Privacy Policy

This website is operated by Project Legacy Ltd, a private limited company incorporated in England and Wales (company number 16588134), with its registered office at Suite A, James Carter Road, Mildenhall, Bury St. Edmunds, England, IP28 7DE.

For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, Project Legacy Ltd is the data controller of any personal data you provide through this website.

If you have any questions about this policy or how we handle your personal data, please contact us at contact@projectlegacy.world.

We only collect personal data that you choose to give us via our contact form. This is limited to:

• Your full name
• Your work email address
• The organisation or firm you represent
• Whether you are contacting us as an investor or a potential customer

We also automatically collect a small amount of technical information when you submit the form, strictly for security and anti-abuse purposes:

• A one-way hash of your IP address (we do not store the IP itself)
• Your browser's user-agent string
• A timestamp of submission

We do not use tracking cookies, advertising cookies, or third-party analytics on this website.

We use the information you provide only to:

• Respond to your enquiry and follow up with you directly
• Send you information about Project Legacy that is relevant to the reason you contacted us
• Keep a record of the enquiry for our internal business records
• Prevent and detect abuse of our contact form (spam, automated submissions)

We will never sell, rent or trade your personal data.

Under UK GDPR, we rely on the following lawful bases:

• Consent (Article 6(1)(a)) — when you tick the consent box and submit the contact form.
• Legitimate interests (Article 6(1)(f)) — to protect our website from abuse and to keep basic records of business enquiries. We have assessed these interests against your rights and freedoms.

Access to enquiry data is restricted to the founders and named staff of Project Legacy Ltd on a strict need-to-know basis.

We share data with a small number of trusted processors that help us run this site:

• Supabase (Supabase Inc.) — database hosting for enquiry records. Data is stored in the EU/UK region where available.
• Resend (Resend, Inc.) — sends the notification email that lets us know you got in touch.
• Cloudflare — content delivery, DNS and edge-level protection against abuse.

Each of these processors is bound by a written data-processing agreement and is required to apply appropriate security measures. Where any transfer of personal data leaves the UK, it is protected by the UK International Data Transfer Addendum or equivalent safeguards under UK GDPR.

We take security seriously and apply industry-standard controls, including:

• All data is transmitted over encrypted HTTPS (TLS 1.2+).
• Enquiry records are stored in a database with row-level security enabled; only authenticated administrators can read them.
• Secrets and API keys are held in an encrypted secret store and are never exposed to the browser.
• IP addresses are stored only as a one-way hash used for rate limiting.
• Access to administrative systems requires multi-factor authentication.
• We keep the number of people, systems and third parties with access to your data to the minimum necessary.

We keep enquiry records for as long as there is a legitimate business reason to do so — typically up to 24 months from your last interaction with us. After that, records are deleted or anonymised. If you ask us to delete your data sooner, we will do so unless we are legally required to retain it.

You have the following rights in respect of your personal data:

• The right to be informed about how we use your data (this policy).
• The right of access to a copy of the data we hold about you.
• The right to rectification of inaccurate or incomplete data.
• The right to erasure ("right to be forgotten").
• The right to restrict processing.
• The right to data portability.
• The right to object to processing based on legitimate interests.
• The right to withdraw consent at any time, where processing is based on consent.

To exercise any of these rights, email us at contact@projectlegacy.world. We will respond within one month.

If you are not satisfied with our response, you have the right to lodge a complaint with the UK's data protection authority, the Information Commissioner's Office (ICO), at ico.org.uk.

We use a strictly limited set of cookies and local storage. See our Cookie Policy for full details.

This website is not directed at children under 16 and we do not knowingly collect personal data from children.

We may update this policy from time to time. When we do, we will update the "Last updated" date at the top of the page. If the changes are material, we will make reasonable efforts to notify people who have contacted us.

Project Legacy Ltd
Suite A, James Carter Road
Mildenhall, Bury St. Edmunds
England, IP28 7DE
Company number 16588134
Email: contact@projectlegacy.world