Privacy & cookies

This notice is a preparation draft for the UK PmrOne market validation website. It is not approved for public collection. Use synthetic test data in the private preview.

Who is responsible?

[OWNER TO CONFIRM: controller legal identity, address, privacy contact and any applicable UK representative.] Privacy contact: [OWNER TO PROVIDE].

What we collect and why

The form asks for your first name, last name, email, mobile phone and primary use case, plus optional location, organisation, device needs, expected frequency and comments. Records include a submission ID, timestamp, page version, campaign attribution and consent choices. These are intended to help assess demand and manage registrations.

The necessity of each required field, including mobile phone, and the lawful basis for research and registration management must be confirmed by the owner before launch. Do not include sensitive or third-party personal information in comments.

Optional marketing

The email marketing checkbox is optional and unchecked. Registration does not authorise marketing calls or SMS. Marketing consent must be recorded and can be withdrawn without affecting earlier lawful processing. No communications are sent by this draft. The owner must establish an unsubscribe process before sending updates.

Storage, access and recipients

The proposed backend uses Sites-hosted Cloudflare D1 storage. Administrator exports require explicit server-side authorisation. Odoo, external webhooks and CRM integrations are inactive. The owner must review processor agreements, storage locations, security controls and any international transfer safeguards before public collection.

Retention and deletion

[OWNER TO SET: justified retention period or criteria, review schedule and deletion process.] Data should be deleted or anonymised when no longer necessary. No automatic retention policy is enabled in this draft. Deletion and consent-withdrawal requests must go to the confirmed privacy contact.

Your rights

Depending on the applicable lawful basis and circumstances, you may request access, correction, erasure, restriction, portability or object to processing. You may withdraw consent and complain to the Information Commissioner’s Office. The owner must provide a working rights-request channel and response procedure before launch.

Optional headline test

The page compares 2 headlines with equal-probability random allocation. With your permission, the first-party session cookie pmrone_ab stores a random session reference. The server records the assigned variant, consent timestamp and whether that session produces a new registration. The reference may be linked to your registration and is pseudonymous, not anonymous. It is not used for advertising.

The pmrone_measurement session cookie remembers your measurement preference. No experiment session is stored before opt-in. Declining still lets you view the page and use the form. Without measurement consent, any submitted registration may record the displayed headline variant but is excluded from measured conversion-rate comparisons. Forced variant preview links are excluded too.

Both cookies are session cookies without a fixed expiry date; browser session restoration may preserve them. Use Measurement preferences to withdraw future measurement and remove the experiment cookie. Withdrawal does not erase historical server records automatically. Server record retention and deletion procedures still require owner approval before public use.

Cookies and measurement

No Meta Pixel, Google Analytics 4 or non-essential advertising cookies are installed. Event hooks are prepared without external analytics delivery. Optional consent-based A/B measurement is stored in the Site database as described above. Campaign parameters in the page URL accompany form submission. Any future analytics or advertising installation requires a reviewed consent mechanism and an updated notice. Platform authentication and security may use essential storage; the owner must verify the platform cookie inventory.

Before launch

Confirm controller identity, privacy contact, lawful bases, retention, processors and international transfers; approve the notice; configure administrator access, unsubscribe and deletion processes; then explicitly enable public lead collection. This preview is not an offer to purchase or a promise of early access availability.