Skip to content

PRIVACY

Privacy policy

Last updated 11 August 2026.

This policy covers this website — the contact form on it, and the analytics that count visits. It is short because the site does two things: it states who the company is, and it lets you send us a message.

Who is responsible

M7KNI Ltd is the data controller. We are registered in England and Wales, company number 17385187, at Unit 13 Freeland Park, Wareham Road, Lytchett Matravers, Poole, England, BH16 6FA.

The contact form is the only route in. We do not publish a mailbox anywhere on this site, deliberately — a published address collects spam faster than it collects questions. We are not required to appoint a Data Protection Officer and have not appointed one; the form reaches the people who would answer to one.

What the contact form does

The form takes your name, your email address and your message. All three are required, because a message we cannot reply to is not much use to either of us.

Attached to the message, we also record the country you sent it from and the time you sent it, so that if the form is ever used for abuse we can see roughly where it came from.

We do not keep your IP address. Cloudflare's bot check sees it while deciding whether the request is automated, and it is then discarded rather than written into the email.

Nothing is stored on this website. There is no database here. Where your message goes:

  1. It is posted to a Cloudflare Worker, which checks the bot test and composes the email.
  2. It is sent by Cloudflare Email Sending, from an address on our send.m7kni.com subdomain. Your own address goes in the Reply-To header and never in From, so the message passes SPF and DKIM while replying still reaches you.
  3. It is delivered to the company mailbox, which is hosted by Microsoft, and lives there.

So the full text of your message passes through Cloudflare's infrastructure before Microsoft stores it. Both act as our processors, and neither is the destination on their own.

The lawful basis is our legitimate interest under Article 6(1)(f) of the UK GDPR in answering people who contact us about our services, and in keeping the form from being abused. You chose to write to us, and the only thing we do with the message is reply to it.

A Turnstile bot check sits on the form. It looks at your IP address and browser signals to decide whether a request is automated, so a public form cannot be used to send mail through us. It is Cloudflare's, and it runs whether or not you agree to analytics, because without it the form would not work at all.

Analytics and cookies

This site uses Google Analytics 4 to count visits and see which pages get read. It is loaded through Cloudflare Zaraz, and it does not run until you have agreed to it. The first time you arrive you are asked; if you decline, the tag is never loaded, and every part of the site works exactly the same.

What is stored in your browser, and why:

  • Your consent choice, in a cookie named cf_consent. This one is set whatever you choose, because refusing analytics is itself a decision we have to remember — without it you would be asked again on every page.
  • An analytics identifier, but only if you agreed. It is a random value that lets Google count two visits by you as one visitor rather than two.
  • A Turnstile token, briefly, while the bot check on the form runs.
  • A Cloudflare cookie that distinguishes real visitors from automated traffic. This is part of serving the site securely and is set regardless of your analytics choice.

If you agree to analytics, this is what is sent to Google about the visit:

  • Which page you are on — the full address, including any campaign tags — and the page you arrived from, including when that is somebody else's site.
  • Your device and browser, in broad terms — whether you are on a phone or a computer, which browser and operating system, your screen and window size, the language your browser asks for, and your time zone. The identifying detail is deliberately stripped on the way out: no device make or model, no exact browser or operating-system version, and no list of what is installed.
  • Roughly where you are, worked out from your IP address. The address is trimmed before it reaches Google, so this is a general area rather than your connection.
  • The random visitor ID above, so two visits by you count as one visitor.

None of Google's advertising features are switched on. Google Signals, remarketing and ads personalisation are all off on the analytics property, so a visit here is never associated with your Google account and is never used to build an advertising profile of you. There are no advertising cookies and no tracking pixels. The fonts are served from this site rather than a font provider, so loading a page does not tell anyone else that you visited.

Who else handles it

Cloudflare hosts the page, runs the Worker your message is posted to, provides the Turnstile bot check, and transmits the resulting email. It acts as our processor, and it handles the full text of your message in passing rather than merely routing an envelope.

Microsoft hosts the company mailbox the message is delivered to, and acts as our processor for it. That is where the message comes to rest.

Google receives website analytics data, and only if you agreed to it. Google is a separate controller for that data and handles it under its own terms.

All three are bound by contract to protect your data to at least the standard set out in this policy and required by UK data protection law. Nobody else has access. We do not sell, share or rent personal data, and we do not use your message to add you to any list.

Where it goes

Analytics data, if you agreed to it, is transferred to Google in the United States. That transfer relies on the UK International Data Transfer Addendum to the European Commission's standard contractual clauses. Declining analytics means no transfer happens.

How long we keep it

  • Your message: as long as the conversation is useful, and then it is deleted with the rest of the mailbox's ordinary housekeeping. If a message becomes a business record — a quote, a contract, an invoice — it is kept for as long as company and tax law requires.
  • Analytics: Google keeps event data for 2 months and user-level data for 14 months, after which it is deleted.
  • Your consent choice: stored in your browser until you clear it or it expires.

Your rights

Over the personal data we hold about you, you have the right to:

  • be told what we hold and get a copy of it;
  • have it corrected if it is wrong;
  • have it deleted;
  • restrict or object to what we are doing with it — including objecting to our legitimate interest in holding your message;
  • receive it in a portable form, or have it sent to someone else.

For analytics, use the Manage cookies button above. For anything else, use the contact form — which does mean writing to us once more to be forgotten, and there is no way around that when the form is the only route in. We will respond within one month and we do not charge for it.

Decisions, and what you have to give us

We do not make automated decisions about you and we do not profile you. Nothing here is required by law or by a contract: writing to us is entirely optional, and so is agreeing to analytics. The only consequence of giving us nothing is that we cannot reply to you.

Changes to this policy

If we change what we do with personal data, we will update this page and move the date at the top.

Complaining

If you think we have handled your data badly, you can complain to the Information Commissioner's Office, the UK's data protection regulator. We would rather you told us first, but you do not have to.