The Frosted
Privacy Policy.

Last updated: 11 August 2026

1. Who we are

This Privacy Policy explains how Saifi Consulting Ltd, trading as Frosted (“Frosted”, “we”, “us” or “our”) handles personal data collected through frosted.co (the “Website”).

Saifi Consulting Ltd is the controller of the personal data described in this policy. It is registered in England and Wales under company number 12931268. Its registered office is 71-75 Shelton Street, Covent Garden, London, England, WC2H 9JQ.

For privacy questions or requests, email [email protected].

2. What this policy covers

This policy covers personal data we handle when you visit the Website, contact us through it or request a complimentary audit.

It does not govern personal data we process on behalf of clients while delivering retention marketing services. That processing is governed by our client agreements and applicable data processing terms. If your data was provided to us by one of our clients, please contact that organisation first; you may also contact us and we will assist appropriately.

3. Personal data we collect

We collect information directly from you when you submit a Website form.

Contact form

• full name;
• email address;
• optional telephone number;
• reason for your enquiry;
• the details you include in your message; and
• your response to our human-verification question.

Complimentary Audit form

• full name, email address and telephone number;
• optional website address;
• current email marketing platform;
• project budget range;
• reason for your enquiry;
• any additional details you choose to provide; and
• your response to our human-verification question.

Please only include information relevant to your enquiry. Do not send passwords, API keys, payment credentials, special category data—such as health, ethnicity, beliefs, biometrics or sexual orientation—or criminal-offence information through our forms.

Technical information

When you use the Website, our infrastructure and service providers may process technical information such as your IP address, browser and device type, requested page, date and time, referring page and security events. This information is used to deliver and secure the Website and to produce aggregate usage statistics.

Our Website forms are configured not to store submitters’ IP addresses or logged-in user identities in Formie.

4. How and why we use personal data

UK data protection law requires us to have a lawful basis for each use of personal data.

• Responding to enquiries: to read, route and reply to messages and conduct follow-up correspondence. We rely on our legitimate interests in responding to people who contact our business. If you ask us to provide services to you personally, for example as a sole trader, we may also rely on taking steps at your request before entering into a contract.
• Providing a complimentary audit: to assess your current setup, prepare the requested audit and discuss potential work. We rely on our legitimate interests in assessing and progressing potential engagements. If you request the audit in your personal capacity, we may also rely on taking steps at your request before entering into a contract.
• Qualifying enquiries: to understand whether Frosted is a suitable fit and direct an enquiry to the appropriate person. We rely on our legitimate interests in operating an efficient and proportionate sales process.
• Preventing spam and misuse: to check human-verification answers and protect our forms, staff and systems. We rely on our legitimate interests in security and abuse prevention.
• Operating and securing the Website: to deliver pages, monitor availability, investigate faults and defend against attacks. We rely on our legitimate interests in network and information security.
• Understanding Website use: to review aggregate traffic and performance information through Cloudflare Web Analytics and improve the Website. We rely on our legitimate interests in measuring and improving our Website using privacy-focused analytics.
• Keeping appropriate records: to administer our business, evidence what was requested or agreed, comply with legal obligations and establish, exercise or defend legal claims. We rely on legitimate interests and, where applicable, legal obligation.
• Direct marketing: to send marketing about Frosted services only where the Privacy and Electronic Communications Regulations (PECR) permit it. We rely on consent where PECR requires consent; otherwise we rely on our legitimate interests in promoting relevant business services, subject to your right to object at any time.

The privacy notice wording shown beside the Contact form confirms that this policy was made available to you. It is not consent to marketing and is not the lawful basis for handling your enquiry.

5. Required and optional information

You do not have to use our forms and can email [email protected] instead. Fields marked as required are the minimum information needed to process that form. If required information is missing or inaccurate, the form may not submit or we may be unable to respond or provide the requested audit. Optional fields can be left blank.

6. Who receives personal data

We do not sell personal data. We share it only where necessary with:

• DreamHost, which hosts the Website and database where form submissions are stored;
• Mailgun, which delivers Website form notifications and transactional emails;
• Google Workspace, which hosts our business email and related correspondence;
• Cloudflare, which provides Website delivery, security, performance and Web Analytics;
• Google Fonts, Font Awesome and Vimeo, whose hosted resources or API may receive your IP address and browser information when your browser requests them; these services do not receive Website form submissions from us;
• our staff and contractors who need the information to handle the enquiry;
• professional advisers such as lawyers, accountants and insurers where necessary;
• regulators, courts, law enforcement or other authorities where required by law or needed to protect legal rights; and
• a buyer, investor or successor if all or part of our business is sold or reorganised, subject to appropriate confidentiality and data-protection safeguards.

Craft CMS and Formie are the software used on our hosting to capture and manage Website content and form submissions.

7. International transfers

Some Website providers may process or allow access to personal data outside the United Kingdom, including in the United States.

For any restricted transfer under UK GDPR, we use the relevant provider terms and safeguards for that transfer, such as UK adequacy regulations where the recipient or destination is covered, or the UK International Data Transfer Agreement or UK Addendum to approved standard contractual clauses together with any required transfer assessment. Contact us for details of the safeguard used for a particular provider.

