Who we are
ChilliMint (Europe) Limited (“ChilliMint”, “we”, “us”) is a consultancy and marketing agency specialising in payments, banking, and financial services. We are registered in England and Wales under company number 06900260. Our registered office is at Elgon, Warwick Road, Leek Wootton, Warwickshire CV35 7QR, and our business address is 8 The Old Post Office, Old Square, Warwick CV34 4RA.
We are the controller of the personal information described in this notice. This means we decide how and why it is used. We are registered with the Information Commissioner’s Office (ICO) under registration number ZA359697.
What this notice covers
This notice explains how we collect and use personal information when you:
- visit our website, chillimint.com
- contact us through a form on our website or by email
- sign up to receive news and updates from us
- work with us as a client, or as a contact at a client or prospective client
- apply for a job with us
It also explains your rights, and how to contact us or complain.
The information we collect
Information you give us
| When | What we collect |
|---|---|
| You use the Contact us form | Your name, email address, message, and whether you agree to receive news and updates from us |
| You use the contact form on our Insights pages | Your first name, last name, work email address, company, job title, how you heard about us, and your message, plus the page you were on when you sent it |
| You email us | Your name, email address, and anything you include in your message |
| You sign up for news and updates | Your name, email address, and a record of when and how you agreed |
Please don’t include sensitive information, such as health details, in your messages to us. We don’t need it to respond.
Information collected automatically
| When | What is collected |
|---|---|
| You visit any page | Your IP address, browser and device type, the pages you visit, and the date and time. Our website host and our security system record this in technical logs. |
| You load the Contact us page | Google reCAPTCHA collects information about your device and how you interact with the page, such as your IP address and browser details, to check you are a person and not a spam bot. |
| A page loads its fonts | Your browser requests the fonts from Google, which receives your IP address. |
| You accept analytics cookies | Google Analytics records how you use our website: the pages you visit, how long you stay, your device and browser type, your approximate location (country or city), and how you arrived, for example from a press article. It doesn’t record your name or contact details. |
We use Google Analytics only if you accept analytics cookies, and we’ve switched off its advertising features. We don’t use advertising tools.
How we use your information, and our lawful basis
Data protection law requires us to have a lawful basis for each way we use personal information. These are ours:
| What we use it for | Information used | Lawful basis |
|---|---|---|
| Replying to your enquiry, and discussing how we might work together | The details you give us in a form or email | Legitimate interests: responding to people who contact us. If you ask about our services, also steps you have asked us to take before entering a contract. |
| Keeping a record of our contact with you in our customer relationship management (CRM) system | Your contact details and enquiry | Legitimate interests: managing our business relationships |
| Sending you news and updates | Your name, email address, and consent record | Consent. You can withdraw it at any time, using the unsubscribe link in any email or by contacting us. |
| Protecting our website and forms from spam and attacks | Technical information, including reCAPTCHA data | Legitimate interests: keeping our website and forms secure |
| Running our website and displaying it correctly | Technical information, such as your IP address | Legitimate interests: operating our website |
| Meeting our legal obligations | Any of the above, where needed | Legal obligation |
| Understanding how people hear about us, to improve our marketing | Your answer to “How did you hear about ChilliMint?” | Legitimate interests: understanding which of our marketing activities work |
| Understanding how people use our website, so we can improve it | Analytics information, only if you accept analytics cookies | Consent. You can withdraw it at any time with the “Manage consent” tab on our website. |
Where we rely on legitimate interests, we have considered your interests and rights, and you can object at any time (see “Your rights”).
We don’t sell your information. We don’t make decisions about you based solely on automated processing.
