Privacy Policy
This notice explains how ECHO ALPHA LTD collects and uses personal data when you visit this website or contact us, and the rights you have under UK data protection law.
Last updated: 17 September 2026
1. Who we are
The controller of your personal data is ECHO ALPHA LTD, a private limited company registered in England and Wales under company number 11271098, with its registered office at C/O Quick Accountancy Waterlooville Ltd, London Road, Waterlooville, Hampshire, PO7 7DZ, United Kingdom.
For any question about this notice or your personal data, write to [email protected]. We have not appointed a Data Protection Officer because the law does not require one for our activities; privacy questions are handled directly by the company’s management.
2. What this notice covers
This notice applies to personal data processed through this website at echoalphaltd.online and through email correspondence with us about our services. It is written to meet the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR).
Each mobile app we publish has its own privacy information, available from its store listing. Where we build an app for a client, the client is normally the controller of data collected by that app and its own privacy notice applies.
3. Personal data we collect
Information you give us
When you send an enquiry through a form on this website we receive: your full name, your company name if you provide it, your email address, the type of project you select, your message, and the page the form was sent from. We also record the date and time of the enquiry.
If you email us directly, we receive your email address, name and whatever the message and any attachments contain. Please do not send special category data, such as health information, unless we have asked for it.
Information collected automatically
Like any web server, the server hosting this website records technical request data in access logs: IP address, date and time, the page requested, browser user agent and referring address. These logs are used for security and troubleshooting.
To protect our forms from automated abuse, the server keeps a one-way hash of your IP address for a short time after you send a form. The hash cannot readily be turned back into the IP address and is deleted automatically, as described in section 7.
Your choice in the cookie banner is stored in your own browser. It is not sent to us. See our Cookie Policy.
What we do not do
We do not buy personal data, sell it, use it for advertising profiles or make decisions about you by automated means that have legal or similarly significant effects.
4. Purposes and lawful bases
| Purpose | Data used | Lawful basis (UK GDPR Article 6) |
|---|---|---|
| Replying to your enquiry and preparing a proposal | Enquiry form data, emails | Steps taken at your request before entering into a contract (6(1)(b)); where you enquire on behalf of an organisation, our legitimate interests in responding to business enquiries (6(1)(f)) |
| Sending an automatic confirmation copy of your enquiry | Name, email address, message | Legitimate interests in confirming receipt and giving you a record of what you sent (6(1)(f)) |
| Delivering services to clients and managing the relationship | Contact details, correspondence, project information | Performance of a contract (6(1)(b)) |
| Protecting forms from spam and abuse | Hashed IP address, a hidden anti-spam field | Legitimate interests in keeping the website secure (6(1)(f)) |
| Keeping the website secure and working | Server access logs | Legitimate interests in security and service reliability (6(1)(f)) |
| Keeping business and tax records | Invoices, contracts, related correspondence | Legal obligation (6(1)(c)) |
| Establishing, exercising or defending legal claims | Relevant correspondence and records | Legitimate interests (6(1)(f)) |
The checkbox on our forms confirms that you have read this notice. We do not rely on it as consent for processing. Where we rely on legitimate interests, we have balanced them against your rights, and you may object at any time as described in section 9.
We do not send marketing emails. If that changes, we will ask for your consent first where PECR requires it.
5. Who we share data with
We share personal data only where needed for the purposes above:
- Website hosting provider, which stores the website and its server logs on our behalf.
- Email service provider, which carries and stores email sent to and from our domain.
- Professional advisers, such as accountants and lawyers, under duties of confidentiality.
- Public authorities, regulators or courts, where the law requires it.
- A buyer or successor of our business, if the business or its assets are transferred, under equivalent protections.
Service providers act as processors under written contracts that require them to follow our instructions and keep the data secure, as Article 28 UK GDPR requires. You can ask us for the names of our current processors by writing to [email protected].
6. International transfers
If a service provider stores or accesses personal data outside the United Kingdom, we make sure the transfer is protected. That means the destination is covered by UK adequacy regulations, or the transfer is made under the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, with supplementary measures where needed. You can ask us for a copy of the relevant safeguards.
7. How long we keep data
| Data | Retention period |
|---|---|
| Enquiries that do not lead to a contract | 24 months from our last contact with you, then deleted |
| Client contracts, invoices and related correspondence | For the duration of the contract and 6 years after it ends, in line with the Limitation Act 1980 and HMRC record-keeping rules |
| Hashed IP addresses used for form spam protection | Deleted automatically within 1 hour |
| Server access logs | Up to 90 days, unless needed to investigate a specific security incident |
| Cookie banner choice in your browser | 12 months, or until you clear your browser storage |
Form submissions are delivered by email and are not stored in a database on the web server.
8. Security
The website is served only over encrypted HTTPS connections. Access to email accounts and hosting is limited to people who need it and protected by strong authentication. The server directory used for spam protection is closed to public access. No method of transmission or storage is completely secure, but we take appropriate technical and organisational measures for the kind of data we hold.
9. Your rights
Under UK GDPR you have the right to:
- access the personal data we hold about you and receive a copy;
- rectification of inaccurate or incomplete data;
- erasure of your data in certain circumstances;
- restriction of processing in certain circumstances;
- object to processing based on legitimate interests;
- data portability for data you provided to us where processing is based on contract or consent and carried out by automated means;
- withdraw consent at any time where we rely on consent, without affecting processing already carried out.
To exercise a right, write to [email protected]. We may need to confirm your identity first. We respond within one month of receiving your request. That period can be extended by up to two further months for complex or numerous requests, in which case we will tell you why within the first month. There is normally no fee.
10. Complaints
If you are unhappy with how we handle your personal data, please contact us first at [email protected] so we can try to put it right.
You also have the right to complain to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Complaints can be made online at ico.org.uk/make-a-complaint.
11. Children
This website is intended for businesses and adults looking for app development services. We do not knowingly collect personal data from children through it.
12. Changes to this notice
We review this notice when our processing changes and at least once a year. The date at the top shows when it was last updated. Material changes will be highlighted on this page.