Privacy Policy

Version 1.7 | Last reviewed: 1 September 2026 | Effective from: 12 February 2026

Enarra is a sole trader business based in the United Kingdom.

Trading Name: Enarra
Business Address:
Office 19, The Orion Suite
Enterprise Way
Newport
NP20 2DX
United Kingdom

Enarra is the data controller for the purposes of UK GDPR.

1. Information We Collect

We may collect the following personal data depending on how you contact us:

Enquiry form (native, hosted on our own website):

  • Full name
  • Email address
  • Phone number (if provided)
  • Business or firm name (if provided)
  • Preferred contact method (if provided)
  • Any information you include in your message
  • The page you submitted the form from, and, where available, how you arrived at our site (e.g. referring page or campaign source) — captured only at the moment you submit the form, used only to understand which pages and sources lead to enquiries. We do not store any identifier in your browser to link this to any other page you visit.

Workflow Review request form (native, hosted on our own website):

  • Full name
  • Email address
  • Phone number (if provided)
  • Business or firm name (if provided)
  • Preferred contact method (if provided)
  • What you would like us to review
  • Whether you have already had a similar review or assessment carried out, and — only if you choose to share it — who carried it out, roughly how recent it was, and whether you would be willing to share a copy of it later if asked. We do not ask you to upload any document through this form.
  • The page you submitted the form from, and, where available, how you arrived at our site — captured only at the moment you submit the form, used only to understand which pages and sources lead to requests. We do not store any identifier in your browser to link this to any other page you visit.

Submitting the Workflow Review request form is a request for us to review, not a confirmed booking, payment, or appointment. Scheduling and payment are only arranged afterwards, directly with you, once we've confirmed the Workflow Review is a good fit.

Direct email correspondence:

  • Name and email address (from your email header)
  • Any personal data you include in the message

We do not intentionally collect sensitive personal data.

2. How We Collect Your Data

We collect data through the following channels:

  • The enquiry form on our website, built and hosted directly on our own website infrastructure (Cloudflare) — submissions are protected against spam and automated abuse by Cloudflare Turnstile
  • The Workflow Review request form on our website, built and hosted the same way and protected by the same Cloudflare Turnstile check
  • Direct email correspondence sent to hello@enarra.co.uk

3. Why We Collect Your Data

We process your data for the following purposes:

  • To respond to enquiries about our services
  • To review Workflow Review requests and assess whether the service is a good fit
  • To arrange and manage a Workflow Review session, directly with you, once confirmed
  • To discuss the potential scope of work
  • To maintain business records

We rely on legitimate interest as the lawful basis for processing enquiry, Workflow Review request, and email correspondence data. Where a Workflow Review request leads to an agreed, paid engagement, we rely on steps taken at your request prior to entering a contract for arranging that engagement.

4. How Your Data Is Stored

Your data may be processed or stored by the following providers:

  • Zoho Mail (email service) — stores email correspondence. Zoho processes data in multiple locations.
  • Cloudflare (website hosting, CDN, and form infrastructure) — hosts this website, stores enquiry form and Workflow Review request form submissions directly (Cloudflare D1, EU jurisdiction — see below), and provides spam/abuse-prevention checks for both forms (Cloudflare Turnstile). Turnstile is used to help distinguish genuine visitors from automated bots and scripts as an anti-spam measure — it does not verify who you are. To help us tell apart genuine submissions from likely automated or duplicate ones, each form also stores a one-way cryptographic hash of your email and message (not the reversible content itself) and a classification label (e.g. genuine, duplicate, or suspected spam); a submission is never disclosed to anyone outside Enarra on this basis. If a Workflow Review request leads to an agreed, paid engagement, we also record the resulting engagement's status (e.g. scheduling and delivery stage) in the same Cloudflare D1 database, referenced back to your original submission rather than duplicating your contact details into a separate record.

These providers act as data processors on our behalf. Where data is processed outside the UK, we take reasonable steps to ensure appropriate safeguards are in place in line with UK GDPR requirements.

We take reasonable steps to ensure all data is handled securely.

5. Data Retention

We retain personal data only for as long as necessary for the purpose for which it was collected:

  • Enquiry data (where no client relationship develops): up to 12 months from the date of enquiry
  • Submissions flagged as suspected spam: up to 30 days, to allow a genuine enquiry that was mistakenly flagged to be recovered, then deleted
  • Workflow Review request data (where no engagement proceeds): up to 12 months from the date of the request
  • Workflow Review engagement records (where an engagement does proceed): up to 6 years from the end of the engagement, in line with client correspondence and project records, below
  • Client correspondence and project records: up to 6 years from the end of the engagement, in line with standard UK business record-keeping practice

Retention above these periods is not automatic: enquiry and suspected-spam records older than the stated period are identified and deleted by Enarra directly (via Cloudflare's database console) as part of a periodic manual review, not by an automated deletion process.

You may request deletion of your data at any time by contacting us at hello@enarra.co.uk. We will respond within 30 days.

6. Your Rights

Under UK GDPR, you have the right to:

  • Access — request a copy of the personal data we hold about you
  • Rectification — request correction of inaccurate or incomplete data
  • Erasure — request deletion of your personal data in certain circumstances
  • Restriction of processing — request that we limit how we use your data in certain circumstances
  • Data portability — request a copy of data you have provided to us in a structured, commonly used format, where technically feasible
  • Object to processing — object to processing based on legitimate interest
  • Lodge a complaint — contact the Information Commissioner's Office (ICO) at ico.org.uk if you believe your data has been handled improperly

To exercise any of these rights, contact us at: hello@enarra.co.uk

7. International Data Transfers

Some of our service providers may process data outside the UK. Zoho processes data in multiple locations internationally. Cloudflare D1, which stores enquiry form and Workflow Review request form submissions, is configured to store that data in the EU for both our live and pre-release environments. Where data is transferred outside the UK, we rely on the processors' own compliance mechanisms, which may include UK adequacy decisions, standard contractual clauses, or other appropriate safeguards in accordance with UK GDPR.

8. Changes to This Policy

We may update this policy from time to time. The version number and review date at the top of this page will be updated when changes are made. The latest version will always be published at this address.