Privacy

This notice explains what we do with information about you when you use this website, write to us through the contact form, or book a call. It is short because the site does very little.

Who we are

This site is run by SHIRO ELEVEN LTD, registered in England & Wales, Company No. 17288356. Our registered office is 66 Paul Street, London EC2A 4NA. We trade as SHIRO 11.

We are the data controller for the information described below. If you want to ask about anything here, email contact@shiro11.com.

This site sets no cookies and runs no analytics

Plainly: this website stores nothing on your device and reads nothing from it. There are no cookies of any kind — not for analytics, not for preferences, not for sessions. There is no analytics tool, no tag manager, no advertising pixel and no session recording. Typefaces are downloaded when the site is built and served from our own domain, so no font network is contacted when you open a page.

Because nothing is stored on or read from your device, the consent rule in the Privacy and Electronic Communications Regulations (reg. 6) is not engaged and no cookie banner is due. Putting one up anyway would ask for consent that is not needed and imply cookies that do not exist. If this ever changes, this notice changes first.

When you use the contact form

The form asks for three things: your name, your email address, and what you want to tell us. We use them to read your message and reply to it. We do not add you to a mailing list, build a profile, or share or sell what you send.

Our lawful basis is not consent. Where you are asking about work, we rely on UK GDPR Art. 6(1)(b) — steps taken at your request before entering a contract. Otherwise we rely on Art. 6(1)(f), legitimate interests: running a business and answering the people who write to it. Because we are not relying on consent there is nothing for you to withdraw, but you can object to the Art. 6(1)(f) processing at any time under Art. 21 by emailing us.

The form posts to our own code on this domain rather than to a third-party form service. That code passes your message to Resend, an email delivery provider acting on our instructions, which delivers it to our mailbox.

To stop automated submissions, the server briefly holds a one-way hash of the IP address a submission came from, in memory, purely to count how many submissions have arrived from it. The address itself is never written down, the hash is never stored or logged, it is not linked to your message, and it disappears when the server process restarts.

When you book a call

The Book a call page hands you over to a scheduling page run by Microsoft, on a Microsoft address. From the moment you arrive there you are using Microsoft’s service under Microsoft’s terms — this website collects nothing about your booking and no booking information passes through it.

Microsoft asks for what it needs to make an appointment, typically your name, email address and time zone. The booking arrives in our calendar and we use it to hold the call and to prepare for it. For what Microsoft does with the information while you are on their page, see the Microsoft Privacy Statement.

Hosting and server logs

The site is hosted by Vercel and served from their Frankfurt region. Like any web host, Vercel automatically records standard request information — the IP address a request came from, the time, the page requested, the browser’s user-agent string and the response status. This happens for delivery, security and abuse prevention. We do not build reports from those logs, we do not export them, and nobody here reads them as a matter of routine. Vercel keeps them for a short period set by their platform and then deletes them.

Who else handles your information

These are the only companies that process personal information on our behalf. Each is bound by a data processing agreement and may use it only to provide the service described.

• Vercel — Hosts this website and records standard request logs. Served from Frankfurt, Germany. Vercel Inc. is a US company.
• Resend — Delivers the email generated by the contact form to our mailbox. United States.
• Google — Runs the mailbox that receives enquiries, as part of Google Workspace. European Union, with support access from the United States.
• Microsoft — Runs the booking page that “Book a call” links to. European Union, with support access from the United States.
• Cloudflare — Answers DNS queries for shiro11.com. It does not sit in front of the site's traffic. Global anycast network.

Some of these companies are based in the United States. Where personal information is transferred outside the UK, it is covered by the safeguards in each provider’s data processing terms — the UK Addendum to the EU Standard Contractual Clauses, or the UK extension to the EU–US Data Privacy Framework.

How long we keep it

• Enquiries you send through the contact form — 24 months from our last exchange with you, then deleted.
• Enquiries that turn into work — kept with the project records for as long as the contract runs, and then for six years afterwards, which is how long a claim under that contract can be brought.
• Bookings — kept in the calendar for as long as the record of the meeting is useful, and deleted with the rest of a contact’s records on the same schedule as above.
• The anti-spam hash — minutes, in memory only. Never written to disk.
• Vercel’s request logs — held by Vercel for a short period set by their platform. We keep no copy.

Your rights

Under UK GDPR you can ask us to:

• give you a copy of the personal information we hold about you;
• correct it if it is wrong;
• delete it;
• restrict what we do with it, or object to our doing it at all;
• hand it to you, or to someone else, in a portable form.

Email contact@shiro11.com and we will respond within one month. It costs nothing. We may need enough information to be sure it is you — for an enquiry sent through this site, replying from the same address is usually enough.

We do not make any decision about you by automated means, and we do not profile you.

Complaints

If you think we have handled your information badly, tell us first — it is usually the fastest way to fix it. You also have the right to complain to the Information Commissioner’s Office, the UK’s supervisory authority for data protection.

ico.org.uk/make-a-complaint

Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

Helpline 0303 123 1113

Changes to this notice

If what we do with your information changes, we change this page and the date at the top of it. This version is dated 27 July 2026.