Privacy Policy
Last updated: 16 September 2026
Anature Ltd respects the confidentiality of everything our clients and prospective clients tell us — it is the basis of the work we do. This policy explains what personal data we collect through anatureltd.co.uk and in the course of our business, why we hold it, how long we keep it, and what rights you have over it.
It is written to meet the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Who we are
The data controller is:
ANATURE LTD, a company registered in England and Wales under number 06538975, whose registered office is at 19 The Circle, Queen Elizabeth Street, London SE1 2JE, United Kingdom.
Contact for all privacy matters: business@anatureltd.co.uk
We have not appointed a Data Protection Officer; we are not required to. Privacy questions are handled by the company's director.
2. What we collect
2.1 When you send us an enquiry or request a quote
Through the form on this site, or by writing to us directly:
- your name and the company you work for;
- your work email address, and your telephone number if you provide it;
- your country and the sector you operate in;
- the size of your company, the channels you sell through, and the areas of our platform that interest you, if you tell us;
- anything else you choose to write in your message — typically a description of your products, your suppliers and your current process;
- the date and time of your enquiry.
Please send us only what is needed to understand your enquiry. Do not send special category data (health, biometric, political, religious or trade union data) or anyone's personal data beyond business contact details.
2.2 When you simply visit the site
Our server records technical data for each request: IP address, date and time, page requested, HTTP status, browser and operating system type, and referring page. These logs exist to keep the site running and secure. No audience measurement is in place today; were any to be added, we would receive aggregated data only from visitors who had agreed to it — see our Cookie Policy.
2.3 When you become a client, or discuss becoming one
In the course of a commercial relationship we hold the business contact details of the people we work with, the correspondence exchanged, contracts, quotations and invoices, and the records needed to run a project and account for it.
2.4 Data held inside the systems we build
Where we develop or maintain an Anature system for a client, that system may contain personal data belonging to the client — their staff, their suppliers, their customers and, where the system handles online sales, the people who buy from them. For that data, our client is the controller and Anature Ltd acts solely as a processor, on their documented instructions, under a written data processing agreement. We do not use client data for our own purposes, we do not use it to train models, and we do not disclose it to anyone without the client's instruction. If you believe your data sits in a system we operate on a client's behalf, please address your request to that client; we will support them in answering it.
2.5 Payment data
Where an Anature system integrates payment, the platform records what the client needs in order to run its business: the order, the amount, the currency, the payment method type, the transaction reference returned by the payment provider, the status of the payment, and any refund or chargeback attached to it.
Full card numbers, expiry dates and security codes are never collected or stored by Anature or by Anature Ltd. They are captured directly by the payment provider our client has contracted with, and held by that provider under its own PCI DSS certification. That provider is an independent controller in respect of the data it holds for its own regulatory and fraud-prevention purposes; its own privacy notice applies to that processing.
Anature Ltd does not receive, hold or transmit funds belonging to clients or to their customers. Its role is technical: connecting the systems, recording the result, and reconciling it against the order.
This site itself takes no payment and processes no payment data.
3. Why we hold it, and on what legal basis
| What we do | Why | Legal basis (UK GDPR Art. 6) |
|---|---|---|
| Reply to your enquiry and prepare a quotation | You asked us to | Steps taken at your request prior to entering a contract — Art. 6(1)(b); consent, where you ticked the form consent box — Art. 6(1)(a) |
| Run a project and maintain a client relationship | To perform the contract | Contract — Art. 6(1)(b) |
| Keep server logs, protect the site against abuse and attack | To keep the service available and secure | Legitimate interests — Art. 6(1)(f) |
| Measure how the site is used | To improve it | Consent — Art. 6(1)(a) |
| Send occasional information to existing business contacts about our services | To maintain the relationship | Legitimate interests — Art. 6(1)(f), with an unsubscribe link in every message |
| Keep accounting and tax records | Legal obligation under UK company and tax law | Legal obligation — Art. 6(1)(c) |
| Establish, exercise or defend a legal claim | To protect our position | Legitimate interests — Art. 6(1)(f) |
Where we rely on legitimate interests, we have weighed those interests against your rights and concluded that the processing is limited, expected and not intrusive. You may object at any time — see section 7.
