Privacy Policy
Your Data, Your Rights

Overview

At Norfy, we respect your privacy and are committed to protecting your personal data. This privacy policy explains how we collect, use, store, and protect information when you interact with us.

This policy applies to our website at norfy.co and all applications developed and published by Norfy. By using our website or apps, you agree to the practices described in this policy.

The data controller for your personal data is Norfy Ltd, trading as Norfy. We are registered in England and Wales under company number 17090160. You can contact us about anything in this policy at info@norfy.co.

This policy is effective as of March 2026. We encourage you to review it periodically for any updates.

What We Collect

We believe in collecting only what we need. Here is what we may collect depending on how you interact with us:

Information you provide directly:

• Your name and email address when you fill out a contact form or enquiry
• Any additional information you choose to include in a message to us
• Messages you send us through the live chat widget on our website

Information collected automatically:

• Basic usage data such as page views, device type, and browser type (if analytics are enabled)
• IP address and approximate location derived from it (for security and abuse prevention)

We do not use tracking cookies on our website. We use privacy-first, cookieless analytics that collect only anonymous, aggregated data with no personally identifiable information.

How We Use Your Data

We use the information we collect for the following purposes:

• To respond to your enquiries and provide the information or services you have requested
• To improve our website, apps, and services based on usage patterns and feedback
• To send you updates about our products or services, but only with your explicit consent
• To maintain the security and integrity of our website and systems
• To comply with legal obligations where applicable

We will never sell, rent, or trade your personal data to third parties for marketing purposes. Your trust matters more to us than any revenue from data monetisation.

Data Sharing

We do not sell or rent your personal data. We may share limited information with the following categories of service providers, solely to operate our business:

• Hosting provider (Cloudflare): Our website is hosted on Cloudflare Workers. Cloudflare may process certain technical data (such as IP addresses) as part of delivering and securing our website.
• Email service provider: When you contact us via our website, your message and contact details are processed through our email service so we can respond to your enquiry.

Beyond these operational needs, we will only disclose your personal data if required to do so by law, regulation, or legal process, or if we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others.

We require all third-party service providers to respect the security of your personal data and to treat it in accordance with applicable data protection laws.

Your Rights

Depending on your location and applicable laws, you may have the following rights regarding your personal data:

• Right of access: You can request a copy of the personal data we hold about you.
• Right to rectification: You can ask us to correct any inaccurate or incomplete personal data.
• Right to erasure: You can request that we delete your personal data, subject to any legal obligations we may have to retain it.
• Right to withdraw consent: Where we process data based on your consent, you can withdraw that consent at any time.
• Right to data portability: You can request your data in a structured, commonly used, machine-readable format.
• Right to lodge a complaint: You have the right to lodge a complaint with a supervisory authority if you believe we have not handled your data appropriately.

If you are located in the European Economic Area (EEA) or the United Kingdom, you are entitled to the full set of rights under the General Data Protection Regulation (GDPR) and the UK GDPR respectively.

To exercise any of these rights, please contact us at info@norfy.co. We will respond to your request within one calendar month.

Cookies & Tracking

We believe in a web that respects your privacy. Our current approach to cookies and tracking is straightforward:

• No tracking cookies: We do not use cookies to track your behaviour across our website or across other websites.
• Privacy-first analytics: We use a privacy-first analytics service that collects anonymous, aggregated usage data without cookies and without personally identifiable information. No consent banner is required as no personal data is processed.
• Live chat: If you open our chat, one cookie keeps the conversation with you as you move between pages. Nothing is stored unless you open the chat.
• Security: We use a cookie to tell real visitors from bots. If you are asked to confirm you are human, it remembers that you did, so you are not asked on every page.
• No third-party tracking cookies: We do not load scripts that place cookies to follow you across other websites.
• No advertising or retargeting: We do not run any advertising pixels or retargeting scripts.

If we ever introduce tools that use cookies or collect personal data, we will update this policy, clearly explain what is collected and why, and request your consent before setting any non-essential cookies on your device.

Data Security

We take the security of your data seriously and implement appropriate technical and organisational measures to protect it. These include:

• Encryption in transit: All data transmitted between your browser and our website is encrypted using HTTPS with TLS 1.2 or higher.
• Secure hosting: Our website is hosted on Cloudflare, which provides enterprise-grade security, DDoS protection, and a global content delivery network.
• Security headers: We implement industry-standard HTTP security headers including Content Security Policy, Strict Transport Security, and others to protect against common web vulnerabilities.
• Regular reviews: We periodically review our security practices and update them to address new threats and vulnerabilities.
• Data minimisation: We follow the principle of collecting only the minimum amount of personal data necessary to fulfil the purpose for which it is collected.

While no method of transmission over the internet or method of electronic storage is completely secure, we are committed to using commercially reasonable measures to protect your personal data.

Children's Privacy

Our website and services are not directed to children under the age of 13. We do not knowingly collect personal data from children under 13. If we become aware that we have inadvertently collected personal data from a child under 13, we will take steps to delete that information as soon as possible.

If you are a parent or guardian and believe that your child has provided us with personal data, please contact us at info@norfy.co so we can take appropriate action.

Changes to This Policy

We may update this privacy policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make changes, we will update the "Last updated" date at the top of this page.

If we make material changes that significantly affect how we handle your personal data, we will provide a prominent notice on our website prior to the change becoming effective. We encourage you to review this policy periodically to stay informed about how we protect your data.

Your continued use of our website or apps after any changes to this policy constitutes your acceptance of the updated policy.

Contact Us

If you have any questions, concerns, or requests regarding this privacy policy or how we handle your personal data, we would like to hear from you.

You can reach us by email at info@norfy.co. We will respond to all privacy-related enquiries within one calendar month.

You can also reach us through our contact page, where you can send us a message directly.

Written enquiries can be sent to our registered office:

You have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues, atico.org.uk.