Last updated: 25 April 2026
Privacy notice
This notice tells you what personal data Pennine Pixels Ltd ("Pen9", "we", "us") collects when you use this site, why we collect it, how long we keep it, and what your rights are under the UK GDPR and the Data Protection Act 2018.
1. Who we are
Pennine Pixels Ltd is a private limited company registered in England and Wales.
- Companies House number: [Companies House number — to be filled]
- Registered office: [registered office address — to be filled]
- ICO registration number: [ICO number — to be filled]
- Data controller contact: contact form or digitaldenirouk@gmail.com
2. What data we collect
2a. Enquiries via the contact form
- Your name (mandatory)
- Your organisation (optional)
- Your email address (mandatory)
- Reason for enquiry (drop-down)
- Message text (mandatory)
- Your explicit consent to be contacted in reply (mandatory)
- Submission timestamp and source IP, recorded by Netlify Forms for spam/abuse prevention
2b. Site analytics
We do not run Google Analytics, Meta Pixel, Hotjar, or any other third-party analytics tag. Netlify (our hosting provider) keeps short-term aggregated request logs as part of normal hosting operations.
2c. Cookies
The site sets one first-party storage entry, pen9.cookie.consent.v1, to record whether you have
dismissed the cookie banner. No advertising or analytics cookies are set. See our
cookie policy.
3. Lawful basis for processing
For enquiry submissions: legitimate interest under UK GDPR Article 6(1)(f) — specifically, our legitimate interest in assessing landowner eligibility for carbon-credit projects and in responding to consortium, pilot, press, and DSIT-related enquiries that relate to PEN9's stated business purpose. You provide explicit consent to be contacted by ticking the consent box on the form.
For Netlify hosting logs: legitimate interest in operating a secure web service.
4. How long we keep your data
- Contact-form submissions: retained for up to 24 months from last contact, then deleted, unless you become a counterparty (consortium partner, pilot landowner, supplier) in which case standard business-record retention applies.
- Netlify request logs: per Netlify's standard retention (typically 30–90 days).
- Cookie-consent storage entry: lives in your browser only; we do not see it.
5. Who we share it with
- Netlify (USA, with EU/UK Standard Contractual Clauses) — site hosting and form storage.
- Google Workspace (USA, SCCs) — the
digitaldenirouk@gmail.commailbox that receives forwarded enquiries. - No one else. We do not sell, rent, or share enquiry data with marketing networks, data brokers, or any third party for advertising.
6. Your rights
Under the UK GDPR you have the right to:
- Request a copy of the personal data we hold about you (subject access request).
- Request correction of inaccurate data.
- Request erasure ("right to be forgotten") subject to overriding legal bases.
- Object to processing carried out under legitimate interest.
- Withdraw any consent you have given, at any time.
- Lodge a complaint with the Information Commissioner's Office (ico.org.uk) if you believe we have mishandled your data.
To exercise any of these rights, email digitaldenirouk@gmail.com with the subject line "Data rights request".
7. International transfers
Our hosting provider (Netlify) and email provider (Google Workspace) operate in the United States. Both rely on UK International Data Transfer Agreements / Standard Contractual Clauses to keep your data protected to UK GDPR standards.
8. Changes to this notice
We will update this page if our processing changes. The "last updated" date at the top of the page is the authoritative version; substantive changes will be flagged on the home page.