Privacy Policy

1. Data controller

Banto Ltd ("Banto", "we", "us", "our") is the data controller responsible for your personal data. We are a company registered in England and Wales (company number 17037384).

We have not appointed a Data Protection Officer as we are not required to do so under UK GDPR. If you have questions about how we handle your data, contact us at luke@banto.systems.

You must be at least 18 years old to use this website or engage our services. We do not knowingly collect personal data from anyone under 18.

2. What data we collect

Information you provide

• Contact form submissions: your name, email address, company name, and the nature of your enquiry.
• Email correspondence: any information you share when you email us directly.
• Scheduling: when you book a call via Calendly, Calendly collects your name, email, and any information you provide. Please refer to Calendly's Privacy Policy for details.

Information collected automatically

• Analytics data: we use Google Analytics to understand how visitors use our website. This includes pages visited, time on site, referral source, approximate location (country/city level), device type, and browser type. Google Analytics uses cookies to collect this data.

Data we do not collect

We do not collect any special categories of personal data as defined by UK GDPR Article 9. This includes data about race or ethnicity, religious or philosophical beliefs, sex life or sexual orientation, political opinions, trade union membership, health, or genetic and biometric data. We do not collect information about criminal convictions or offences.

3. Cookies

We use the following cookies on our website:

Cookie	Provider	Purpose	Duration
_ga	Google Analytics	Distinguishes unique visitors	2 years
_ga_*	Google Analytics	Maintains session state	2 years
theme	banto.systems	Stores your light/dark mode preference	Persistent (localStorage)

Under the Privacy and Electronic Communications Regulations (PECR), analytics cookies require your consent. Google Analytics cookies are only set when you consent to analytics. You can withdraw your consent at any time using the cookie banner shown when you visit our site, or by clearing your browser cookies. See our Cookie Policy for full details.

4. Lawful basis for processing

We process your personal data under the following lawful bases (UK GDPR Article 6):

• Consent (Article 6(1)(a)): for analytics cookies. You can withdraw consent at any time.
• Legitimate interest (Article 6(1)(f)): for processing contact form data and email correspondence to respond to your enquiry and provide our services. Our legitimate interest is to communicate with potential and existing clients.
• Contract (Article 6(1)(b)): where processing is necessary for the performance of a consultancy engagement.

5. How we use your data

• To respond to your enquiries and provide our consultancy services.
• To understand how our website is used and improve its content.
• To comply with legal obligations.

6. Data sharing and third parties

We do not sell your personal data. We share data with the following third-party services:

• Google Analytics (Google LLC): website usage analytics. Data may be transferred to the United States. Google is certified under the UK Extension to the EU-US Data Privacy Framework. See Google's Privacy Policy.
• Calendly (Calendly LLC): appointment scheduling. See Calendly's Privacy Policy.

We do not allow third-party service providers to use your personal data for their own purposes. They may only process your data for the specific purposes described above and in accordance with our instructions.

We may also disclose your personal data if required to do so by law, or if we believe in good faith that disclosure is necessary to comply with a legal obligation, protect our rights, or ensure the safety of our users. In the event of a business sale, merger, or acquisition, your personal data may be transferred to the new owner as part of that transaction.

7. International transfers

Some of our third-party service providers are based outside the UK. Where personal data is transferred internationally, we ensure appropriate safeguards are in place, including adequacy decisions, standard contractual clauses, or participation in recognised data transfer frameworks.

8. Data retention

• Contact form and email data: retained for 2 years from the date of your last communication, or longer if required for an ongoing engagement.
• Analytics data: Google Analytics data is retained for 14 months, after which it is automatically deleted.
• Engagement records: retained for 6 years to comply with UK legal and tax obligations.

9. Data security

We take reasonable technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, or alteration. These include encryption of data in transit (HTTPS/TLS), access controls limiting who can view your data, and secure storage of any records we hold.

No method of transmission over the internet or electronic storage is completely secure. While we take steps to protect your data, we cannot guarantee its absolute security.

10. Your rights under UK GDPR

You have the following rights regarding your personal data:

• Right to be informed: to know how your personal data is being collected and used. This privacy policy fulfils that obligation.
• Right of access: request a copy of the personal data we hold about you.
• Right to rectification: request correction of inaccurate or incomplete data.
• Right to erasure: request deletion of your data where there is no compelling reason for continued processing.
• Right to restrict processing: request that we limit how we use your data.
• Right to data portability: request a copy of your data in a structured, commonly used format.
• Right to object: object to processing based on legitimate interest or for direct marketing purposes.
• Right to withdraw consent: where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, email us at luke@banto.systems. We will respond within one month. There is no fee for making a request unless it is clearly unfounded or excessive.

11. Complaints

If you are not satisfied with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

Information Commissioner's Office
Website: ico.org.uk
Helpline: 0303 123 1113

12. Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page indicates the most recent revision.

13. Contact

For any questions about this Privacy Policy or your personal data:

Banto Ltd
Email: luke@banto.systems
Web: banto.systems