Privacy & Cookie Policy

1. Who we are

Serendipiware Ltd is the data controller for the personal data described in this policy. That means we decide what gets collected and why, and we're the ones responsible for looking after it.

We're a small company, so there's no dedicated privacy department. Your email goes straight to a human who can actually do something about it.

2. What this policy covers

This policy applies only to serendipiwa.re, our company site and blog. It's a static site with no accounts, no logins and nothing to sign up for.

Each of our products has its own privacy policy, published on its own site, because each one handles data differently. If you're looking for how a specific product treats your data, check the policy linked in that product's footer. This policy also doesn't cover other websites we link to. Once you click through to someone else's site, you're under their rules.

3. What we collect

When you browse

Anonymous, aggregated analytics: page views, referrer, rough country, browser and device type. This is collected without cookies and without anything that identifies you personally. We can tell that a blog post got 400 views. We can't tell that one of them was you.

Server logs

Our hosting provider keeps short-lived technical logs, including IP addresses, to serve the site and block abuse. We don't build profiles from them and we don't use them for analytics.

When you email us

Whatever you put in the email: your address, your name if you give it, and the contents of the message. Nothing more, and we don't add you to any list off the back of it.

4. Why we're allowed to

Under UK and EU GDPR we need a legal basis for every bit of processing. Ours are:

• Legitimate interest, for anonymous analytics, keeping the site secure, and replying to messages you send us.
• Consent, where we ask for it directly, such as an email newsletter. You can pull it back at any time.
• Legal obligation, for keeping records we're legally required to keep and responding to lawful requests.

5. Cookies and analytics

We use Umami for analytics. It's privacy-first and cookieless: no persistent identifier is stored on your device and no profile is built about you across sites. That's the whole reason we don't show you a cookie banner.

This site sets no advertising cookies, no cross-site trackers and no social media pixels. If that ever changes, we'll ask for your consent first and update this page before anything runs.

6. Who we share data with

We don't sell your data, and we don't share it for advertising. Two providers are involved in running this site:

Both are bound by a data processing agreement and can only use data to provide the service to us. Where data reaches a provider outside the EU or UK, it's protected by Standard Contractual Clauses or an equivalent safeguard. If you email us, your message sits with our email provider until we delete it. We may also disclose data if the law genuinely requires it, and if we're allowed to tell you about it, we will.

7. How long we keep things

• Analytics: anonymous and aggregated, kept indefinitely because it isn't personal data.
• Server and security logs: a short rolling window, typically no more than 30 days.
• Emails you send us: up to 2 years, so we have context if you write again.

8. Your rights

You have the right to:

• Get a copy of the data we hold about you
• Correct anything that's wrong
• Ask us to delete it
• Object to or restrict certain processing
• Withdraw consent at any time, without it affecting what happened before

Realistically, for this site that mostly means your emails, since everything else is anonymous. Write tohello@serendipiwa.re and we'll respond within 30 days. It's free. If you think we've handled your data badly, you can complain to the UK Information Commissioner's Office at ico.org.uk, or to the data protection authority in your own country if you're in the EU.

9. Security

Everything runs over HTTPS. The site is static, so there's no database attached to it and very little to steal in the first place. No system is perfectly secure, but if a breach ever put you at risk, we'd tell you and the relevant regulator within 72 hours.

10. Children

This site isn't aimed at children under 16, and since there's nothing here to sign up for, we don't knowingly collect data from them.

11. Changes to this policy

We'll update this page when things change, and the date at the top will tell you when that happened. If a change actually affects your rights, we'll say so clearly rather than quietly editing the page.

12. Contact

Questions, requests, or a paragraph here that makes no sense? Emailhello@serendipiwa.re.

We'd genuinely rather explain it than have you guess.