1. Who we are

The controller of your personal data is Machineium Ltd, a company registered in England and Wales (company number 16092459), registered office 32 Parsonage Brow, Upholland, United Kingdom. Contact us about anything in this notice at contact@machineium.com.

2. What we collect

  • Contact details you give us in a form: name and email address; company name if you choose to add it.
  • Your message, if you use the contact form.
  • Consent records: what you agreed to, the wording version, the form it came from and when.
  • Campaign information: the UTM tags in the link you arrived from, if any.
  • Security data: a one-way hash of your IP address, used only to block spam and abuse.
  • Cookie choices: a random ID and your settings (no personal identifiers). See our cookie policy.

We don't collect special category data and don't knowingly collect data from children under 16.

3. Why we use it and our lawful bases

  • Sending a resource you requested, workshop details and reminders: consent, given with the required box on the form.
  • Reviewing your application to the Power Platform Incubator (name, email, location, role, company, start date and what you tell us about yourself): steps you ask us to take before you join the programme (contract), and legitimate interests in running a fair selection.
  • Our occasional newsletter: consent, given only with the separate optional box. Never assumed.
  • Replying to your enquiry and taking steps before a contract: contract (pre-contractual steps) and legitimate interests in responding to you.
  • Keeping the site secure and preventing spam: legitimate interests.
  • Analytics: consent, via the cookie banner. Off by default.

You can withdraw consent at any time; it doesn't affect anything we did before you withdrew it.

4. Who we share it with

We don't sell your personal data. We use these processors, under contract and only on our instructions:

  • Website hosting and database: hosts this site and stores form submissions.
  • Email delivery: sends resources, workshop reminders and newsletters.

We may disclose data if required by law or to protect our legal rights.

No third-party services receive data when you load a page. Fonts, icons and images are served from our own site, we use no embeds, ad pixels or external analytics, and your browser is told not to contact any other domain. The external booking page is only opened if you click its link.

5. International transfers

Some processors may handle data outside the UK or EEA. Where they do, we rely on adequacy regulations or safeguards such as the UK International Data Transfer Agreement (IDTA) / UK Addendum and the EU Standard Contractual Clauses (SCCs). Ask us for details.

6. How long we keep it

  • Leads and enquiries: deleted after 24 months of inactivity, or sooner if you ask.
  • Incubator applications: deleted 12 months after the cohort you applied for ends, or sooner if you ask.
  • Newsletter: until you unsubscribe; we then keep a minimal suppression record so we don't email you again.
  • Consent records: for as long as we rely on the consent, plus 2 years to show we had it.
  • Cookie choices: 12 months, after which we ask again.

7. Your rights (UK and EU)

You have the right to:

  • access your data;
  • have it corrected (rectification);
  • have it deleted (erasure);
  • restrict how we use it;
  • receive it in a portable format;
  • object to processing based on legitimate interests, and to direct marketing at any time;
  • withdraw consent at any time.

Email contact@machineium.com to use any of these. We reply within one month. You can also complain to the UK Information Commissioner's Office (ico.org.uk) or, if you're in the EU/EEA, your local data protection supervisory authority.

8. US privacy rights

If you live in a US state with a consumer privacy law (such as California, Colorado, Connecticut, Virginia or others):

  • Categories collected: identifiers (name, email), commercial/professional information you choose to share (company, message), internet activity (campaign tags, hashed IP) and inferences we don't make.
  • Sources: you, directly, through our forms.
  • We do not sell your personal information and do not share it for cross-context behavioural advertising, and we don't use it for profiling with legal effects.
  • Your rights: to know what we hold, to delete it, to correct it, and to opt out of any sale, sharing or targeted advertising.
  • Global Privacy Control: we treat a GPC signal from your browser as a valid opt-out of non-essential tracking.
  • No discrimination: we won't treat you differently for exercising your rights.

Email contact@machineium.com to make a request. We'll verify it using your email address. An authorised agent may act for you with your signed permission.

9. Security

Data is encrypted in transit, access is restricted to people who need it, and public visitors can't read form submissions.

10. Changes

We'll update this page if anything changes and revise the date at the top.