Pivotal Path, Your digital pathfinders
This is a working draft for review, please have it checked before relying on it.

Privacy Policy

Who we are

Pivotal Path, Pivotal Labs and Pivotal Hub are trading names of Hayward-Zhu Ltd, registered in England & Wales (company no. 12231837), registered office 14 Hollybank Estate, CV9 3ET. We are the data controller for personal data collected through this site. You can reach us at pathfinders+GDPR@pivotalpath.co.uk.

What we collect

  • Contact form: your name, company (optional), email address and the content of your message.
  • Product interest forms: your email address.
  • Analytics: we use Vercel Web Analytics, which is cookieless and collects only anonymous, aggregated usage data. It sets no cookies, does not track you across sites, and does not collect personal identifiers. See the Cookies section below for details and how to opt out.

How we use it and our lawful basis

  • To respond to your enquiry and take steps at your request before entering into a contract (legitimate interest / pre-contract).
  • To send you occasional insights from Pivotal Path, only where you have opted in (consent). You can withdraw consent at any time by emailing us or using the unsubscribe link in any message.

Purposes and lawful bases

We separate what we do with your data by purpose, and name the UK GDPR lawful basis for each:

  • Contact-form enquiries. To reply to you and to take steps at your request before entering into a contract. Lawful basis: legitimate interest, and where relevant, pre-contract steps under Article 6(1)(b).
  • Product interest sign-ups. To email you when a specific product you registered interest in becomes available. Lawful basis: consent (your submission of the interest form).
  • Marketing insights and updates. Occasional insights or news from Pivotal Path, only where you have ticked the separate marketing opt-in box. Lawful basis: consent. You can withdraw at any time.

Who we share it with

We use a small number of trusted processors to run the site and reply to you:

  • Resend delivers contact-form emails on our behalf. Resend is built on Amazon SES.
  • Vercel hosts this website.

We never sell your data.

International transfers

Transactional email is sent via Resend, which is built on Amazon SES. Delivering your enquiry may therefore involve transferring your personal data to servers located outside the UK and EEA (including the United States). Where that happens we rely on appropriate safeguards, such as the UK International Data Transfer Addendum and the European Commission's Standard Contractual Clauses, together with the technical and organisational measures our processors have in place.

Web fonts

This site self-hosts its typefaces (Inter and Poppins). Font files are served from our own domain, so your IP address is not shared with Google or any other third-party font host when the page loads.

Retention

We keep enquiry and contact records for up to 24 months from the date of your last contact with us, then delete them, unless a client relationship begins, in which case we retain the records for the life of that relationship and for a reasonable period afterwards to meet our accounting, tax and legal obligations. Marketing consent records are kept for as long as you remain subscribed, plus a short period afterwards to evidence that consent was given and withdrawn.

Your rights

Under UK GDPR you have the right to:

  • access the personal data we hold about you;
  • ask us to correct inaccurate data (rectification);
  • ask us to delete your data (erasure);
  • ask us to restrict how we use it;
  • object to our processing;
  • portability of the data you gave us;
  • withdraw consent at any time where processing is based on consent.

To exercise any of these, email pathfinders+GDPR@pivotalpath.co.uk.

You also have the right to complain to the UK Information Commissioner's Office (ICO) if you think we have mishandled your personal data. You can contact the ICO at ico.org.uk (opens in a new tab).

Cookies

We use a first-party cookie called pp_consent to remember your cookie choice. It is set only after you interact with the cookie banner, contains a small JSON record of your decision (categories chosen, timestamp, policy version), and lasts about six months. It is scoped to this site and uses SameSite=Lax.

We group cookies into three categories:

  • Strictly necessary. Needed for the site to work. Covers the pp_consent cookie itself and basic security and form submission protection. Always on.
  • Analytics. On by default. We use Vercel Web Analytics, which is cookieless and collects only anonymous, aggregated usage data. It sets no cookies, does not track visitors across sites, does not collect personal identifiers, and the visitor session hash it uses is discarded after 24 hours. Because it cannot identify you, it runs by default on a legitimate-interests basis under the UK DUAA. You can opt out at any time via the cookie banner or the "Cookie preferences" link in the footer.
  • Marketing. Off by default. If enabled, this would support advertising and cross-site measurement. No marketing tools are loaded today.

You can change or withdraw your consent at any time using the "Cookie preferences" link in the footer.

Changes to this policy

We may update this policy from time to time. The "last updated" date below shows the latest version.

Last updated: 23 July 2026