Last Updated: September 2026
‍

Foundry 3 Ltd ("Foundry3", "we", "us", or "our") is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you visit our website at www.foundry3.agency (the "Website"), contact us, or engage with our services.

Foundry 3 Ltd is the data controller responsible for your personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Information We Collect

We may collect and process the following categories of personal data about you:
‍

1. Information You Provide Directly

   • Identity and Contact Data: Name, job title, company/organisation name, email address, telephone number, and postal address when you submit an inquiry form, request information, or contact us directly via email or phone.
   • Communications Data: Any comments, inquiries, feedback, or materials you send us via email, web forms, or social channels.
   • Recruitment Data: If you submit an application, CV, or inquiry regarding careers at Foundry3, we collect your employment history, educational background, qualifications, and related recruitment details.

2. Information Collected Automatically

   • Technical Data: Internet Protocol (IP) address, browser type and version, time zone setting and approximate location, operating system and platform, browser plug-in types, and device identifiers.
   • Usage Data: Information about how you interact with our Website, including page interaction information, referral sources, length of visits to certain pages, navigation paths, and download errors.

3. Cookies and Tracking Technologies

   We use essential and analytics cookies to maintain website functionality, ensure security, and understand how visitors interact with our content.
   

2. How and Why We Use Your Personal Data (Lawful Bases)

Under the UK GDPR, we must have a valid lawful basis to process your personal data. The table below outlines how we use your data and our lawful basis for doing so:

3. How We Share Your Personal Data

We do not sell, rent, or trade your personal data. We may share your information with trusted third-party service providers only to the extent necessary for our operations, including:

• IT and Infrastructure Providers: Cloud hosting, website management, cybersecurity, and email service providers.
• Analytics Providers: Services assisting us in understanding website traffic and engagement (subject to your cookie choices).
• Professional Advisers: Legal, accounting, compliance, and insurance advisers based in the UK.
• Legal and Regulatory Authorities: Law enforcement agencies, regulators, or courts where required by law or to protect rights, property, or safety.

All third-party service providers are bound by strict contractual data processing terms and are prohibited from using your personal data for their own independent purposes.

4. International Data Transfers

When we share data with third-party service providers located outside the United Kingdom (UK) or European Economic Area (EEA), we ensure appropriate safeguards are implemented in accordance with UK data protection laws, such as:

• Transferring to countries recognized by the UK government as providing an adequate level of data protection; or
• Putting in place approved UK International Data Transfer Agreements (IDTAs) or the UK Addendum to the EU Standard Contractual Clauses (SCCs), alongside supplementary technical and organizational security measures where necessary.

You may contact us if you would like further details regarding the safeguards applied to international transfers.

5. Data Security

We implement technical and organizational security measures to protect your personal data against accidental loss, unauthorized access, alteration, or disclosure. These measures include encrypted communications (HTTPS/TLS), restricted access controls, firewalls, and regular security reviews. Access to your personal data is restricted to employees, contractors, and partners who require it on a strict need-to-know basis.

6. Data Retention

We will retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, including satisfying any legal, accounting, reporting, or regulatory requirements.

To determine the appropriate retention period, we consider:

• The volume, nature, and sensitivity of the personal data;
• The potential risk of harm from unauthorized use or disclosure;
• The purposes for which we process your data and whether we can achieve those purposes through other means; and
• Applicable statutory limitation periods and legal retention obligations.

In general:

• General inquiries: Retained for up to 2 years from our last interaction, unless an ongoing business relationship develops.
• Client communications and contract records: Retained for 6 to 7 years following completion of the project or contract for tax, corporate, and legal compliance.
• Website analytical logs: Retained in an aggregated, anonymized, or pseudonymized format for up to 12 months.
• Job applicant records: Retained for up to 6 months following recruitment decisions, unless explicit consent is provided to keep your CV on file for future opportunities.

7. Your Legal Rights (UK GDPR)

Under the UK General Data Protection Regulation, you have the following rights regarding your personal information:

• Right of Access: You have the right to request a copy of the personal data we hold about you (commonly known as a "Subject Access Request").
• Right to Rectification: You have the right to ask us to correct incomplete or inaccurate personal data we hold about you.
• Right to Erasure: You have the right to ask us to delete your personal data where there is no lawful reason for us continuing to process it (the "right to be forgotten").
• Right to Object: You have the right to object to the processing of your personal data where we rely on legitimate interests, including an absolute right to object to direct marketing.
• Right to Restriction: You have the right to ask us to suspend the processing of your personal data under certain conditions (e.g., while its accuracy is verified).
• Right to Data Portability: You have the right to receive your personal data in a structured, commonly used, machine-readable format and transfer it to another controller.
• Right to Withdraw Consent: Where our processing relies on your consent, you have the right to withdraw that consent at any time.

How to Exercise Your Rights

If you wish to exercise any of these rights, please contact our Data Privacy Lead at matt@foundry3.agency or using the postal details provided below. We do not charge a fee for standard requests and will respond within one calendar month, as required by law.

8. Third-Party Links

Our Website may contain links to external third-party websites, plug-ins, and social media platforms. Clicking on those links may allow third parties to collect or share data about you. We do not control these external sites and are not responsible for their privacy statements. We encourage you to read the privacy notices of every website you visit.

9. Right to Complain to the Supervisory Authority

If you have concerns about how we handle your personal data, we encourage you to contact us first so we can resolve the issue promptly.However, you have the statutory right to lodge a complaint at any time with the UK’s supervisory authority for data protection:Information Commissioner’s Office (ICO)

Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Helpline: 0303 123 1113

Website: ico.org.uk

10. Contact Us

If you have any questions about this Privacy Policy, our data handling practices, or how to exercise your privacy rights, please contact us:

• Company Name: Foundry 3 Ltd
• Attention: Data Privacy / Data Protection Lead
• Email: privacy@foundry3.agency
• Website: www.foundry3.agency
• Registered Address: 54 Vale Road, Windsor, England. SL4 5LA
• Company Registration Number: 11194584