Privacy policy
What personal data we collect, why, who we share it with, how long we keep it, and the rights you have — wherever you are.
Last updated: 5 November 2026
1. Who we are
Atomeridian Ltd (“Atomeridian”, “we”, “us”) is a private limited company registered in England and Wales, with its registered office at Suite RA01, 195-197 Wood Street, London, E17 3NU.
We are the controller of the personal data described in this policy, which covers visitors to atomeridian.com and people who contact us. Our primary legal framework is the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Where the EU General Data Protection Regulation (EU GDPR) or other privacy laws apply to you, we handle your data in line with them too.
For any privacy question or request, email [email protected].
2. What we collect
Contact form. Your name, email address, company name (optional), the type of enquiry you select, your message, and your confirmation that you have read this policy. Name, email, enquiry type and message are needed so we can reply; without them we cannot respond through the form.
Emails. If you email us, your email address, name and anything you choose to include.
Technical data. When you visit the site or submit the form, our hosting provider (Cloudflare) and our form service (FormSubmit) receive technical data needed to deliver and protect the service, such as your IP address, browser and device information, the pages requested, and security logs. Cloudflare may also set one strictly necessary security cookie, __cf_bm, to help tell people apart from automated traffic — see our cookie policy.
What we do not do. We do not set any cookies of our own, and we do not use analytics, tracking pixels, advertising, social media plug-ins or third-party scripts. The site has no user accounts and takes no payments. Fonts are hosted on our own domain.
Please do not send us special category data (for example, about health, religion or ethnicity) or information about criminal convictions.
3. Why we use it and our lawful bases
| Purpose | Lawful basis (UK GDPR and EU GDPR, Article 6) |
|---|---|
| Reading and replying to your enquiry, and keeping a record of our correspondence | Legitimate interests — responding to people who contact us and running our business |
| Preparing a proposal at your request, and providing services if you become a client | Contract — taking steps at your request before entering into a contract, or performing it |
| Keeping the website and form secure, and preventing spam and abuse | Legitimate interests — protecting our website, visitors and inbox |
| Meeting legal, accounting and tax requirements, and responding to lawful requests from authorities | Legal obligation |
| Establishing, exercising or defending legal claims | Legitimate interests |
| Anything else we specifically ask your permission for, such as sending you updates | Consent, which you can withdraw at any time |
The checkbox on our form confirms that you have read this policy; we do not rely on consent to reply to you. We will not add you to a mailing list or send you marketing without your separate agreement.
We do not carry out profiling or make decisions about you based solely on automated processing that have legal or similarly significant effects.
4. Who we share it with
We use the following service providers (processors) to run the website and handle enquiries. They process personal data to provide their services to us:
- FormSubmit (formsubmit.co) — receives the details you submit through the contact form and forwards them to our inbox by email.
- Our email service provider — receives and stores mail sent to our address, which we use to reply to you.
- Cloudflare — hosts the website and protects it against attacks and automated abuse.
We may also disclose personal data to professional advisers bound by confidentiality, or where we are required to by law.
We do not sell your personal information, and we do not share it for targeted or cross-context behavioural advertising.
5. International transfers
Some of our providers may process personal data outside the UK and the European Economic Area (EEA), for example in the United States. Where that happens, we make sure a transfer mechanism recognised under UK law (and, where it applies, EU law) is in place, such as:
- adequacy regulations or decisions — including the UK–US data bridge and the EU–US Data Privacy Framework, where the provider is certified under them; or
- the EU Standard Contractual Clauses together with the UK International Data Transfer Addendum, or the UK International Data Transfer Agreement.
Email us if you would like more information about the safeguard used for a particular provider.
6. How long we keep it
We keep enquiry emails and contact form submissions for up to 24 months from our last contact with you, then delete them securely. We keep them longer only where we need to meet a legal obligation, or to establish, exercise or defend legal claims.
If you become a client, we keep the records of our business relationship for as long as needed to provide our services and to meet legal, accounting and tax requirements. Technical and security logs held by our providers are kept for the periods set by those providers.
7. Security
We use measures proportionate to the data we hold. The website is served only over HTTPS, the contact form sends your details over HTTPS, and the site uses security headers including a strict Content Security Policy. Access to enquiries is limited to people at Atomeridian who need it. No method of transmission or storage is completely secure, so we cannot guarantee absolute security; if a personal data breach occurs, we will notify the ICO and affected people where the law requires us to.
8. Your rights
Under UK and EU data protection law you have the right to:
- access the personal data we hold about you and get a copy;
- rectification — have inaccurate or incomplete data corrected;
- erasure — have your data deleted;
- restriction — ask us to limit how we use your data;
- object to our use of your data where we rely on legitimate interests;
- data portability — receive data you gave us in a commonly used format, where applicable;
- withdraw consent at any time, where we rely on consent;
- not be subject to a decision based solely on automated processing that has legal or similarly significant effects (we make no such decisions).
How to exercise them. Email [email protected]. We will respond within one month; if a request is complex, this may be extended by up to two further months and we will tell you why. We may ask for information to confirm your identity. There is normally no charge.
Complaints. Please contact us first so we can try to put things right. You also have the right to complain to the UK Information Commissioner’s Office (ICO): ico.org.uk/make-a-complaint (opens in a new tab), telephone 0303 123 1113. If you live or work in the EU or EEA, you can also complain to your local supervisory authority (see the list of EU and EEA supervisory authorities (opens in a new tab)).
9. People in other regions
If you live elsewhere, including California or another US state with a privacy law, you can exercise the equivalent rights your local law gives you — such as the rights to know, access, correct and delete your personal information — by emailing [email protected]. You may use an authorised agent, and we will not treat you differently for exercising your rights.
For those laws: the categories of personal information we collect are identifiers (name, email address, IP address), professional information (company name), the content of your communications, and internet or network activity (technical and security data), as described in section 2. We collect them from you and your device, use them for the purposes in section 3, and disclose them only to the service providers and in the circumstances in section 4. We do not sell or share personal information for cross-context behavioural advertising, and we do not use sensitive personal information to infer characteristics about you, so there is nothing to opt out of.
10. Children
Our website and services are intended for businesses and adults. They are not directed at children, and we do not knowingly collect personal data from anyone under 16. If you believe a child has sent us personal data, email us and we will delete it.
11. Links to other websites
Our site links to some other websites, such as our LinkedIn company page and the ICO. These are plain links: we do not embed content or tracking from them. Those websites have their own privacy policies, and we are not responsible for how they handle your data.
12. Changes to this policy
We may update this policy, for example if our providers or practices change. The “Last updated” date at the top of this page shows when it last changed, and we will highlight significant changes on this page.