This policy explains what personal data we process when you visit this site or contact us, why, on what legal basis, who we share it with, how long we keep it and what rights you have.
We follow the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 for visitors in the United Kingdom, and the data protection law of the Republic of Moldova, where we are established.
Who is the data controller?
The controller is Lole Works S.R.L., a company registered in Chișinău, Republic of Moldova.
For any question about your data, email dan@lole.works or call +373 69 163 838.
What data do we collect?
When you complete the scorecard:
- your answers and the resulting score;
- the number of companies or sites, the number of employees, how you handle the topic today and when you would like it solved;
- your name, role, company name and work email address;
- your phone number (optional);
- the campaign parameters in the address of the page you arrived on (for example which advert or message), if any.
Your answers stay in your browser until you send the form at the end.
When you use the contact form:
- your name;
- your company name (optional);
- your email address or phone number;
- what you want to solve, the number of companies or sites, the number of employees, your timeline and, optionally, the budget you have in mind;
- your message.
When you email or call us: the information you include in your message or in the call.
Technical data: when you visit the site, our hosting provider receives your IP address and technical information about your browser, which it needs to deliver the pages and protect the site. To limit abuse, our forms keep the IP address only in an irreversibly hashed form, not in clear.
Visit statistics, only with your consent: if you accept the "Analytics" category in the cookie banner, Google Analytics collects data about your visit: pages viewed, where you came from, device and browser type, approximate town or country, and actions such as sending a form.
Why do we use the data, and on what legal basis?
| Purpose | Legal basis |
|---|---|
| To show you your scorecard result and contact you about it | Steps taken at your request before entering into a contract (Article 6(1)(b) UK GDPR) |
| To reply to your enquiry and make you a proposal | Steps taken at your request before entering into a contract (Article 6(1)(b) UK GDPR) |
| To protect the site and the forms from abuse and automated messages | Our legitimate interest in keeping the site secure (Article 6(1)(f) UK GDPR) |
| To see, through Google Analytics, how the site is used | Your consent, which you can withdraw at any time (Article 6(1)(a) UK GDPR) |
| To perform the contract, if we work together, and keep accounting records | Performance of the contract and legal obligations (Article 6(1)(b) and (c) UK GDPR) |
We do not use your data for automated decisions that affect you, and we do not sell it to anyone.
Who do we share the data with?
We use a small number of providers who process data on our behalf, under contracts that require them to protect it:
| Provider | What for | Where |
|---|---|---|
| Cloudflare | Hosting the site, delivering pages and protection against attacks | Global network |
| Supabase | The database that receives scorecard results and contact form enquiries (our CRM) | European Union (Ireland) |
| Resend | Sending our internal email notification when an enquiry arrives | United States |
| Google (Google Analytics, Google Tag Manager) | Statistics on how the site is used, only with your consent | European Union and United States |
| Our email provider | Correspondence with you | As set out in our contract with the provider |
We may disclose data to authorities only where the law requires it.
Is the data transferred outside the United Kingdom?
Yes. We are established in the Republic of Moldova, and the providers above process data in the European Union, the United States and elsewhere. Where the law requires a safeguard for such a transfer, we rely on the mechanisms it provides, such as adequacy regulations or standard contractual terms.
How long do we keep the data?
- Scorecard results, contact form enquiries and correspondence: no more than 24 months from the last contact, unless we start working together. You can ask us to delete them sooner.
- Client data: for the length of the contract and then for as long as accounting and tax law requires.
- The hashed IP address used against abuse: no more than 12 months.
- Google Analytics data: no more than 14 months.
- Your cookie choice: 12 months, after which we ask again.
Cookies
The site stores your cookie choice in your browser, which is strictly necessary. With your consent it also loads Google Analytics, which sets its own cookies. The site does not use advertising cookies. You can change your choice at any time from "Cookie settings" at the bottom of every page.
What rights do you have?
You have the right to:
- know what data we hold about you and receive a copy (access);
- have inaccurate data corrected (rectification);
- have your data deleted (erasure);
- ask us to restrict processing;
- receive your data in a structured format (portability);
- object to processing based on our legitimate interest;
- withdraw your consent at any time, without affecting processing done before.
To use any of them, email dan@lole.works. We reply within one month.
If you believe we are infringing your rights, you can complain to the Information Commissioner's Office (ico.org.uk).
How do we protect the data?
Access to data is limited to the people who need it to reply to you. We use encrypted connections (HTTPS), role-based access control in the database and providers with recognised security standards.