listed in the cookie notice. Google Ireland Limited provides the service and acts as our processor. It receives pseudonymous browser and session identifiers, the canonical page address and title, browser and device information, IP address as transport metadata, bounded event labels and the five campaign labels. We do not send Google names, email addresses, telephone numbers, form or scorecard answers, appointment details, booking or CRM identifiers, raw query strings, advertising identifiers or free text. The tag does not load before consent. Advertising storage and personalisation remain denied; Google Ads, Meta, remarketing and Customer Match stay off. Read how Google uses information from sites that use its services.
- Netlify · hosting
- The website is served from Netlify's hosting and content-delivery network. Like any web host, Netlify processes visitor IP addresses and request metadata in its infrastructure and service logs to deliver pages and protect the service. The browser removes unknown query parameters and later captures or discards recognised campaign labels, but it cannot undo the initial query-bearing request already received by the host; that request may remain in host logs under Netlify's controls. Read Netlify's privacy policy.
- Company mailbox · direct correspondence
- Enquiries, form notifications, requested result emails and direct conversations are held in the Mach Lilies business mailbox at hey@machlilies.com and are covered by the retention schedule below.
Where information leaves the UK
Formspree currently states that its service is hosted on AWS in the United States. Google Ireland Limited provides Google Analytics as our processor, and Google may process measurement information outside the UK under its data-processing terms. Netlify uses a global hosting and content-delivery network to serve and protect the website. Google Ads and Meta remain off and receive no advertising measurement. Provider locations, terms and certifications can change.
Evidence status · third-party provider statements, checked 18 July 2026. The provider documents linked above are the current sources. The applicable UK transfer mechanism must be confirmed from the current provider terms and Mach Lilies' agreement for that service; this summary does not assert that one named safeguard applies in every case. Email us if you want the current detail before submitting anything.
How long we keep it
The deletion schedule below applies to website enquiries, requested result emails, direct correspondence, engagement records and optional measurement.
Evidence status · published first-party retention commitment. The periods below are maximums Mach Lilies commits to operate. The owner must keep the analytics setting and deletion-review cadence aligned with them; they are not a statement that a provider deletes every backup immediately.
| Record | Kept for | Then |
|---|---|---|
| Enquiries, requested result emails and direct correspondence that do not lead to an engagement | Up to 12 months from our last substantive contact with you | Deleted from the Formspree inbox and mailbox on our periodic review cycle. |
| Enquiries or correspondence that become part of a client engagement | The engagement, plus up to 6 years after it ends | Deleted. The longer period reflects UK limitation and record-keeping rules for business contracts. |
| Optional campaign attribution (after opt-in only) | Each first or most-recent touch for no more than 30 days from its capture; visits do not extend it | Removed from local storage when the stored schema is malformed, both touches expire, consent is invalid, or sooner on rejection, withdrawal or a material policy change. |
| Google Analytics data (after opt-in only) | User-level and event-level data is retained for no longer than 14 months. The two first-party cookies expire 420 days after the first visit and are not renewed when you return. | Google deletes user-level and event-level data on its retention cycle. The setting does not govern every standard aggregated report, and provider backup or legal limits may apply. |
This is a public operating commitment, not proof that periodic deletion reviews or provider settings have been independently audited; legal duties and provider backup cycles can limit or delay erasure.
Consent preference: kept for 180 days from the decision without extending on visits. It then expires and the site asks again. A material provider, purpose, category, data, retention or cross-site-processing change also requires a new choice.
Optional attribution and Google Analytics browser measurement start only after acceptance. These are the configured lifetimes for this release's own consent, attribution and analytics cookies; they do not state how long every Google aggregate or backup persists. Advertising providers remain off, and any further material provider change requires a new policy version, fresh choice and separate review.
You can ask for deletion at any time before those periods end — email hey@machlilies.com. Provider backup cycles or a legal duty to keep a record can delay or limit full erasure; if a limit applies to your request, we will explain it when responding.
Your rights and choices
Under UK data-protection law you can ask us for access to the information we hold about you, correction, deletion, restriction of processing, a portable copy, or to object to processing based on legitimate interests. Where processing relies on consent — optional analytics and campaign attribution — you can withdraw it at any time. Email hey@machlilies.com and we will respond within one month.
- Use email instead of the website form if you do not want to use Formspree.
- Use the scorecard without submitting its optional result-email form if you want the on-device result without sending anything answer-derived to Mach Lilies or Formspree.
- Use “Cookie preferences” in every page footer to accept, reject, manage or withdraw optional analytics and campaign attribution. Withdrawal saves the denied choice, sends the loaded Google tag an immediate denied consent update, clears the consent-bound first/last attribution record, retired source keys and registered optional cookies, then reloads the same query-free page. The denied replacement does not load the tag, and no analytics event is sent about the withdrawal.
- Read the cookie and browser-storage notice for the complete active storage inventory and fixed consent-record lifetime. Advertising is not in use and stays off.
- You can also raise a concern with the UK Information Commissioner's Office at any time.
Client engagements and changes to this notice
If an enquiry becomes a service discussion, the engagement's service agreement and data-processing documents identify the workflow's data, suppliers, processing locations or transfers, retention, deletion, access and incident contacts before processing begins. See the data-safety controls for the standard framework and document pack.
When this notice changes materially, we update the date at the top of the page and, where the change affects information already submitted, tell affected people directly where we reasonably can.