Catalyst Bridge
Privacy Policy
This policy explains how Catalyst Bridge Ltd collects, uses, and protects personal data when you visit our website, contact us, or work with us as a client. We're committed to handling your data lawfully, fairly, and transparently under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Who We Are
Catalyst Bridge Ltd is registered in England and Wales (Companies House #16684771) with its registered office in Kinmel Bay, North Wales, United Kingdom. We are the data controller for the personal data described in this policy.
Contact: [email protected]
2. Information We Collect
When you visit our website
- IP address, browser type, device type, and pages visited (server logs)
- Referrer information (which site sent you here)
- Aggregated, anonymised analytics via Plausible (no cookies, no cross-site tracking)
- With your consent only: usage analytics and session replays via PostHog, showing how pages are scrolled and clicked. Anything you type into forms is masked in replays.
When you contact us or book a call
- Name, email address, phone number, business name
- The information you choose to share about your business and goals
- Calendar booking details (if you book through our scheduling tool)
When you become a client
- Contract details, billing address, billing contact
- Operational data needed to deliver the systems we build for you (for example, business contact lists, FAQ content, brand assets)
- Payment data is handled by Stripe. We never see or store your card numbers.
When we contact you for outreach
- Public business contact details (business name, public email, address, website)
- Notes on whether our services may be relevant to your business
3. How We Use Your Data
We process your data for the following purposes, each with a lawful basis under UK GDPR Article 6:
| Purpose | Lawful basis |
|---|---|
| Reply to enquiries and run discovery calls | Pre-contract steps (Article 6(1)(b)) |
| Deliver services to clients | Contract (Article 6(1)(b)) |
| Send invoices and operational communications | Contract (Article 6(1)(b)) |
| B2B outreach to businesses we believe could benefit | Legitimate interest (Article 6(1)(f)) |
| Improve our website, services, and security | Legitimate interest (Article 6(1)(f)) |
| Comply with tax, accounting, and legal obligations | Legal obligation (Article 6(1)(c)) |
| Send marketing emails to subscribers | Consent (Article 6(1)(a)) |
| Optional usage analytics and session replay (PostHog) | Consent (Article 6(1)(a)) |
We do not sell your personal data, share it with advertisers, or use it for automated decision-making that produces legal effects.
4. Who We Share Data With
To deliver our services we use the following sub-processors. Each is bound by appropriate data processing terms.
| Sub-processor | Purpose | Location |
|---|---|---|
| Anthropic | AI processing (Claude API) | USA |
| Google Workspace | Email, document storage | USA / EU |
| DigitalOcean | Server infrastructure | UK |
| Cloudflare | DNS, CDN, security | Global |
| ElevenLabs | Voice AI generation (where used) | USA |
| Stripe | Payment processing | UK / USA |
| Plausible Analytics | Privacy-first website analytics | EU |
| PostHog | Usage analytics and session replay (only with your consent) | EU (Frankfurt) |
Where data is transferred outside the UK or EEA, we rely on Standard Contractual Clauses, UK International Data Transfer Agreements, or adequacy decisions to safeguard your data.
We may also disclose your data when required by law (court order, valid regulator request, fraud prevention).
5. How Long We Keep Data
- Website server logs: 90 days
- Prospect data (no engagement): 12 months, then deleted
- Client data: Duration of contract plus 6 years (UK tax law requirement)
- Marketing list subscribers: Until you unsubscribe
- Backups: Up to 30 days after deletion of the underlying data
6. Your Rights Under UK GDPR
You have the right to:
- Access the personal data we hold about you
- Correct inaccurate or incomplete data
- Delete your data ("right to be forgotten") where applicable
- Restrict or object to certain types of processing
- Receive your data in a portable format
- Withdraw consent at any time, where consent is the basis
To exercise any of these rights, email [email protected]. We'll respond within 30 days.
If you believe we are not handling your data properly, you have the right to complain to the UK Information Commissioner's Office: ico.org.uk, helpline 0303 123 1113.
7. Cookies
Our website uses minimal cookies:
- Essential cookies: Needed for security and basic site functionality, including one first-party cookie that remembers your cookie choice.
- Plausible Analytics: Cookieless. Counts visits without tracking individuals across sites.
- PostHog (optional): Sets cookies and browser storage only after you choose "Accept all" on the cookie banner. You can change your choice any time on the cookies page.
We do not use advertising cookies, third-party trackers, or social media pixels. If you book a call through our embedded scheduling tool, that tool may set cookies needed to handle the booking.
8. Security
We protect your data with:
- Encryption in transit (HTTPS / TLS 1.3) on all services
- Encryption at rest where the underlying platform supports it
- Access controls and least-privilege principles for staff and systems
- Two-factor authentication on administrative accounts
- Regular backups, log monitoring, and intrusion detection
- A documented incident response process
9. Children
Our services are aimed at businesses, not children. We do not knowingly collect personal data from anyone under 16. If you believe we hold data about a child, contact us and we'll delete it.
10. Changes to This Policy
We update this policy as our services and the law evolve. The "Last updated" date at the top reflects the most recent revision. Material changes affecting active clients will be communicated by email.
11. Contact
Catalyst Bridge Ltd
Kinmel Bay, North Wales, United Kingdom
Companies House #16684771
[email protected]