We do not carry out automated decision-making or profiling that produces legal effects concerning you.
4. Who sees it
Your data is seen by the people at Anature Ltd who need it to answer you or to run your project. Beyond that, it is disclosed only to:
- our technical suppliers, acting as processors under contract — hosting, email, backup, and — if audience measurement is ever added — analytics, and then only where you have consented. They act only on our instructions;
- payment providers, in the context of a client system only, and solely so that a payment made to our client can be processed — never in respect of data collected through this website;
- our professional advisers — accountants, auditors, lawyers — where necessary and under a duty of confidentiality;
- public authorities, where we are legally obliged to disclose.
We never sell your data, rent it, or share it for anyone else's marketing.
5. Where it is held
We host our systems and data within the United Kingdom and the European Economic Area wherever we can.
If a supplier processes data outside the UK, we do so only where the transfer is covered by UK adequacy regulations, or by the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with any additional safeguards the transfer requires. You may ask us which mechanism applies to a given supplier.
6. How long we keep it
| Data | Retention |
|---|---|
| Enquiries that do not lead to a commercial relationship | 24 months from the last exchange, then deleted |
| Prospect and client correspondence | Duration of the relationship, then 3 years |
| Contracts, quotations, invoices and accounting records | 6 years after the end of the financial year concerned (UK statutory requirement) |
| Server logs | 12 months |
| Analytics data, if audience measurement is added | Up to 13 months, aggregated |
| Cookie consent record | 6 months |
When a retention period ends, data is deleted or irreversibly anonymised. Where deletion is technically impractical — in a backup, for instance — the data is isolated and left unprocessed until the backup cycle overwrites it.
7. Your rights
Under the UK GDPR you have the right to:
- be informed about how we use your data — this document;
- access the personal data we hold about you, and receive a copy;
- rectification of data that is inaccurate or incomplete;
- erasure of your data, where there is no overriding reason for us to keep it;
- restriction of our processing while a dispute over accuracy or legitimate interests is resolved;
- portability — receive the data you gave us in a structured, machine-readable format, or have it transmitted to another controller;
- object to processing based on legitimate interests, and to direct marketing at any time and without reason;
- withdraw consent at any time, where processing rests on consent. This does not affect the lawfulness of what was done before you withdrew it.
To exercise any of these rights, write to business@anatureltd.co.uk. We will reply within one month. Where a request is complex, we may extend that by a further two months and will tell you why within the first month. We may ask for proof of identity where we have genuine doubt about who is making the request. Exercising these rights is free of charge.
8. Complaints
If you are unhappy with how we have handled your data, tell us first — we would prefer to resolve it directly. You also have the right to complain to the UK supervisory authority at any time:
Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF — ico.org.uk — telephone 0303 123 1113.
9. Security
We protect personal data with measures appropriate to the risk: encryption in transit (TLS) and at rest where applicable, access restricted to those who need it and authenticated individually, activity logging, regular patching, encrypted backups tested for restoration, and confidentiality obligations binding everyone who works with us. Where we act as a processor for a client, the security measures agreed in that contract apply in addition.
No system is absolutely secure. If a breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and inform you without undue delay where the risk is high.
10. Children
This site is addressed to businesses. We do not knowingly collect data relating to anyone under 18. If you believe a child has sent us personal data, write to us and we will delete it.
11. Changes to this policy
We update this policy when our practices change. The date at the top of the page shows the current version. Where a change materially affects your rights, we will make it clear on the site and, where the law requires it, ask for your consent again.
12. Contact
Anature Ltd — Data protection19 The Circle, Queen Elizabeth Street, London SE1 2JE, United Kingdom
business@anatureltd.co.uk