What happens to the information you send Industrial™?
Industrial™ uses what you send only to reply and, if it becomes work, to carry it out. The lawful basis is legitimate interests to reply to enquiries, and contract once work starts. Nothing is sold, and nobody is put on a mailing list. Enquiries are kept for 12 months. You can ask to see, correct or delete what we hold.
Who is responsible for your information
The controller is Luminacious Ltd. Industrial™ is a trading name of Luminacious Ltd; whichever name you write to, Luminacious Ltd is responsible for your information.
- Company number: 10612406, registered in England and Wales
- Registered office: C/O Rus & Co, 1192 Stratford Road, Hall Green, Birmingham, B28 8AB
- VAT number: GB263968557
- Privacy contact: privacy@industrial.org.uk
Privacy requests are handled by Sam Naseem, founder.
What we collect
- If you use the contact form, or the stepped version of it behind "Arrange a first conversation"
- your answers to its four questions (what is prompting the change, which systems are involved, what would be most useful first, and whether a date is driving it), your name, your company, your work email address, your phone number and anything you add in the notes box if you fill those in, how you would like us to reply — in writing or by phone — and the time it was sent. The stepped version keeps your answers in the browser tab you are using, and only while it is open: nothing is written to a cookie or to storage on your device, and nothing reaches us until you press send. The service that receives the form, Amazon Web Services (API Gateway, Lambda and Simple Email Service), run by Luminacious Ltd, writes one log line per message: whether it was delivered and a short reference, which is also the reference at the foot of the email we receive. That line does not include your name, company, email address, phone number, answers or IP address, and it is deleted after 30 days.
- If you email
- your email address and name, what you write, any attachments, and the details in your email signature.
- If a conversation or work follows
- notes of what was discussed, proposals, the statement of work, and invoicing details.
- If you become a client
- the statement of work, the name and email of the person who approves invoices, the company's billing address, any purchase-order number you give, and a record of what was invoiced and paid. We do not hold your card or bank details.
- What not to send with an enquiry
- passwords, special category data (for example, health information), or personal data about your customers or staff. If any arrives unasked, we delete what we do not need.
- When you visit the site
- no cookies and no analytics. We keep no server logs: logging on our hosting is switched off. Our hosting provider processes IP addresses only to deliver the site to you and protect it.
Why we use it, and the lawful basis
| What it is used for | Lawful basis |
|---|---|
| Reading and replying to your enquiry | Lawful basisLegitimate interests: replying to people who have written to the business |
| Keeping a record of the conversation, in case you write again | Lawful basisLegitimate interests |
| Preparing a proposal, and carrying out work you ask for | Lawful basisContract, including steps you ask for before a contract |
| Statements of work, invoices and payment records | Lawful basisContract; legal obligation for accounting records |
| Telling a client about relevant new solutions from Luminacious Ltd or AI UVD Ltd | Lawful basisOnly where the client contact agreed to the line in the statement of work naming both companies. It can be withdrawn at any time, and a withdrawal is honoured by both companies the same day. |
| Any other marketing | Lawful basisNot used. If that ever changes, we will ask you first. |
Where the basis is legitimate interests, you have the right to object (see "Your rights").
Automated decisions. No decision about you is made by automated means.
Work on your systems and data
When we carry out work for a client, material from that work (documents, data samples, interview notes, exports) is kept on our systems on AWS in London. It goes only to AI services we use in delivery that have a data processing agreement and do not train on customer data by default: OpenAI (ChatGPT Business), which processes data in the United States under a data processing agreement and does not train on it by default. Working material is deleted or returned within 30 days of the engagement ending. Records of the work (the statement of work, invoices, correspondence) are kept six years.
Hosted services. Where Industrial™ runs a hosted service that processes a client's personal data, it does so as the client's processor, under the data processing agreement signed with the statement of work. This notice does not cover that data; the client's own privacy notice does.
Who sees it and where it is stored
- Sam Naseem, who reads enquiries and replies to them.
- Our credit controller, employed by Luminacious Ltd, who handles invoicing and payments and sees the invoicing details listed above.
- Trusted engineers or subcontractors brought in for specific client work, named in the statement of work, only where that work needs it.
- AI UVD Ltd, the associated applied-AI practice, only where you have agreed to the consent line naming both companies, or where you ask for AI work to be introduced.
- Service providers that store or carry information on our behalf, under contracts that limit what they may do with it:
- Form handling: Amazon Web Services (API Gateway, Lambda and Simple Email Service), run by Luminacious Ltd, London (eu-west-2)
- Email: Google Workspace
- Website hosting: Amazon Web Services: Amazon S3 in the London region (eu-west-2), delivered through Amazon CloudFront
- Working material: Amazon Web Services, London region
- Invoices and accounting records: Zoho Invoice, which stores data in Zoho's EU data centres in the Netherlands and Ireland, and our accountants, who see invoices, including client names, to prepare the accounts
- Outside the UK: OpenAI processes data in the United States under Standard Contractual Clauses with the ICO's UK Addendum. Google Workspace may store and process email outside the UK, including in the United States, under Google's data processing terms, which use Standard Contractual Clauses or another recognised transfer mechanism. Zoho stores invoicing data in the Netherlands and Ireland, which the UK recognises as adequate.
- Nobody else. Your details are not sold, rented or shared for anyone's marketing. They are disclosed only if the law requires it.
How long it is kept
- Enquiries that do not lead to work: 12 months after the last contact, then deleted.
- Working material from client work: deleted or returned within 30 days of the engagement ending.
- Records of work carried out: six years.
- Contracts, invoices, payment and accounting records: as long as company and tax law require.
Your rights
Under UK data protection law you can ask us to:
- tell you what we hold about you and give you a copy (access)
- correct anything that is wrong (rectification)
- delete it, where there is no longer a good reason to keep it (erasure)
- limit how it is used while a question is being resolved (restriction)
- stop using it where the basis is legitimate interests (objection)
- give it to you in a portable format, where the basis is contract (portability)
To ask, email privacy@industrial.org.uk. There is normally no charge. We may need to confirm who you are. We reply within one month. If a request is complex, or one of several, that can be extended by up to two further months, and we will tell you why within the first month.
Complaints
If you are unhappy with how we have handled your information, tell us first, at privacy@industrial.org.uk or any other way you prefer. We acknowledge a complaint within 30 days, look into it without undue delay, keep you informed, and tell you the outcome.
You can also complain to the Information Commissioner's Office (ICO), the UK regulator for data protection: https://ico.org.uk/make-a-complaint/
Cookies
The site sets no cookies and uses no analytics. If that changes, this section will say which tool is used, what it stores and how to refuse it, before it goes live.
Changes to this notice
Last updated: 20 September 2026. If the way we use personal information changes, this page changes first.
Frequently asked questions
Will you add me to a mailing list?
No. Writing to us does not put you on any list.
Do you share my details with AI UVD?
Only if you are a client contact who agreed to the line in the statement of work naming both companies, or if you ask us to introduce AI work. A consent given to one company does not cover the other.
Can I ask you to delete my enquiry?
Yes. Email us and ask. We will delete it and confirm in writing, unless the law requires part of it to be kept, such as an invoice. In that case the reply says what is kept and why.
Questions about this notice: write through /contact/ or email privacy@industrial.org.uk.
Every engagement is architected by me, and I'm the person you deal with.
We take on a small number of clients at a time.