Short version: we collect only what we need to answer your enquiries and understand which pages are useful. We use cookieless, aggregate analytics — so no cookie banner. We don't sell your data, run ad pixels, or track you across the web.
1. Who we are
This notice covers the Hyracbox marketing website at hyracbox.com. Hyracbox is the learning platform operated by Hyrac Tech; for the purposes of this website, Hyracbox is the data controller responsible for the personal data described here.
Our products — HyracHub (the learner portal & marketplace) and Studio (the authoring app) — are separate services with their own accounts and their own privacy terms shown at the point of sign-in. This notice is about the public website only.
For any privacy matter, contact us at info@hyractech.com (see §12).
2. What we collect
We keep collection to a minimum. On this website that is:
| Data | When | Why |
|---|---|---|
| Name, work email, organisation, role, your message, and your consent | When you submit the contact form | To reply to your enquiry and, if relevant, scope a walkthrough or deployment |
| Aggregate, non-identifying page statistics (pages viewed, referrer, country, device type) | Automatically as you browse | To understand which content is useful — no cookies, no personal identifiers (see §4) |
| Server request logs (including a truncated/anonymised IP) held briefly by our host | Automatically | To serve the site securely and prevent abuse |
We do not ask for special-category data (health, ethnicity, etc.). Please don't include sensitive personal information in the contact form.
3. Why we use it & our legal basis
Under the UK/EU GDPR we rely on:
- Consent — for the contact form. You give it with the checkbox when you submit, and you can withdraw it any time by emailing us.
- Legitimate interests — to run and secure the website and to measure, in aggregate, which pages are useful. We've balanced this against your privacy; because our analytics are cookieless and non-identifying, the impact is minimal.
- Steps prior to a contract — where your enquiry is about a possible engagement, to respond and prepare a proposal.
4. Cookies & analytics
This site sets no advertising or tracking cookies and shows no cookie consent banner — because none is required. Our analytics are provided by self-hosted Plausible, which is cookieless, aggregate-only, and stores no personal identifiers or cross-site tracking. Because we host it on our own infrastructure, analytics data never passes to a third-party analytics company. Full detail is in our Cookie Notice.
5. Who we share it with
We never sell or rent personal data. We share it only with service providers ("processors") that help us run the website, each under a data-processing agreement and only for the purposes above:
| Processor | What it handles | Purpose |
|---|---|---|
| Netlify | Website hosting; server request logs (a truncated IP) | Serve the site securely |
| Self-hosted Plausible | Aggregate, cookieless page statistics (no personal data) | Site analytics — on our own infrastructure, not a third party |
| Our email provider | The email address and message needed to notify us of your enquiry and reply to you | Handle your enquiry |
When you use the contact form, your enquiry is received and stored on our own systems (it is not handled by Netlify); the providers above support hosting, analytics and email. We may also disclose data if required by law, or to protect our rights, users or the public.
6. International transfers
Some providers process data outside your country, including in the United States. Where we transfer personal data internationally, we rely on an appropriate safeguard — an adequacy decision, the EU–US Data Privacy Framework, or Standard Contractual Clauses — so your data keeps an equivalent level of protection.
7. How long we keep it
- Contact enquiries — kept only as long as needed to handle your enquiry and any resulting relationship, then deleted or anonymised. If nothing comes of it, we remove it within 24 months.
- Aggregate analytics — retained in non-identifying, aggregate form only; it can't be tied back to you.
- Server logs — kept briefly by our host for security, then rotated out.
8. Your rights
Subject to local law, you can ask us to: access the data we hold about you; correct it; delete it; restrict or object to its use; port it; and withdraw consent at any time. To exercise any of these, email info@hyractech.com and we'll respond within the time the law allows (usually one month). You also have the right to complain to your data-protection authority, though we'd appreciate the chance to help first.
9. How we protect it
The site is served over HTTPS. We limit who can access enquiry data, keep collection minimal, and choose providers with strong security practices. No method of transmission is perfectly secure, but we take reasonable measures to protect your information and will notify you and the relevant authority of a qualifying breach as required by law.
10. Children
This website is aimed at educators, organisations and adult learners. It isn't directed at children, and we don't knowingly collect personal data from children through it. Where Hyracbox is used with young learners, that happens through an organisation's own account and safeguarding arrangements, not this website.
11. Changes to this notice
We'll update this notice when our practices change and revise the "Last updated" date above. Material changes will be highlighted on this page.
12. Contact us
Questions, requests or complaints about privacy:
- Email: info@hyractech.com
- General enquiries: via our contact page
Hyracbox is a product of Hyrac Tech, in the family with HyracHub & SonzaHQ.