Who we share it with
We use trusted service providers to run our website and business. They act on our instructions and may only use your information to provide their service to us.
| Provider | What they do for us | Where your information is held |
|---|---|---|
| HubSpot | Our CRM. It receives messages sent through the contact form on our Insights pages, and stores our contact records. | Our HubSpot account is hosted in HubSpot’s EU data centre. |
| Google (reCAPTCHA) | Protects the Contact us form from spam. Google’s Privacy Policy and Terms of Service apply to this service. | United States |
| Google (Fonts) | Supplies the fonts our website uses | United States |
| Google (Analytics) | Measures how our website is used, only if you accept analytics cookies. We’ve switched off Google’s advertising features and its data sharing. | United States |
| IONOS | Hosts our website and its technical logs | Germany (European Union) |
| Wordfence | Protects our website from attacks | On our website. Information about suspected attacks, including IP addresses, is shared with Defiant, Wordfence’s provider, in the United States, under a data processing agreement. |
| Microsoft 365 | Our email system, which receives messages sent to us and from the Contact us form | We’re confirming this, and will update this notice. |
| Rackspace | Archives the email we send and receive, including deleted messages, so we can meet our legal and record-keeping obligations | We’re confirming this, and will update this notice. |
| Dropbox | Stores our files, including job applications and client work | We’re confirming this, and will update this notice. |
| Wrike | Our project management system, which holds client contact details and project information | We’re confirming this, and will update this notice. |
| Xero | Our accounting system, which holds client billing details | United States |
We may also share information with our professional advisers, or where the law requires us to, for example with a regulator or the police.
Transfers outside the UK
Some of our providers hold or access information outside the UK and the European Economic Area (EEA). The UK recognises the EEA as giving equivalent protection, so information held there, such as on our website host in Germany, needs no extra safeguards.
Where information goes elsewhere, we make sure it is protected by an approved safeguard: the UK-US data bridge for US companies certified under it, or the UK’s International Data Transfer Agreement or Addendum.
| Provider | Where information may go | Safeguard |
|---|---|---|
| Google (reCAPTCHA, Fonts, and Analytics) | United States | An approved safeguard, set out in Google’s data processing terms |
| Defiant (Wordfence) | United States | Standard contractual clauses with the UK Addendum, signed with Defiant |
| HubSpot | Hosted in the EU. HubSpot is a US company and may access information from the United States, for example for support. | An approved safeguard, set out in HubSpot’s data processing agreement |
| Xero | United States | An approved safeguard, set out in Xero’s data processing terms |
We’re confirming where Microsoft 365, Rackspace, Dropbox, and Wrike hold our information, and will update this notice once we have.
You can contact us for more details about these safeguards.
How long we keep it
We keep personal information only for as long as we need it.
| Information | How long we keep it |
|---|---|
| Enquiries that don’t lead to working together | 2 years after our last contact |
| Contact records for clients and business partners | 6 years after the relationship ends |
| News and updates sign-ups | Until you unsubscribe. We then keep your email address on a “do not contact” list, so we don’t email you again. |
| Website and security logs | Up to 90 days for our own logs. Defiant, Wordfence’s provider, may keep IP addresses involved in attacks for longer, under its own policies, to protect other websites. |
| reCAPTCHA information | Held by Google, under Google’s own retention policy |
| Emails we send and receive | 6 years in our secure email archive, even if deleted from a mailbox, to meet our legal and record-keeping obligations |
| Google Analytics information | 14 months, after which Google Analytics deletes it automatically |
Email is the one exception: copies stay in our archive for 6 years, even where a period above is shorter, with access limited to legal and compliance needs. Otherwise, when we no longer need information, we delete it securely or make it anonymous.
Clients and business contacts
This section applies if you work for one of our clients or prospective clients, or we work with you on a project.
What we collect. Your name, job title, organisation, work email address and phone number, and our correspondence and meeting notes with you. For clients, also the information needed to deliver our work and to invoice. We get this from you, from your colleagues, and, for prospective clients, from public professional sources such as LinkedIn and company websites.
How we use it, and our lawful basis
| What we use it for | Lawful basis |
|---|---|
| Delivering our services to your organisation, and managing our relationship | Legitimate interests: working with the organisations we have agreements with |
| Invoicing and keeping financial records | Legal obligation: tax and accounting rules |
| Getting in touch about services that may interest your organisation, and sending relevant updates to your work email address | Legitimate interests: developing our business. You can opt out at any time. If you’re a sole trader, or in some partnerships, we’ll only send you marketing emails with your consent. |
When we act for a client. Sometimes we handle personal information on a client’s behalf, for example inside the client’s own systems. In that case we act on the client’s instructions, and the client’s privacy notice applies.
