PRIVACY POLICY

Last Updated: 21.10.2026

This policy explains how CML Team Limited (“CML Team”, “we”, “us”, “our”) handles personal data when you use https://cmlteam.com (the “Website”). Please read it together with our Terms and Conditions.

In short

• We collect what you send us through our forms, the chat window, job applications and call bookings, and we use it to answer you, to discuss work and to recruit.
• Google Analytics runs only if you accept analytics cookies, and advertising and remarketing with Google, LinkedIn and Microsoft run only if you accept advertising cookies. Until you choose, the Website sends nothing to any of them, and you can withdraw your choice at any time with “Cookie settings” in the footer.
• You have rights over your data, and you can write to us at info@cmlteam.com.

1. Who we are

CML Team Limited is a company registered in England and Wales (company number 11580376). Our registered office is 61 Bridge Street, Kington, HR5 3DJ, United Kingdom. We are the controller of the personal data described in this policy. You can reach us at info@cmlteam.com.

2. What we collect, why, and on what basis

We collect personal data directly from you through the Website. For each purpose:

Contact form (also on the home page)

• Data: name, email address, company (optional), a description of your project and an estimated budget (optional). The form also receives where your visit came from, taken from the address of the page you are on (for example, that you followed a link in one of our blog posts), and your answer to the optional question “How did you hear about us?”.
• Why: to reply to you and to discuss a possible engagement.
• Legal basis: our legitimate interests in answering enquiries and developing our business and, if you ask us to, steps before entering into a contract.

Chat window

• Data: name, email address, phone number and your message.
• Why and legal basis: as for the contact form.

Early-access form (Persona page)

• Data: email address, LinkedIn profile and the reason you give.
• Why: to review your request and to get in touch with you about it.
• Legal basis: our legitimate interests in running the early-access programme.

Booking a call

• Data: the details you enter in the scheduling window (for example your name, email address and the time you choose), which Calendly processes to make the booking.
• Why: to hold the call you asked for.
• Legal basis: steps at your request before entering into a contract, and our legitimate interests.

Emails

• Data: what you write to info@cmlteam.com, and the copies of form and chat messages that reach our mailboxes.
• Why: to answer you and to keep a record of our business dealings.
• Legal basis: our legitimate interests.

Visit statistics

• Data: only if you accept analytics cookies: the pages you view and when (with the kind of page, such as a blog post or a case study, and its topic or industry), the type of device and browser, your approximate location, how you reached the Website, a random identifier kept in the _ga cookie, how fast pages load and respond on your device, and the actions we count: opening the booking window, booking a call, sending a form or an application, and clicking a call-to-action button (events without your name, email address or anything you wrote).
• Why: to count visits, see which pages are read and how fast they are, so that we can improve the Website.
• Legal basis: your consent, which you can withdraw at any time.

Advertising and remarketing

• Data: only if you accept advertising cookies: the pages you view and when, the identifier of the Google, LinkedIn or Microsoft ad you clicked (if you came from one of our ads), the actions we count (booking a call, sending the contact form; these reach LinkedIn and Microsoft as an event with a fixed name, never with what you typed), the type of device and browser, your IP address, your approximate location, and identifiers kept in the cookies listed in section 4. If you also accept analytics cookies and Google signals is on, Google may add whether you are signed in to a Google account with ad personalisation switched on. The LinkedIn tag may also record which links and buttons you click on our pages and how long you stay on a page (its website actions feature) and send this to LinkedIn. LinkedIn can link a visit to a LinkedIn member in its own systems and Microsoft to a Microsoft account; we never see who that is.
• Why: to measure whether our ads on Google, LinkedIn and Microsoft Advertising (Bing) work, to build groups of visitors (audiences) that these companies may show our ads to on their own platforms and partner websites (remarketing), and to show those ads.
• Who decides what: we decide to place the tags on the Website, and we place them only after you accept advertising cookies. For that one step, in which a LinkedIn or Microsoft tag collects data in your browser and passes it on to LinkedIn or Microsoft, we and the company behind the tag are jointly responsible (Article 26 of the GDPR and the UK GDPR); we use the tags under the LinkedIn Ads Agreement and the Microsoft Advertising Agreement. What LinkedIn, Microsoft and Google do with the data afterwards in their own systems, each of them decides alone and is alone responsible for, under its own privacy policy. The company behind the tag is LinkedIn Ireland Unlimited Company for visitors in the European Union, the European Economic Area and Switzerland and LinkedIn Corporation elsewhere, as LinkedIn’s privacy policy states (see also its cookie policy), and Microsoft Ireland Operations Limited for visitors in the European Economic Area, the United Kingdom and Switzerland and Microsoft Corporation elsewhere, as Microsoft’s privacy statement states. From LinkedIn and Microsoft we receive totals and audiences, and we do not use them to identify you. You can switch off personalised advertising with LinkedIn in LinkedIn’s ad settings.
• Legal basis: your consent, which you can withdraw at any time.

