Privacy policy

Published by KLAIM LIMITED on 5 October 2026. This page is the company’s own statement for this website. It is not a substitute for advice on a particular engagement.

Who this policy is about

This privacy policy explains how KLAIM LIMITED handles personal data in connection with the website at https://klaimlimited.business. KLAIM LIMITED publishes the address 9 Corbets Tey Road, Upminster, RM14 2AP, United Kingdom, the telephone number +44 7520 619384, and the email address help@klaimlimited.business. Those are the contact details to use for a privacy question about this site.

The company is the controller for personal data that people send through the website’s contact forms, and for personal data in ordinary correspondence sent to the published email address or telephone number about the website or a possible engagement. This policy does not describe a separate product dashboard, a user account, or a marketing list, because the website does not offer those things.

The policy is written with the UK GDPR and the Data Protection Act 2018 in mind, because the company publishes a United Kingdom address and the site is the means of contacting that company. It does not state an Information Commissioner’s Office registration number. No such number is published on this website, and none should be inferred.

If a later written engagement makes KLAIM LIMITED a processor of personal data that a business client controls, that role is set in the engagement paperwork. It is not created by this website policy. The policy still explains the enquiry that led to the engagement.

What this policy does not claim

The website does not embed advertising pixels, social plugins, or a third-party analytics product. It does not ask visitors to create an account. It does not run a checkout. It does not ask for payment card numbers, identity documents, or special-category data. People should not put passwords, card numbers, or special-category data in the contact form.

Photographs on the site are directed editorial images used to explain the kind of work the company does. They are not presented as photographs of named clients, named staff, or the interior of the Upminster address. A person who appears in an image is not identified on the page, and the image is not used here as a testimonial.

The portfolio describes capability demonstrations, representative scenarios, and technical approaches. It does not publish client names or performance figures. This policy does not invent a list of customers whose data the company holds.

KLAIM LIMITED does not publish a data-protection officer on this website. Privacy correspondence should go to help@klaimlimited.business. If a formal engagement later names a different privacy contact, that document governs the engagement and this page continues to govern the website.

Personal data the contact form collects

Each contact form asks for three things: a name, an email address, and a message. Those fields are required because the company cannot reply to an enquiry that does not say who it is from, where the reply should go, or what the enquiry is about. The forms appear on the home page and on the contact page. Both post to the same server script.

The script also receives two fields that are not part of the conversation. One is a hidden timing value set in the browser when the form is shown, used to reject submissions that arrive too quickly to be a considered message. The other is a honeypot field labelled for a company website, which is hidden from ordinary use and is there so that automated submissions can be refused. If that field is filled, the message is not sent.

A successful submission is emailed to help@klaimlimited.business. The email contains the name, the email address, and the message. The site then shows a confirmation page. That page is shown only after the server accepts the message for delivery. If delivery is not accepted, the site says so and does not claim that the message was sent.

The company does not ask the form to collect a job title, a company registration number, or a budget. If a person includes those details in the message, they become part of the enquiry record because the person chose to write them. They are used for the same purpose as the rest of the message.

Correspondence outside the form

People may also write to help@klaimlimited.business or call +44 7520 619384. An email or a call can contain the same kinds of personal data as the form, and often more, because the person decides what to say. The company uses that correspondence to understand the enquiry and to reply.

If a call is not recorded, the personal data from the call is whatever note is made in order to follow it up. This website does not state that calls are recorded, and it should not be read as a promise that they are or are not. Any later recording practice would need to be explained at the time of the call.

Postal correspondence can be sent to 9 Corbets Tey Road, Upminster, RM14 2AP, United Kingdom. A letter may include a name, a return address, and whatever the writer puts on the page. It is read for the purpose of dealing with the letter.

The company does not operate a separate web chat on this site. A message left with a third-party messaging service is outside this policy unless it is then forwarded to the published email address, in which case the forwarded content is treated as correspondence.

Technical data connected with a visit

Like most websites, the server that delivers these pages may keep a short technical log of a request. That log can include an IP address, the date and time, the address of the page requested, a status code, and the user agent string sent by the browser. The company does not place a separate analytics tag on the pages to build a profile of browsing.

Those logs, where the host keeps them, are a consequence of serving the site. They are used to keep the site available, to diagnose faults, and to investigate abuse such as repeated automated posts. They are not used on this website to show advertising.

The company does not publish the name of its hosting provider or its email provider on this site, and this policy does not invent one. Whoever stores the pages or accepts the enquiry email is a service provider for that limited purpose. The company does not authorise that provider, through this policy, to use enquiry content for the provider’s own marketing.

If a browser sends a referrer when the contact form is submitted, the script checks that the submission came from this host. That check is an abuse control. It is not a record of the visitor’s wider browsing history.

