Privacy Policy

1Who is responsible for your data

Astral Turbines is the data controller for personal data collected through this website. We are a digital and technology services company founded in 2024, operating remotely across multiple countries.

You can reach us about anything in this policy at info@astralturbines.com. We aim to respond within 30 days, which is the maximum period allowed under the GDPR for most requests.

We have not appointed a Data Protection Officer, as we are not required to under Article 37. Privacy enquiries go to the address above and are handled by a member of the leadership team.

2What we collect, why, and on what legal basis

We only collect what we need. Each category below states the purpose and the lawful basis we rely on under Article 6.

• Enquiry details (name, email, company, budget, services of interest, message) — to respond to your enquiry and, if it progresses, to scope the work. Legal basis: legitimate interests in responding to business enquiries directed at us, and steps taken at your request prior to entering a contract.
• Newsletter email address — to send the newsletter you asked for. Legal basis: consent, withdrawable at any time.
• Anti-abuse data (IP address, submission timing, rate-limit counters) — to prevent spam and automated abuse of our contact form. Legal basis: legitimate interests in protecting our systems.
• Analytics data (pages viewed, approximate location, device and browser type) — to understand which content is useful. Legal basis: consent, collected only if you accept analytics cookies.
• Cookie preferences — stored locally in your browser so we do not ask repeatedly. Legal basis: legitimate interests, and necessity for a service you requested.
• Client project data, where an engagement follows — to deliver the contracted services. Legal basis: performance of a contract.

3Our legitimate interests, and your right to object

Where we rely on legitimate interests, we have weighed our interest against your rights and freedoms. In each case the processing is limited, expected in a business context, and low risk: replying to someone who contacted us, and stopping bots from flooding that same form.

You can object to processing based on legitimate interests at any time by emailing us. We will stop unless we can demonstrate compelling grounds that override your interests.

4Who receives your data

We do not sell personal data, and we do not share it with advertisers or data brokers. We disclose it only to the following categories of recipient, each acting as a processor under a written agreement:

• Our hosting and email provider, which stores this website and delivers enquiry notifications to our mailbox
• Analytics providers, only where you have accepted analytics cookies
• Professional advisers (accountants, lawyers, insurers) where strictly necessary
• Public authorities, where we are legally required to disclose

5International transfers

Our team and some of our processors operate outside the European Economic Area and the United Kingdom. Where personal data is transferred outside those areas, we rely on the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, or an adequacy decision covering the destination country.

You can request a copy of the safeguards applying to a specific transfer by writing to info@astralturbines.com.

6How long we keep it

We do not keep personal data longer than we need it.

• Enquiries that do not become projects: up to 24 months from your last contact with us, then deleted
• Enquiries stored in our admin inbox: automatically capped, with the oldest records removed once the limit is reached
• Client project records: for the duration of the engagement plus the period required by contract and applicable tax law, typically six to seven years
• Newsletter subscriptions: until you unsubscribe
• Anti-abuse counters: minutes to hours, then discarded
• Server access logs: as retained by our hosting provider, typically a matter of months

7Cookies and similar technologies

Strictly necessary cookies keep the site working and remember your consent choice. These do not require consent.

Analytics cookies are only set after you accept them in the banner. Declining does not restrict any part of the site, and you can change your mind by clearing your browser storage for this site.

We do not use advertising, retargeting or cross-site tracking cookies.

8Your rights

If the UK GDPR or EU GDPR applies to you, you have the following rights. Exercising them is free, and we will not treat you differently for doing so.

• Access — obtain a copy of the personal data we hold about you
• Rectification — have inaccurate or incomplete data corrected
• Erasure — have your data deleted where there is no overriding reason to keep it
• Restriction — have us pause processing while a dispute is resolved
• Portability — receive data you gave us in a structured, machine-readable format
• Objection — object to processing based on legitimate interests, and to direct marketing at any time
• Withdraw consent — where we rely on consent, withdraw it without affecting prior processing
• Complain — lodge a complaint with your supervisory authority. In the UK that is the Information Commissioner’s Office (ico.org.uk); in the EU it is the authority in your country of residence

9California residents

Under the CCPA as amended by the CPRA, California residents have the right to know what personal information is collected and for what purpose, to request deletion or correction, and to opt out of sale or sharing.

We do not sell or share personal information as those terms are defined by the CCPA, and we do not use it for cross-context behavioural advertising. We do not knowingly collect personal information from anyone under 16. We will not discriminate against you for exercising any of these rights.

10Automated decision-making

We do not make decisions producing legal or similarly significant effects about you by automated means. Our contact form applies automated anti-spam checks that may reject a submission; if yours does not reach us, email us directly and a person will read it.

11Security

We apply encryption in transit (HTTPS across the whole site), access controls with least-privilege defaults, rate limiting and abuse detection on public forms, and separation of credentials from application code.

No system is perfectly secure. If a breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and, where the risk is high, notify you directly.

12Children

This site is aimed at businesses and is not directed at children. We do not knowingly collect data from anyone under 16. If you believe a child has provided us with personal data, contact us and we will delete it.

13Changes to this policy

We may update this policy as our services or obligations change. The date at the top always reflects the current version. Where a change materially affects how we use your data, we will make that clear on this page before it takes effect.

14How to contact us or complain

Email info@astralturbines.com for any request under this policy. Please tell us which right you are exercising so we can respond quickly. We may ask you to verify your identity before releasing personal data.

If you are unhappy with our response, you can complain to your data protection supervisory authority at any time. You do not need our permission to do so.