8. Cookies and third-party technologies

A clean-browser audit of the homepage and Contact page found no non-essential cookies and no writes to local or session storage on those pages. Cloudflare Web Analytics is designed to provide aggregate Website statistics without using cookies or local or session storage to track individuals across websites.

Strictly necessary cookies or similar technologies may be used in specific circumstances, such as maintaining a secure session, processing a form or responding to a Cloudflare security challenge. These are used to provide or protect the service, not for advertising.

The Website also loads resources from third parties. Your browser sends those providers your IP address and standard browser information when requesting the resource:

• Google Fonts provides Website typefaces;
• Font Awesome provides icons;
• Vimeo’s API supports video-related Website functionality and may receive your IP address and browser information when Vimeo resources are requested. If a Vimeo player is embedded or used, Vimeo may set cookies or use similar technologies under its own privacy and cookie notices; and
• Cloudflare Web Analytics provides aggregate Website analytics.

These providers handle information they receive under their own privacy notices. You can block or delete cookies and third-party resources using browser settings or extensions, although doing so may prevent fonts, icons or videos from displaying correctly.

We will update this policy and introduce an appropriate consent mechanism if we deploy non-essential cookies or similar technologies that require consent.

9. Direct marketing

Submitting a Contact or Complimentary Audit form does not automatically subscribe you to a marketing list. We may reply and follow up about the enquiry or audit you requested.

If we send direct marketing by email or similar electronic message, we obtain consent where PECR requires it. For corporate business contacts, we may send relevant business-to-business marketing where PECR and UK GDPR permit it, but you can object at any time. You can stop marketing by using an unsubscribe link or emailing [email protected]. This will not prevent service-related messages or replies to an active enquiry.

10. How long we retain information

We keep personal data only for as long as reasonably necessary for the purpose for which it was collected:

• Contact and Complimentary Audit submissions stored in Formie/Craft are retained for up to 24 months from submission, unless deleted sooner or retained longer because they relate to an engagement, proposal, dispute or legal claim;
• Website form notification emails and follow-up correspondence that do not lead to an engagement are retained for up to 24 months after the last meaningful contact, unless one of the longer retention reasons below applies;
• Mailgun delivery data and any transient copies of notification emails are retained only for the periods applied in our Mailgun settings or Mailgun’s service terms, and are used for delivery, troubleshooting, security and legal purposes;
• records relating to an engagement, proposal, dispute or legal claim may be retained for up to six years after the relationship or matter ends, or longer where the law requires;
• marketing suppression records may be retained for as long as necessary to respect an opt-out;
• security and technical logs are retained for the periods applied by our providers and only as long as needed for security, troubleshooting and legal purposes; and
• spam and clearly irrelevant submissions may be deleted sooner.

When information is no longer required, we delete or anonymise it from active systems where reasonably practicable. Residual copies may remain in protected backups until those backups are overwritten in the normal backup cycle; we do not use backups for ordinary access.

11. Your rights

Depending on the circumstances, UK data protection law gives you rights to:

• be informed about how your personal data is used;
• access your personal data and receive a copy;
• correct inaccurate or incomplete data;
• request deletion where there is no good reason for continued retention;
• restrict processing in certain circumstances;
• object to processing based on legitimate interests and object at any time to direct marketing;
• receive certain data in a portable, machine-readable format; and
• withdraw consent where we rely on consent, without affecting earlier lawful processing.

These rights are not absolute and may not apply in every situation. To exercise a right, email [email protected]. We may need to verify your identity. We normally respond within one month and will explain if an exemption applies or additional time is required.

12. Automated decision-making

We do not use Website data to make decisions based solely on automated processing that produce legal or similarly significant effects. We do not profile Website visitors. The human-verification question is a simple anti-spam measure.

13. Security

We use technical and organisational measures designed to protect personal data against unauthorised access, loss, alteration or disclosure. These include HTTPS encryption, network protection through Cloudflare, access controls and authentication, restricted access to submissions and business email, and reputable service providers.

No internet transmission is completely secure. Please do not send highly sensitive information through ordinary Website forms or email.

14. Children

The Website is aimed at businesses and the people who work in them. It is not directed at children and we do not knowingly collect children’s personal data through it. Contact us if you believe a child has provided personal data.

15. Third-party links

The Website links to third-party websites and may contain embedded content. We do not control their privacy practices. Their own privacy policies apply when you visit or interact with them.

16. Complaints

If you are concerned about how we use personal data, please contact [email protected] so we can investigate.

You may also complain to the UK Information Commissioner’s Office:

Information Commissioner’s Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Website: ico.org.uk/make-a-complaint
Telephone: 0303 123 1113

Contacting us first does not affect your right to complain to the ICO.

17. Changes and contact

We may update this policy when our practices, providers or the law change. The “Last updated” date shows when it was most recently revised. Where a change materially affects how we use personal data, we will take reasonable steps to bring it to your attention.

Saifi Consulting Ltd, trading as Frosted
Company number: 12931268
Registered office: 71-75 Shelton Street, Covent Garden, London, England, WC2H 9JQ
Email: [email protected]
Website: frosted.co