Who we are
Milaco Engineering Ltd ("we", "us", "our") is the data controller for this website. We are registered in England & Wales, Company No. 12101869, and with the Information Commissioner's Office (ICO) as a data controller, registration number ZC234722. Registered office: Unit 1 Barons Court, Graceways, Blackpool, FY4 5GP.
Contact: info@milaco.co.uk or 0800 368 9329.
Privacy contact: for any question about this policy or about your personal data, email david@milaco.co.uk.
What this policy covers
This policy covers personal data collected through milaco.co.uk — mainly the contact form and website analytics. It does not cover data we hold about existing clients under a separate service contract.
Information we collect, and why
When you submit the contact form
We collect:
- Name (required), email address (required), phone number (optional), company name (optional), enquiry type (a fixed list you choose from), and your message.
- Your acknowledgement that you have read this Privacy Policy, and which version of it you accepted.
- Technical and anti-abuse data recorded automatically: the time of submission, a one-way (non-reversible) hash of your IP address — we do not store your raw IP address — your browser's user agent string, the page that referred you, and any approved marketing campaign (UTM) parameters present in your visit.
- Internal handling data: which member of staff the enquiry is assigned to, its status (new, in progress, resolved, or spam), and any internal notes added while we handle it.
We use this to respond to your enquiry, manage it through to resolution, and to detect and block spam or abusive submissions (using automated checks such as a hidden honeypot field, a minimum completion-time check, rate limiting, and duplicate-submission detection). Submissions that fail these checks are not stored and no email is sent.
When you browse the website
Only after you give analytics consent, we collect aggregate usage data as described in our Cookie Policy.
Our lawful basis for processing
- Legitimate interests — responding to and managing your enquiry, and protecting the contact form from spam and abuse.
- Contract, or steps prior to a contract — where your enquiry leads to a quotation or an engagement with us.
- Consent — for website analytics (Umami), which does not run at all until you actively consent, and stops immediately if you withdraw consent. You withdraw it on the site itself, using the Analytics choice control on our Cookie Policy page; every page links to it from the footer.
How long we keep enquiry data
Retention follows a fixed lifecycle and is not decided case by case:
- New or in-progress enquiries have no deletion date — they are kept for as long as we are actively working on them.
- Resolved enquiries are deleted 12 calendar months after being marked resolved.
- Enquiries marked as spam are deleted 30 days after being marked spam.
- Any genuine change of status resets or clears the applicable countdown, so re-opening a resolved enquiry stops its 12-month clock.
Once an enquiry is deleted, we keep a minimal audit record of the deletion itself — the enquiry's reference ID, which retention rule applied, its final status, and the scheduled and actual deletion times. This audit record never includes your message or our internal notes.
Who we share your data with
We do not sell personal data. We share it only with the service providers who help us run the website and respond to you.
- Resend sends the email notifications and replies generated by the contact form.
- Umami (self-hosted, separately operated analytics) only runs after you give analytics consent; see the Cookie Policy for what it records. It uses its own dedicated database, kept separate from the website's own data, with staging and production data isolated from each other.
- Our hosting provider runs the website application and its PostgreSQL database on infrastructure managed through our Dokploy hosting platform.
- Garage object storage stores and serves the marketing images shown on the website. This storage is deliberately public: anyone with a specific image's web address can view that file, even if the surrounding page is a draft. Because of this, we do not upload personal, confidential or embargoed images to it — only approved marketing imagery.
We do not use your data for advertising, profiling, or automated decision-making.
Your rights
Under UK GDPR you have the right to access the personal data we hold about you, have inaccurate data corrected, request deletion, object to or restrict our processing, request a portable copy of your data, and withdraw consent at any time — which does not affect processing already carried out. Analytics consent is withdrawn on the site itself, through the Analytics choice control described above; for anything else, email our privacy contact. To exercise any of these rights, email david@milaco.co.uk.
Complaints
If you are unhappy with how we have handled your data, we would like the chance to put it right — please contact our privacy contact, david@milaco.co.uk, first. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk, or on 0303 123 1113.
Changes to this policy
We may update this policy from time to time. The current version and its date will always be shown on this page.
Contact us
Milaco Engineering Ltd, Unit 1 Barons Court, Graceways, Blackpool, FY4 5GP. Email info@milaco.co.uk. Phone 0800 368 9329. Privacy enquiries: david@milaco.co.uk. ICO registration number ZC234722.