Who we share it with. Our CRM (HubSpot), our email system (Microsoft 365), Wrike for project management, Xero for accounting, and our professional advisers where needed.
How long we keep it. For 6 years after our relationship ends, to meet tax and accounting rules. Contact details of prospective clients we have not worked with are kept for 2 years after our last contact.
Job applicants
This section applies if you apply to work with us, directly or through a recruitment agency.
What we collect. Your contact details, CV, cover letter, employment history, and qualifications, plus our interview notes and any assessments. Before making an offer, we also collect references and the documents we need to check your right to work in the UK. We get this from you, from recruitment agencies and job sites you apply through, and from your referees.
Sensitive information. If you tell us about a disability or health condition so that we can make adjustments to the interview, we use it only for that purpose. If we ask for equal opportunities information, answering is optional and your answers are kept separate from your application.
How we use it, and our lawful basis
| What we use it for | Lawful basis |
|---|---|
| Assessing your application and deciding whether to make an offer | Steps you have asked us to take before entering an employment contract |
| Checking your right to work in the UK | Legal obligation |
| Taking up references | Legitimate interests: confirming your experience before making an offer |
| Making adjustments for a disability or health condition | Legal obligation under employment and equality law |
| Equal opportunities monitoring | Your consent, which you can withdraw at any time |
Who we share it with. The people at ChilliMint involved in hiring, the recruitment agency you applied through, your referees (with your agreement), and our email system (Microsoft 365) and file storage (Dropbox).
How long we keep it. If you’re not successful, we keep your application for 6 months after we tell you our decision, in case of questions about the process. With your permission, we may keep it for up to 12 months to consider you for future roles. If you join us, your application becomes part of your staff record, and our staff privacy notice applies.
Your rights
You have the right to:
- Access the personal information we hold about you, and get a copy
- Correct information that is wrong or incomplete
- Delete your information, in some circumstances
- Restrict how we use your information, in some circumstances
- Object to how we use your information where we rely on legitimate interests. You can always object to marketing, and we will stop.
- Move information you gave us to another organisation, in some circumstances
- Withdraw your consent at any time, where we rely on it. This doesn’t affect anything we did before you withdrew it.
To use any of these rights, contact us at hello@chillimint.com. It’s free. We may need to confirm your identity first. We will reply within one month of confirming it, or tell you if we need longer because your request is complex.
How to complain
If you’re unhappy with how we have handled your information, please contact us first at hello@chillimint.com. We will acknowledge your complaint within 30 days, and do our best to resolve it.
You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator:
- Website: ico.org.uk/make-a-complaint
- Telephone: 0303 123 1113
Cookies
Cookies are small files stored on your device when you visit a website. Our website uses the cookies it needs to work and stay secure. With your permission, it also uses Google Analytics cookies to help us understand how the site is used. We don’t use advertising cookies. When you first visit, you can accept or reject analytics cookies, and you can change your choice at any time with the “Manage consent” tab. Our cookie policy lists every cookie we use, who sets it, and how long it lasts, and is kept up to date automatically.
You can delete or block cookies in your browser settings. If you block the reCAPTCHA cookies, you may not be able to send a message through the Contact us form, but you can always email us at hello@chillimint.com instead.
How we keep your information secure
Our website uses an encrypted connection (HTTPS). We limit access to personal information to the people who need it, and we choose providers that keep information secure.
Links to other websites
Our website links to other websites, such as articles about us in the press and our LinkedIn page. Those websites have their own privacy notices, and we are not responsible for how they use your information.
Children
Our website and services are for businesses. They are not intended for children, and we don’t knowingly collect information about them.
Changes to this notice
We review this notice regularly and will update it when the way we use information changes. The date at the top shows when it was last updated.
Contact us
For any questions about this notice or how we use your information, contact:
ChilliMint (Europe) Limited
8 The Old Post Office, Old Square, Warwick CV34 4RA
Email: hello@chillimint.com