Cookies and similar storage

The static pages do not set a cookie in order to be read. The contact script starts a PHP session so that it can limit how many messages one session can send in an hour, and so that it can refuse a second message sent a few seconds after the first. That session uses a cookie commonly named PHPSESSID.

The cookie identifies the session on the server. It is not an advertising identifier. The session holds timestamps of recent form posts. It does not need to hold the text of the message after the message has been mailed or refused. Detail of the cookie, and how to control cookies in a browser, is in the cookie policy.

The site’s own script does not write to local storage or session storage. It does not use a tracking pixel. If a future version of the site needs a non-essential cookie, the cookie policy will be updated before that cookie is set, and a non-essential cookie will not be described as essential.

Third-party content is not embedded in the pages. Fonts are requested from Google Fonts when the browser loads a page. That request is made by the visitor’s browser to Google’s font service so that the page can be displayed in the typefaces the design uses. The company does not receive a copy of Google’s font logs through the website. People who block third-party font requests will still be able to read the pages in a fallback typeface.

Why the enquiry data is used

Enquiry data is used to read the message, to decide whether it is something the company can respond to, to reply, and to keep a record of that exchange for as long as the retention section allows. If the message becomes a discussion about work, the same data is used to prepare a scope, a proposal, or a refusal.

The data is also used to protect the form. Timing checks, the honeypot, the session limit, and the check of origin or referrer exist so that the inbox is not filled with automated or hostile submissions. A message refused by those checks is not treated as delivered.

The company does not use the contact form to build a mailing list. Sending an enquiry is not treated as consent to a newsletter. A later message about the enquiry is a reply, not a separate marketing programme. If the company ever wants to send marketing that is not a reply to an enquiry, it will need a proper basis and will not pretend that this form created one.

Staff or contractors who need to answer the enquiry may see it. They are expected to use it for that purpose. This policy does not publish their names, because the website does not publish a staff list.

Lawful bases

For a message that asks about possible work, the company relies on steps taken at the person’s request before a contract, and on the company’s legitimate interest in answering business enquiries sent to its published address. Both can apply to the same message: the person has asked for a response, and the company has an interest in handling enquiries that are actually addressed to it.

For the abuse controls — rate limits, the honeypot, and the origin check — the company relies on its legitimate interest in keeping the form usable and in avoiding the cost and risk of processing junk or hostile submissions. That interest is balanced against the limited data those controls use. They do not require an account, and they do not follow the person around other sites.

If the company has to keep a record because a legal claim is in prospect, or because a law requires a record, the basis is a legal obligation or the establishment, exercise, or defence of legal claims. The website does not assume that every enquiry will become a dispute. Most will not.

Consent is not the basis for the ordinary contact form. The form is not optional marketing. If a particular request truly depends on consent, the company will ask for that consent separately and will record what was asked. Silence, or the mere fact of visiting a page, is not treated as consent.

Children

The website describes business-to-business technology services. It is not directed at children, and the company does not knowingly use the form to collect personal data from a child. A person who believes a child’s data has been sent through the form can write to help@klaimlimited.business and ask for it to be deleted.

If the company can see that a message is from a child, or is about a child in a way that is not a business enquiry, it will not start a commercial engagement on the back of that message. It will delete the message unless a legal reason requires a short record of the deletion request itself.

The company does not offer age-gated services on this site, because it does not offer consumer accounts. There is no profile to set to a child mode.

How long enquiry records are kept

An enquiry that does not become an engagement is kept for up to twenty-four months from the last message in the thread, so that the company can find what was said if the same person writes again, and so that it can deal with a complaint about how the enquiry was handled. It is then deleted or reduced to a form that no longer identifies the person, unless a legal claim or a legal duty requires a longer record.

If the enquiry becomes a contract, the enquiry is kept with the contract file for the life of the work and for as long after that as the contract, tax, or limitation rules that apply to the file require. This website does not state a single number of years for every kind of commercial file, because that period depends on the work. The engagement paperwork can state a more precise period.

Server logs, where they exist, are kept only for the period the host uses for security and diagnostics. The company does not copy those logs into a separate marketing store.

The session used for rate limiting is a short-lived server session. It is not an archive of messages. Closing the browser, or the session expiring, ends it. The one-hour window used to count posts is part of that session, not a twenty-four-month archive.

A person can ask for deletion earlier. The company will delete enquiry data that it no longer needs, and will explain if a particular record has to stay because of a legal claim or a legal duty. A request to delete does not, by itself, cancel a contract that has already been agreed.

Who receives the data

The enquiry is sent to help@klaimlimited.business. People at KLAIM LIMITED who handle enquiries and, where needed, the work that follows, can read it. An email provider or host that transmits or stores that message will handle it as part of delivering the service. The company does not sell personal data and does not rent enquiry lists.

The company does not pass contact-form data to an advertising network. It does not append the email address to a social audience. It does not use the form as a source for lookalike marketing.