Technical data

• Data: when your browser asks for a page, an image or another file, or sends a form or chat message, our hosting and content-delivery providers and Formspree process technical data such as your IP address and browser details.
• Why: so the Website can be delivered and kept secure.
• Legal basis: our legitimate interests in running a secure Website.

You do not have to give us your personal data, but without it we cannot answer an enquiry, a request or an application. Please do not send sensitive information (for example about health or ethnic origin) in a form or an application.

3. Job applicants

If you apply for a position through the Website, we use your full name, email address and phone number, the position you apply for, the links you give (LinkedIn profile, portfolio, CV) and your cover letter to assess your application, to contact you about it and, if you are hired, to start the employment or engagement. We share applications only with the people who take part in the decision and with the providers in section 5. We keep an application until the recruitment process ends and for 12 months after that, and then delete it (see section 7). Legal basis: steps before entering into a contract with you and our legitimate interests in recruiting.

4. Cookies and similar technologies

We use:

• cml_cookie_consent (our own cookie, strictly necessary, 6 months): remembers your cookie choice so that we do not ask you again.
• _ga and _ga_ followed by the identifier of our property (Google Analytics, only if you accept analytics cookies, up to 2 years each): _ga is used to distinguish visitors and _ga_… to keep the state of a visit. We use the statistics to count visits, see which pages are read and how fast they are, so that we can improve the Website. Google signals and ad personalisation in Google Analytics are switched on only if you also accept advertising cookies; otherwise they are off.
• _gcl_au, _gcl_aw, _gcl_gb and _gac_gb_ followed by the identifier of our property (Google Ads, our own cookies on this website, only if you accept advertising cookies, 90 days each): they keep the identifier of the ad click that brought you here and information about your visit, so that we can measure whether our ads work.
• IDE (up to 13 months in the European Economic Area and the United Kingdom, 24 months elsewhere), test_cookie (15 minutes) and RUL (12 months) (set by Google on its domain doubleclick.net, only if you accept advertising cookies): they let Google recognise your browser and check that it accepts cookies, so that our ads can be measured and shown on Google and partner websites (remarketing).
• ar_debug (90 days, set by Google on doubleclick.net, only if you accept advertising cookies): used to test and debug how ad conversions are measured.
• li_fat_id (30 days), li_giant (7 days) and li_adsId (180 days, also kept in local storage) (LinkedIn Insight Tag, our own cookies on this website, only if you accept advertising cookies): they keep the identifier of the LinkedIn ad click that brought you here, an identifier of the group of members that click belongs to, and a random identifier of your browser for LinkedIn’s ad measurement.
• bcookie (1 year), bscookie (1 year), lidc (24 hours), UserMatchHistory (30 days), AnalyticsSyncHistory (30 days) and li_sugr (90 days) (set by LinkedIn on its domain linkedin.com, only if you accept advertising cookies): they let LinkedIn recognise your browser, choose a data centre, sync advertising identifiers and match your browser to a member’s identity with some probability, so that our ads can be measured and shown.
• _uetsid (24 hours), _uetvid (390 days) and _uetmsclkid (90 days) (Microsoft Advertising tag, our own cookies on this website, only if you accept advertising cookies): they identify the current visit, a random identifier of your browser, and the Microsoft ad click that brought you here. The tag also keeps copies of the first two in local storage.
• MUID (13 months), MR and MSPTC (set by Microsoft on its domain bing.com, only if you accept advertising cookies): they let Microsoft recognise your browser, so that our ads can be measured and shown. The period of MR and MSPTC is set by Microsoft, see its privacy statement.
• Display setting (kept in your browser’s local storage, not a cookie): remembers whether you chose the light or the dark display.
• Calendly: if you open the booking window, that content is provided by Calendly, which may set its own cookies under its own policy.

You can accept or reject analytics cookies and advertising cookies separately in the cookie banner, and change or withdraw your choice at any time with “Cookie settings” in the footer of every page. When you withdraw a choice, the cookies and local-storage entries of that category that this Website set are deleted; the cookies of Google (doubleclick.net), LinkedIn (linkedin.com) and Microsoft (bing.com) on their own domains can only be deleted in your browser. If you withdraw advertising cookies after the LinkedIn or Microsoft script has run on a page, the page reloads once, because a script that is running cannot be stopped from outside. Rejecting either kind does not affect how the Website works, and Google Analytics and the advertising tags do not run unless you accept. You can also block or delete cookies in your browser settings, and manage ad personalisation in Google’s ad settings, in LinkedIn’s ad settings and in Microsoft’s ad settings.

