Privacy Policy

1. Who We Are

EmberForge Ltd ("we", "us", "our") is the data controller for personal data processed through the EmberForge platform. We are registered in England and Wales (registration number EF-GB-291047-03) with our registered office at 115 Lyndhurst Ave, Twickenham TW2 6BU, United Kingdom.

This Privacy Policy explains how we collect, use, store, and protect any personal data relating to users of the EmberForge website, in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Data We Collect

Data you provide directly

EmberForge does not currently require user registration. You can use the platform without submitting any personal information. If you contact us (by phone or in writing), we may collect your name and contact details for the purpose of responding to your enquiry.

Data collected automatically

When you visit EmberForge, we may automatically collect the following technical data:

• IP address — for security, fraud prevention, and to comply with applicable laws.
• Browser type and version — to optimise platform performance.
• Device type and operating system — for compatibility purposes.
• Pages visited and time spent — for aggregate analytics purposes.
• Referring URL — to understand how users find us.
• Session identifiers — stored temporarily in cookies to maintain your Ember balance during your visit.

We do not collect payment card information, financial data, or any sensitive personal data as defined under UK GDPR.

3. How We Use Your Data

We use the data we collect for the following purposes:

• To deliver and maintain the EmberForge platform and all of its features.
• To maintain session state (including your Ember balance) during your visit.
• To monitor and improve platform performance and user experience.
• To detect, prevent, and address technical issues, abuse, or fraud.
• To comply with legal obligations applicable to EmberForge Ltd.
• To respond to enquiries submitted to us directly.

We do not use your data for automated decision-making or profiling that produces legal or similarly significant effects.

4. Legal Basis (UK GDPR)

We process personal data only where we have a lawful basis to do so. The legal bases we rely on are:

• Legitimate interests (Article 6(1)(f) UK GDPR) — for session management, security monitoring, analytics, and platform improvement, where these interests are not overridden by your rights.
• Legal obligation (Article 6(1)(c) UK GDPR) — where processing is necessary to comply with a legal requirement.
• Consent (Article 6(1)(a) UK GDPR) — for non-essential cookies, where your consent is obtained via our cookie banner.

5. Data Sharing

We do not sell, rent, or trade your personal data to any third parties. We may share limited data with:

• Hosting and infrastructure providers — who host our servers and are contractually bound to process data only on our instructions.
• Analytics providers — for aggregate, anonymised usage statistics only.
• Law enforcement or regulatory authorities — where required by applicable law or a court order.

All third-party processors are required to maintain appropriate technical and organisational security measures.

6. Data Retention

We retain personal data for no longer than is necessary to fulfil the purposes described in this policy:

• Session data (including Ember balance) is stored only for the duration of your browser session and is cleared on close.
• Server logs and technical access data are retained for up to 12 months for security purposes.
• Enquiry correspondence is retained for up to 24 months.

7. Your Rights Under UK GDPR

As a data subject under UK GDPR, you have the following rights:

• Right of access — to request a copy of personal data we hold about you.
• Right to rectification — to correct inaccurate or incomplete personal data.
• Right to erasure ("right to be forgotten") — to request deletion of your personal data where there is no legitimate reason for continued processing.
• Right to restrict processing — to request that we limit how we use your data in certain circumstances.
• Right to data portability — to receive your data in a structured, machine-readable format where technically feasible.
• Right to object — to object to processing based on legitimate interests.
• Rights related to automated decision-making — not to be subject to solely automated decisions that significantly affect you.

To exercise any of these rights, please contact us using the details in Section 12. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

8. Cookies

EmberForge uses cookies and similar tracking technologies. For full details of the cookies we use, please see our Cookie Policy. You can manage your cookie preferences at any time through your browser settings.

9. Children's Privacy

EmberForge is strictly intended for users aged 18 and over. We do not knowingly collect personal data from any person under the age of 18. If you believe that we have inadvertently collected data from a minor, please contact us immediately and we will take steps to delete such data.

10. International Transfers

Where personal data is transferred outside the United Kingdom, we ensure that adequate safeguards are in place in accordance with UK GDPR requirements, including the use of Standard Contractual Clauses (SCCs) or reliance on an adequacy decision by the UK Government.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will update the "last updated" date at the top of this page whenever changes are made. We encourage you to review this policy periodically. Continued use of EmberForge following any changes constitutes your acknowledgement of the updated policy.

12. Contact Us & Data Protection Officer

For any questions, requests, or complaints regarding this Privacy Policy or our data practices, please contact:

• EmberForge Ltd — Data Protection Enquiries
• 115 Lyndhurst Ave, Twickenham TW2 6BU, United Kingdom
• Phone: +44 71150095809