LMG NEXUS← Back to LMG NexusPrivacy Policy
1Who we are
This policy explains how LMG Nexus (we, us) handles personal information in connection with the Website at lmgnexus.co.uk and its sub-sites. For UK data protection law, we are the controller of any personal data described here.
Operator: LMG Nexus Ltd, [PLACEHOLDER ADDRESS: 1 Example Street, Sampletown, SA1 1AA, United Kingdom. Company number and registered office to be inserted before publishing]
Contact for all privacy matters: info@lmgnexus.co.uk.
2The law we follow
We handle personal data in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and, for cookies and similar technologies, the Privacy and Electronic Communications Regulations 2003 (PECR), each as amended.
3What we collect, and why
| Situation | What is involved | Why, and our lawful basis |
|---|---|---|
| Browsing the public pages | No account, no form, no analytics and no advertising trackers. Your device’s IP address and basic request details (such as browser type and time of request) are handled automatically by our hosting provider when pages are delivered. | To deliver the site and keep it secure and working. Legitimate interests (Article 6(1)(f) UK GDPR). We do not use this to identify you. |
| Contacting us | The “Get in touch” form sends your message to us by email through our email provider. We receive your name, email address, the brand you are asking about and your message, and you receive an automatic acknowledgement. | To read and reply to your message. Legitimate interests (Article 6(1)(f)), or steps you ask us to take before a contract (Article 6(1)(b)). |
| Administrator sign-in | Used by the site owner only. It holds the owner’s own email address and sign-in session. | To keep private areas secure. This concerns the owner’s own data and is necessary for operating the site. |
| Private photo albums (LMG Photography) | A private gallery for family and friends, opened by private links. Viewers are not asked for personal details. Photos and videos may show people. A passcode, if used, is checked but not stored in readable form. | Personal sharing among family and friends. Where this is purely personal or household activity, data protection law may not apply to it; where it does, our basis is legitimate interests (Article 6(1)(f)). |
| Deletion record | When an account is deleted: an anonymous account number and the date (no name or email). If the account had been blocked first, also a one-way scrambled code of the email address that cannot be turned back into the email. | To make sure deleted data is not restored from a backup, and to stop a blocked person signing up again. Legitimate interests (Article 6(1)(f)). |
| Client account | Your email address, a password (stored only as a secure one-way hash, so we cannot read it), your account status, the products in your package, the time you accepted our Terms and which version, and your sign-in session. | To provide your account and the products in your package. Contract (Article 6(1)(b)). Security and fraud prevention: legitimate interests (Article 6(1)(f)). |
| Waiting list | Your email address, and your name and a short note if you choose to give them, plus the time you joined. | To contact you if a place becomes available, at your request. Steps you ask us to take before a contract (Article 6(1)(b)). |
| Shop orders (currently testing) | Your name, email address, the items and options you chose, the total, and the order status. If you are signed in, the order is linked to your account. During testing no payment details are taken. | To process and keep a record of your order. Contract (Article 6(1)(b)) and, for real orders, legal obligations such as accounting (Article 6(1)(c)). |
We do not knowingly collect special category data (such as health, religion or ethnicity), and we do not carry out automated decision-making or profiling that has legal or similarly significant effects on you.
4Who we share data with
We do not sell your personal data and we do not share it for marketing. We use a small number of service providers who process data on our behalf:
- Cloudflare, Inc.: hosting, content delivery, security and file storage for the Website (including private photo storage).
- Supabase, Inc.: secure sign-in and databases. The owner’s private areas use one database, and client accounts, the waiting list and shop orders use a separate one, hosted in Ireland (EU).
- Resend: sends emails from the Website, such as your contact-form acknowledgement, account emails and waiting-list invitations.
- jsDelivr (CDN): delivers a software library used on the sign-in pages; your IP address is visible to it when that page loads.
- Google (Google Fonts): the LMG Photography site loads its typefaces from Google, so your IP address is sent to Google when that site loads.
- Your email provider and ours: if you email us, the message passes through email services in the normal way.
We may also disclose information if the law requires it, or to protect our rights, security or property.
5Transfers outside the UK
Some of these providers are based in, or use servers in, the United States and other countries. Where personal data is transferred outside the UK, we rely on an appropriate safeguard under UK data protection law, such as the UK adequacy regulations (including the UK–US data bridge, where the provider is certified), or the UK International Data Transfer Agreement or Addendum, which our providers make available in their terms.
6How long we keep it
Emails and messages are kept only as long as needed to deal with your enquiry and any follow-up, normally no more than 12 months afterwards, unless we need to keep them longer to meet a legal obligation or to deal with a claim. Technical logs held by our hosting provider are kept for the periods set by that provider. Client accounts are kept while the account is open. If you ask us to delete your account, we delete it and its data from our live systems; copies in backups are removed on a rolling basis [period to be confirmed once backups are set up]. Waiting-list entries are kept until a place is offered, you ask us to remove you, or 12 months pass. Test orders may be deleted at any time; records of real orders are kept for as long as the law requires for accounting [confirm with an accountant, commonly 6 years].
7Security
We use secure (HTTPS) connections, access controls and reputable providers to protect the Website and the private areas. No system is completely secure, so we cannot guarantee absolute security. If a personal data breach occurs that is likely to put people at risk, we will report it to the Information Commissioner’s Office and to those affected, as the law requires.
8Your rights
Under UK data protection law you have the right to:
- be informed about how your data is used (this policy);
- access a copy of the personal data we hold about you;
- have inaccurate data corrected;
- have your data erased in certain circumstances;
- restrict our use of your data in certain circumstances;
- object to our use of your data where we rely on legitimate interests;
- receive your data in a portable format where it applies; and
- withdraw consent at any time, where we rely on consent (we currently do not).
To use any of these rights, email info@lmgnexus.co.uk. We may need to confirm your identity first, and we will normally reply within one month. There is no fee unless a request is manifestly unfounded or excessive.
9Complaints
We would like the chance to put things right first, so please contact us at info@lmgnexus.co.uk. You also have the right to complain to the UK supervisory authority, the Information Commissioner’s Office (ICO): ico.org.uk/make-a-complaint, telephone 0303 123 1113.
10Children
The Website is not directed at children and we do not knowingly collect personal data from anyone under 13. If you think a child has sent us personal data, please contact us and we will delete it.
11Cookies
Our use of cookies and similar technologies is explained in our Cookie Policy.
12Changes to this policy
We may update this policy from time to time, for example if we start to collect additional data or add new features. The current version is always on this page with its date. If a change is significant we will make that clear on the Website.