Legal
Privacy policy
Last updated 1 January 2026. This policy explains what personal data Curiosityjivar Labs Ltd processes when you use curiosityjivar.click, why we process it, and the rights you hold over it.
1. Who we are
Curiosityjivar Labs Ltd ("we", "us") is a company registered in England and Wales under company number 14872305, with its registered office at 27 Pemberton Row, London EC4A 3BA, United Kingdom. We operate the website curiosityjivar.click and the Curiosityjivar colour system generator. For the purposes of the UK GDPR and the EU GDPR we are the data controller for the personal data described in this policy.
2. What data we collect
Data you give us. When you submit the form on our contact page we collect the name, email address, organisation (if supplied), enquiry category and message content you enter. If you email us directly we receive whatever the message and its headers contain.
Data collected automatically. Our hosting infrastructure records standard server log data for each request: IP address, timestamp, requested URL, HTTP status, referring URL and user agent string. These logs are used for security monitoring, abuse prevention and diagnosing faults.
Data stored on your device. Your cookie choice and any theme preference are stored in your browser's local storage. They are not transmitted to us and are readable only by this site.
Data we do not collect. We do not ask for payment card details on this site, we do not knowingly process data relating to children under 16, and we do not collect special category data as defined by Article 9 of the GDPR. Palettes you generate are computed in your browser and are not sent to our servers.
3. Why we process it, and our lawful bases
- Responding to enquiries — legitimate interests (Article 6(1)(f)): we cannot answer a question without reading it and replying.
- Service security and fault diagnosis — legitimate interests: protecting the site and its users from abuse and outages.
- Analytics and functional cookies — consent (Article 6(1)(a)), collected through the cookie banner and withdrawable at any time.
- Meeting legal obligations — legal obligation (Article 6(1)(c)), for example retaining records where company or tax law requires it.
4. Cookies and similar technologies
We set a small number of cookies and local storage entries. Essential entries keep the site functional and record your consent decision; they are set without consent because the site cannot operate correctly without them. Analytics and functional categories are set only after you allow them. Full details, including names, purposes and durations, are in our cookie policy, which also explains how to withdraw consent or clear stored entries in each major browser.
5. Third-party processors
We keep our processor list deliberately short. At the time of writing we rely on categories of supplier rather than a long chain: a web hosting and content delivery provider that serves this site and holds server logs; an email service provider that transmits and stores correspondence; and, where you have consented, a privacy-focused analytics provider that reports aggregate traffic patterns. Each processor is engaged under a written data processing agreement that restricts them to acting on our documented instructions. Where a processor stores data outside the UK or EEA, transfers are covered by adequacy regulations or Standard Contractual Clauses together with a transfer risk assessment. We do not sell personal data and we do not share it with advertising networks or data brokers.
6. How long we keep data
Contact form submissions and related correspondence are retained for 24 months from the last contact, then deleted, unless an ongoing commercial relationship or legal requirement means a longer period applies. Server logs are retained for 90 days. Aggregated analytics that cannot identify an individual may be kept indefinitely. Consent records are kept for as long as the consent is relied upon plus 12 months, so that we can demonstrate compliance.
7. Your rights
If you are in the UK or EEA you have the right to access your personal data, to have inaccurate data corrected, to have data erased, to restrict or object to processing, to data portability, and to withdraw consent at any time without affecting processing carried out before withdrawal. You also have the right to complain to a supervisory authority — in the UK, the Information Commissioner's Office at ico.org.uk.
If you are a California resident, the CCPA as amended by the CPRA gives you the right to know what personal information is collected, disclosed or sold, the right to delete it, the right to correct it, the right to opt out of sale or sharing, and the right not to be discriminated against for exercising those rights. We do not sell or share personal information as those terms are defined in the CCPA.
To exercise any right, email [email protected]. We respond within one month for GDPR requests and within 45 days for CCPA requests, and we may ask for information to verify your identity before acting.
8. Security
The site is served over HTTPS. Access to administrative systems is limited to personnel who need it, protected by multi-factor authentication, and reviewed periodically. No system is perfectly secure; if a breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and inform affected individuals where the law requires it.
9. Changes and contact
Material changes to this policy will be announced on this page with an updated date. Our data protection contact is reachable at [email protected] or by post to the Data Protection Officer, Curiosityjivar Labs Ltd, 27 Pemberton Row, London EC4A 3BA, United Kingdom. General enquiries: [email protected].