PRIVACY POLICY

Last Updated: 11.10.2026

This policy explains how CML Team Limited (“CML Team”, “we”, “us”, “our”) handles personal data when you use https://cmlteam.com (the “Website”). Please read it together with our Terms and Conditions.

In short

• We collect what you send us through our forms, the chat window, job applications and call bookings, and we use it to answer you, to discuss work and to recruit.
• Google Analytics runs only if you accept analytics cookies. Until you accept, the Website does not load it, and you can withdraw your choice at any time with “Cookie settings” in the footer.
• We do not use advertising or marketing cookies, and we do not use your data for advertising.
• You have rights over your data, and you can write to us at info@cmlteam.com.

1. Who we are

CML Team Limited is a company registered in England and Wales (company number 11580376). Our registered office is 61 Bridge Street, Kington, HR5 3DJ, United Kingdom. We are the controller of the personal data described in this policy. You can reach us at info@cmlteam.com.

2. What we collect, why, and on what basis

We collect personal data directly from you through the Website. For each purpose:

Contact form (also on the home page)

• Data: name, email address, company (optional), a description of your project and an estimated budget (optional).
• Why: to reply to you and to discuss a possible engagement.
• Legal basis: our legitimate interests in answering enquiries and developing our business and, if you ask us to, steps before entering into a contract.

Chat window

• Data: name, email address, phone number and your message.
• Why and legal basis: as for the contact form.

Early-access form (Persona page)

• Data: email address, LinkedIn profile and the reason you give.
• Why: to review your request and to get in touch with you about it.
• Legal basis: our legitimate interests in running the early-access programme.

Booking a call

• Data: the details you enter in the scheduling window (for example your name, email address and the time you choose), which Calendly processes to make the booking.
• Why: to hold the call you asked for.
• Legal basis: steps at your request before entering into a contract, and our legitimate interests.

Emails

• Data: what you write to info@cmlteam.com, and the copies of form and chat messages that reach our mailboxes.
• Why: to answer you and to keep a record of our business dealings.
• Legal basis: our legitimate interests.

Visit statistics

• Data: only if you accept analytics cookies: the pages you view and when, the type of device and browser, your approximate location, how you reached the Website, a random identifier kept in the _ga cookie, and the fact that you booked a call (an event we count, without your name or email address).
• Why: to count visits and see which pages are read, so that we can improve the Website.
• Legal basis: your consent, which you can withdraw at any time.

Technical data

• Data: when your browser asks for a page, an image or another file, or sends a form or chat message, our hosting and content-delivery providers and Formspree process technical data such as your IP address and browser details.
• Why: so the Website can be delivered and kept secure.
• Legal basis: our legitimate interests in running a secure Website.

You do not have to give us your personal data, but without it we cannot answer an enquiry, a request or an application. Please do not send sensitive information (for example about health or ethnic origin) in a form or an application.

3. Job applicants

If you apply for a position through the Website, we use your full name, email address and phone number, the position you apply for, the links you give (LinkedIn profile, portfolio, CV) and your cover letter to assess your application, to contact you about it and, if you are hired, to start the employment or engagement. We share applications only with the people who take part in the decision and with the providers in section 5. We keep an application until the recruitment process ends and for 12 months after that, and then delete it (see section 7). Legal basis: steps before entering into a contract with you and our legitimate interests in recruiting.

4. Cookies and similar technologies

We do not use advertising or marketing cookies. We use:

• cml_cookie_consent (our own cookie, strictly necessary, 6 months): remembers your cookie choice so that we do not ask you again.
• _ga and _ga_ followed by the identifier of our property (Google Analytics, only if you accept analytics cookies, up to 2 years each): _ga is used to distinguish visitors and _ga_… to keep the state of a visit. We use the statistics to count visits and see which pages are read, so that we can improve the Website. Google signals and ad personalisation are switched off.
• Display setting (kept in your browser’s local storage, not a cookie): remembers whether you chose the light or the dark display.
• Calendly: if you open the booking window, that content is provided by Calendly, which may set its own cookies under its own policy.

You can accept or reject analytics cookies in the cookie banner, and change or withdraw your choice at any time with “Cookie settings” in the footer of every page. Rejecting analytics cookies does not affect how the Website works, and Google Analytics does not run unless you accept. You can also block or delete cookies in your browser settings.

5. Who receives your data

We use service providers that handle data on our behalf:

• Formspree, which receives and stores what you send through our forms and the chat window;
• Calendly, for booking calls;
• Google, for Google Analytics, only with your consent;
• our hosting and content-delivery providers, for example Sanity for images and jsDelivr for map data.

Where the law requires it, we may also disclose data to the authorities. We do not sell personal data.

6. Transfers outside the UK

Some of these providers are based in, or process data in, countries outside the United Kingdom and the European Economic Area, mainly the United States. Our own website is also served from a hosting provider in the United States. Where personal data is transferred there, we rely on a transfer mechanism permitted by data protection law:

• Google (Google Analytics) and Calendly: the UK-US data bridge, because both are certified to the Data Privacy Framework, including its UK Extension;
• Sanity: the standard contractual clauses of the European Union together with the UK Addendum.

For Formspree, our hosting provider and any other provider that is not covered by the data bridge or by our clauses with Sanity, we require another mechanism permitted by data protection law, such as the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU standard contractual clauses.

You can ask us at info@cmlteam.com for details of the safeguard that applies to a provider.

7. How long we keep it

We keep personal data only for as long as needed for the purpose for which we collected it, and then delete or anonymise it. In practice:

• Enquiries, chat messages, early-access requests and emails: for 24 months after our last contact with you, and then we delete them. If the contact leads to a contract, the records of the contract are kept for the period the law requires.
• Job applications: for 12 months after the recruitment process ends, so that we can answer a claim about it, and then we delete them.
• Call bookings: we delete the booking on our side 24 months after the call; Calendly keeps the booking data under its own policy.
• Analytics data: the event data Google Analytics keeps about your visit is deleted after 14 months, the retention period set in our account, and it exists only if you accepted analytics cookies; aggregated statistics that do not identify you may be kept longer.
• Records the law requires us to keep (for example accounting records): for the period the law requires.

8. Security

We take technical and organisational measures that are appropriate to the risk to protect personal data, and we limit access to the people who need it.

9. Your rights

Under the UK GDPR (and, if you are in the European Economic Area, the GDPR) you have the right to:

• ask us for access to your personal data;
• ask us to correct it, erase it or restrict how we use it;
• receive your data in a portable format, where this applies;
• withdraw your consent at any time, without affecting the processing that took place before.

You also have the right to object at any time to processing that is based on our legitimate interests. To use any of these rights, write to info@cmlteam.com.

10. Complaints

If you are unhappy with how we handle your personal data, please tell us at info@cmlteam.com. We will acknowledge your complaint within 30 days, look into it without undue delay, keep you informed and tell you the outcome. You also have the right to complain to the UK Information Commissioner’s Office (ico.org.uk) or, if you are in the European Economic Area, to the data protection authority of your country.

11. Children

The Website is aimed at businesses and professionals and is not directed at children. We do not knowingly collect personal data from children.

12. Changes to this policy

We may update this policy. The current version is always on this page, with its date at the top. If a change is significant, we will say so on the Website.