5. Who receives your data

We use service providers that handle data on our behalf, and advertising partners that receive data for the purposes described in section 2:

• Formspree, which receives and stores what you send through our forms and the chat window;
• Calendly, for booking calls;
• Google, for Google Analytics and Google Ads, only with your consent;
• LinkedIn (LinkedIn Ireland Unlimited Company for visitors in the European Union, the European Economic Area and Switzerland, LinkedIn Corporation elsewhere), for the LinkedIn Insight Tag and LinkedIn Ads, only with your consent;
• Microsoft (Microsoft Ireland Operations Limited for visitors in the European Economic Area, the United Kingdom and Switzerland, Microsoft Corporation elsewhere), for Microsoft Advertising (Bing) and its Universal Event Tracking tag, only with your consent;
• our hosting and content-delivery providers. The images and the map data on the Website are stored on the server that hosts the Website and are sent from there, so no separate image or map provider receives your data.

Where the law requires it, we may also disclose data to the authorities. We do not sell personal data.

6. Transfers outside the UK

Some of these providers are based in, or process data in, countries outside the United Kingdom and the European Economic Area, mainly the United States. Our own website is also served from a hosting provider in the United States. Where personal data is transferred there, we rely on a transfer mechanism permitted by data protection law:

• Google (Google Analytics and Google Ads) and Calendly: the UK-US data bridge, because both are certified to the Data Privacy Framework, including its UK Extension;
• LinkedIn and Microsoft: for visitors in the European Economic Area, the United Kingdom and Switzerland, Microsoft’s company is Microsoft Ireland Operations Limited, in Ireland, in the European Economic Area, which the UK recognises as providing adequate protection; for LinkedIn, its privacy policy names LinkedIn Ireland Unlimited Company for the European Union, the European Economic Area and Switzerland and LinkedIn Corporation, in the United States, elsewhere. Both groups also process data in the United States, where LinkedIn Corporation and Microsoft Corporation rely on the Data Privacy Framework, including its UK Extension, and on standard contractual clauses where they need them.

For Formspree, our hosting provider and any other provider that is not covered by the data bridge, we require another mechanism permitted by data protection law, such as the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU standard contractual clauses.

You can ask us at info@cmlteam.com for details of the safeguard that applies to a provider.

7. How long we keep it

We keep personal data only for as long as needed for the purpose for which we collected it, and then delete or anonymise it. In practice:

• Enquiries, chat messages, early-access requests and emails: for 24 months after our last contact with you, and then we delete them. If the contact leads to a contract, the records of the contract are kept for the period the law requires.
• Job applications: for 12 months after the recruitment process ends, so that we can answer a claim about it, and then we delete them.
• Call bookings: we delete the booking on our side 24 months after the call; Calendly keeps the booking data under its own policy.
• Analytics data: the event data Google Analytics keeps about your visit is deleted after 14 months, the retention period set in our account, and it exists only if you accepted analytics cookies; aggregated statistics that do not identify you may be kept longer.
• Advertising audiences: if you accepted advertising cookies, you stay in our remarketing audiences on Google, LinkedIn and Microsoft for up to 180 days after your last visit, and then you drop out unless you visit again.
• LinkedIn: the data the Insight Tag collects is kept by LinkedIn with your direct identifiers removed within 7 days, and the pseudonymised data is deleted within 180 days, as LinkedIn states.
• Microsoft: Microsoft keeps the data collected by its tag for 390 days, as Microsoft states.
• Records the law requires us to keep (for example accounting records): for the period the law requires.

8. Security

We take technical and organisational measures that are appropriate to the risk to protect personal data, and we limit access to the people who need it.

9. Your rights

Under the UK GDPR (and, if you are in the European Economic Area, the GDPR) you have the right to:

• ask us for access to your personal data;
• ask us to correct it, erase it or restrict how we use it;
• receive your data in a portable format, where this applies;
• withdraw your consent at any time, without affecting the processing that took place before.

You also have the right to object at any time to processing that is based on our legitimate interests. To use any of these rights, write to info@cmlteam.com.

For the data that Google, LinkedIn or Microsoft hold about you in their own systems, you can use the same rights with them: LinkedIn through its privacy policy and its data protection contact form, Microsoft through its privacy dashboard and privacy statement, and Google through its privacy policy. You can switch off personalised advertising with each of them in the ad settings linked in section 4, and you can withdraw your consent to our advertising tags at any time with “Cookie settings” in the footer.

10. Complaints

If you are unhappy with how we handle your personal data, please tell us at info@cmlteam.com. We will acknowledge your complaint within 30 days, look into it without undue delay, keep you informed and tell you the outcome. You also have the right to complain to the UK Information Commissioner’s Office (ico.org.uk) or, if you are in the European Economic Area, to the data protection authority of your country.

11. Children

The Website is aimed at businesses and professionals and is not directed at children. We do not knowingly collect personal data from children.

12. Changes to this policy

We may update this policy. The current version is always on this page, with its date at the top. If a change is significant, we will say so on the Website.