A professional adviser — for example a lawyer or an accountant — may see a record if that is necessary for advice, a dispute, or a statutory filing. The website does not name those advisers, because no standing panel is published here.

If the company is legally required to disclose information to a regulator, a court, or a law-enforcement body, it will do so to the extent the law requires. A business enquiry does not, by itself, create that duty.

If a client later asks the company to connect systems that contain personal data, the recipients of that data are defined in the engagement, not in this website policy. The client remains responsible for having a basis to share its own records.

International transfers

The company publishes a United Kingdom address and intends enquiry correspondence to be handled from that context. Email and hosting infrastructure can involve processing outside the United Kingdom even when the company does not choose a particular foreign office. Where a provider stores or routes a message outside the UK, the company expects that transfer to be covered by the provider’s appropriate safeguard, such as the UK extension to the EU-US Data Privacy Framework where it applies to that provider, the UK International Data Transfer Agreement, or a UK adequacy regulation.

This policy does not name a provider, and it does not claim that a particular safeguard is in place with a named company. If a person needs to know the safeguard that applies to a specific message, they can ask at help@klaimlimited.business. The company will explain what it actually knows about the route of that message, and will not invent a mechanism it does not use.

The company does not transfer contact-form data to a foreign group company, because this website does not describe a group of companies.

Security

The contact script rejects messages that are not ordinary form posts, strips line breaks from the name and the email address so that they cannot be used to add extra email headers, and limits the length of each field. It refuses a filled honeypot, a submission that is too fast, and a burst of messages from the same session. Those are practical controls. They are not a claim that misuse is impossible.

Pages should be served over HTTPS when the site is on its public host. A visitor who reaches the site should look for the browser’s ordinary lock indication. The company does not ask people to send passwords through the form.

No website policy can honestly promise that email will never be delayed, misaddressed by the sender, or read by someone who already has access to a mailbox. People should not use the form for information they would not put in an ordinary email.

Access to the enquiry mailbox is limited to people who need it for the company’s work. The website does not publish a count of those people.

If the company becomes aware of a personal-data breach that affects enquiry data and that is likely to result in a risk to people, it will handle notification in line with UK GDPR duties. This policy does not describe a past breach, and none is stated because none is being reported here.

Rights

People whose personal data the company handles have rights under UK GDPR. Those rights are not absolute. They depend on the data and on the reason it is held. The usual rights are: to be told how the data is used; to ask for a copy; to ask for correction; to ask for erasure; to ask for restriction; to object to processing based on legitimate interests; and to ask for data they provided to be sent to them or to another controller in a portable form where the processing is automated and based on contract or consent.

A reply to an access request will describe the enquiry data the company actually holds, not a generic archive. If the company does not hold data about the requester, it will say so. It may ask for enough information to be sure it is writing to the right person, and it will not ask for more identity evidence than the request needs.

Correction applies to data that is inaccurate. A disagreement about a commercial judgement is not, by itself, an inaccuracy in a stored email. The company will correct a wrong email address, a misspelt name, or a message that was stored in a garbled form.

Erasure can apply when the data is no longer needed, when an objection is upheld, or when the data has been used unlawfully. It does not require the company to delete a record that it must keep for a legal claim or a legal duty. Where erasure is refused, the reason will be explained.

Restriction can apply while accuracy or an objection is being considered, or where the person prefers restriction to deletion in a case where deletion would otherwise be required. Restricted data is held and not used except for limited reasons, including legal claims and the protection of another person’s rights.

An objection to legitimate-interest processing will be considered on the facts. The company may continue if it has a compelling reason, for example a live dispute about the enquiry. An objection to a reply the person themselves requested is unlikely to be upheld while they still want the reply.

Portability is most relevant where processing is automated and based on a contract or on consent. An ordinary email enquiry is not a portable account export. If a portable copy is required and the right applies, the company will provide the data it holds in a common format.

These rights can be exercised by writing to help@klaimlimited.business. The company will respond within one month, or will explain a permitted extension if the request is complex. There is no fee for a reasonable request. A manifestly unfounded or excessive request can be refused or charged for, and the reason will be given.

Complaints

A person who is unhappy with a privacy response can complain to the company first, at help@klaimlimited.business, so that a mistake can be corrected. They may also complain to the Information Commissioner’s Office, the UK supervisory authority for data protection. The ICO’s public site explains how to complain. This policy does not reproduce the ICO’s forms and does not claim that KLAIM LIMITED has a particular ICO registration.

A complaint to the company should include enough detail to find the enquiry: the name used, the email address used, and approximately when the message was sent. The company will not ask the complainant to send the original message again if it already has it, unless the original cannot be found.

The company will not treat a privacy complaint as a reason to ignore a separate contractual dispute, and it will not treat a contractual dispute as a waiver of privacy rights.

