This privacy policy explains how EngageHut (“we”, “us”, or “our”) collects, uses, and protects personal information you share with us when you visit engagehut.com or send us an enquiry. We aim to give you clear information about how your data is handled under the EU General Data Protection Regulation (GDPR).

Who we are

The data controller is Malgorzata Biszewska, a sole trader, trading as EngageHut, 9, Flat 3, Triq Amery, Sliema SLM 1706, Malta (VAT registration number MT32867113). “EngageHut” is our brand name, not a separate legal entity. For any questions about this policy or how we handle your data, contact us at [email protected].

What personal data we collect

We only collect the information we need to run this site and respond to enquiries.

The CRM audit enquiry form

If you use the enquiry form on /book-a-crm-audit/, we collect:

  • Your full name, work email address, and company or operator (required)
  • A free-text description of the CRM or retention problem you want to solve (required). This box can end up holding commercially sensitive detail about your business, so please share only what you are comfortable having stored in our mailbox, and do not include personal data about your own customers or players
  • Your current CRM or platform, and your intended timeframe (optional)
  • The time of submission and a random reference number for the submission, which are added to the email we receive

The form also has a hidden anti-spam field that real visitors never fill in. The form uses your IP address only to limit how often one address can submit it; it is held in the web server’s memory, is cleared whenever the site restarts, and the form does not save or log it or include it in the email. The web server’s own access logs do record it (see “How long we keep your data”).

Other data

  • Anything you voluntarily send us by email at the address above
  • Website usage data (pages visited, device type, country, referring site) through Google Analytics: a cookieless count for everyone, and analytics cookies only if you accept the analytics cookie
  • Technical data such as IP address and browser type, processed in the web server’s access logs and by Cloudflare for security and uptime

We do not intentionally collect sensitive categories of personal data, and we do not run a newsletter, user accounts, or a comment system.

How we use your data, and our legal basis

  • Replying to your enquiry and discussing a possible engagement (legal basis: taking steps at your request before entering into a contract, and our legitimate interest in answering business enquiries). We do not rely on consent for this; the notice under the form simply points you to this policy
  • Replying to emails you send us (legal basis: legitimate interest)
  • Understanding which content is useful, through Google Analytics (legal basis: your consent, which you can withdraw at any time)
  • Protecting the site from abuse and keeping it running, and meeting legal obligations (legal basis: legitimate interest or legal obligation)

Where your enquiry goes

When you submit the enquiry form, your data travels over HTTPS to our web server, which sends it as an email to our own mail server. Both run on the same hosting server, and the email is stored in the mailbox for our contact address. There is no separate CRM, database, or form-processing service: the email in that mailbox is the only record of your enquiry, apart from the backups described below.

Once a night, a copy of the mailbox is saved to Google Drive as a backup. Those backups therefore also contain your enquiry, including the free-text description. Our server logs record that a submission happened but not what you wrote in it.

How long we keep your data

  • Enquiries and emails you send us: kept for up to 12 months after our last interaction with you, then deleted by hand. Nothing deletes them automatically yet
  • Backups of the mailbox: each nightly copy is kept for 30 days, and one copy a month is kept for 180 days. A message deleted from the mailbox can therefore remain in backups for up to a further 180 days before it disappears
  • Mail server logs (sender, recipient, and delivery status): 30 days
  • Web server access logs: about 7 days
  • Google Analytics data (cookieless counts for everyone; cookie-based data only if you accepted): kept for the period configured in our analytics property, never longer than 14 months, then deleted automatically

Who we share your data with

Your data is never sold. These providers process it on our behalf:

  • Our hosting provider, which runs the server that serves this website and holds the mailbox, mail logs, and access logs
  • Cloudflare, which sits in front of the website to deliver it and protect it from abuse, and so handles visitors’ IP addresses and request data
  • Google, for the nightly mailbox backups on Google Drive and for Google Analytics (Google Ireland Limited; cookies only if you accept the analytics cookie)

We do not use a newsletter provider, a CRM, or any third-party form service for the enquiry form.

International data transfers

Cloudflare and Google may process data outside the European Economic Area, including in the United States. We do not choose where Google stores Drive backups. Where a transfer takes place, it relies on the safeguards those providers offer for such transfers, such as the European Commission’s Standard Contractual Clauses or an adequacy decision.

Your rights under GDPR

As a data subject, you have the right to:

  • Access the personal data we hold about you
  • Correct inaccurate or incomplete data
  • Request deletion of your data
  • Restrict or object to how we process it
  • Receive a portable copy of your data in a common format
  • Withdraw your consent at any time (this does not affect processing done before withdrawal)
  • Lodge a complaint with the Malta Office of the Information and Data Protection Commissioner (idpc.org.mt) or your local supervisory authority

To exercise any of these rights, email [email protected]. We will respond within 30 days.

Cookies

We do not set advertising or cross-site tracking cookies, and apart from the analytics cookies below we do not set cookies of our own. You can delete all cookies through your browser settings.

Analytics cookie (opt-in). Before you decide, and if you press Decline, the page sends Google Analytics a cookieless measurement request: no cookie is set and no identifier is stored on your device. Like any request to a web server, Google receives the page address, device details and IP address. If you press Accept on the analytics banner, Google Analytics 4 also sets the _ga and _ga_1Y3ZE27GBV cookies to count visits and see which pages are read. Accepting allows analytics storage only, not advertising storage, advertising data sharing or ad personalisation. We remember your choice in your browser (local storage key eh_analytics_consent_v1) so we do not ask again, and you can change it at any time:

Data security

Data is encrypted in transit with HTTPS, and the mailbox is readable only by the mail system and by us as administrators. No online service can guarantee absolute security, but we take reasonable steps to protect your information.

Children

EngageHut is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, email us and we will delete it.

Changes to this policy

We may update this policy from time to time. When we do, we will update the “Last updated” date at the top of this page.

Contact

For any questions about this privacy policy or how we handle your data, email [email protected].