Links and third-party sites

This website links to its own pages and to ordinary email and telephone links. It does not carry a directory of partner sites. If a future page links to another website, that site has its own privacy policy. KLAIM LIMITED is not the controller for a form that lives on someone else’s domain.

A browser extension, a corporate proxy, or an email security gateway can read traffic or messages under the user’s own arrangements. Those tools are not engaged by this website. The company does not receive their reports unless the user or their employer sends them.

Business contact details published on the site

The address, telephone number, and email address of KLAIM LIMITED are published so that people can contact the company. They are business contact details. Publishing them is not a release of a private individual’s home information. The website does not state that the Upminster address is a director’s home, and it should not be read that way.

People who copy those details into their own systems, for example to send a legitimate enquiry, become controllers of that copy. This policy does not govern their filing.

Engagements that involve a client’s personal data

Custom software, hosting, data processing, advertising technology, and integrations often touch personal data that belongs to the client’s customers, staff, or audience. When that happens, the client usually decides the purposes. The engagement should say whether KLAIM LIMITED is a processor, a controller, or both for different parts of the work.

This website does not publish a standard data-processing addendum as a download. If one is needed, it will be written for the engagement. It will describe the subject matter, the duration, the nature and purpose, the type of personal data, the categories of people, and the obligations the law requires of a processor. It will not be implied from a sentence on the services page.

The company will not accept a client’s special-category data, children’s data, or payment-card data into a build unless the engagement expressly deals with it. The contact form is the wrong place for a sample of that data. A sample should not be attached to a first email.

Sub-processors for a client engagement, if any, will be named in the engagement or a later notice under that engagement. They are not fixed by this policy, because the website does not list them.

Automated decisions

The website does not make a decision about a person by solely automated means that produces a legal effect or a similarly significant effect. The abuse checks refuse or accept a form submission. They do not decide credit, employment, or access to a public service. A human reads an enquiry that is delivered.

The company does not build a score of visitors. There is no profile that follows a person from page to page for advertising.

Changes to this policy

The company can update this policy when the site changes or when the law changes. The new text will be posted on this page with a new published date. A change that requires a fresh consent will not be hidden in a quiet edit. The date at the top of the page is the date of this version: 5 October 2026.

Earlier enquiries stay under the policy that applied when they were sent, except where a later law requires a different handling of records still held. The company will not use an old enquiry for a new purpose that is incompatible with the purpose described here.

How the documents fit together

This policy describes personal data. The cookie policy describes cookies and similar technologies in more detail. The terms of service describe use of the website. The terms and conditions describe how commercial work is commissioned. If a sentence in the commercial terms conflicts with a mandatory data-protection duty, the duty prevails.

Nothing in the commercial terms reduces a person’s statutory privacy rights. A client’s contract can add privacy obligations. It cannot remove a data subject’s right to complain to the ICO.

The confirmation page and failed delivery

The page at thanks_you.html is shown only after the server accepts the enquiry for email delivery. It confirms that the message was handed to the mail function. It is not a promise that the recipient has already read it, and it is not a contract. The page asks search engines not to index it, because it is a receipt rather than a public description of the company.

If the mail function does not accept the message, the site shows an error and gives the published email address and telephone number so the person can write or call directly. In that case the company does not treat the form text as a delivered enquiry. The person should assume it has not been read unless they use another channel. The error page may repeat the validation reasons. It does not store those reasons as a marketing profile.

Validation failures — a missing name, a malformed email address, a message that is too short or too long, a honeypot, a too-quick submit, or too many posts in an hour — are explained on the error page. The company does not keep a separate database of failed attempts beyond the short session used for the rate limit. A person who sees an error can correct the form and send it again.

Public statements and demonstrations

The site describes services and shows capability demonstrations. Those pages are not a register of personal data. A business that recognises its own situation in a general description has not, by that recognition, been named. The company will not confirm or deny that a particular unnamed organisation is a client in response to a casual website question, because the website does not publish clients at all.

If a person is concerned that a photograph identifies them, they can write to help@klaimlimited.business. The company will look at the image. The images are commissioned as editorial photographs of work, not as portraits of customers. Where an image unexpectedly identifies a private individual and there is no reason to keep it in that form, the company will replace or crop it.

Quotes are not published on the site. A sentence in an enquiry will not be turned into a testimonial without a separate request that the person can refuse. Silence after an enquiry is not permission to publish the person’s words or name.

Contact about this policy

Privacy questions, access requests, and deletion requests go to help@klaimlimited.business. Post can be sent to KLAIM LIMITED, 9 Corbets Tey Road, Upminster, RM14 2AP, United Kingdom. The telephone number is +44 7520 619384. Please say that the message is about privacy so that it is not handled only as a sales enquiry.

The company will not ask a requester to use a different brand name or a different domain. The domain of this site is klaimlimited.business. A message about this policy should refer to that site.