Privacy Policy

Last updated: 28 September 2026

Who we are

Made Purple Ltd is a company registered in England and Wales under company registration number 11151840, with its registered office at Keystone Innovation Centre, Croxton Road, Thetford, Norfolk, IP24 1JD. For the personal information described in this policy, Made Purple Ltd is the data controller.

What this policy covers

This policy covers madepurple.com and the enquiries you send us through the website, by email or by phone. It does not cover our products. When our products are deployed in a prison, hospital or other organisation, that organisation is usually the data controller and we process data on its behalf under contract. Each product has its own privacy notice, for example the Purple Visits privacy policy (opens in new window).

Information we collect

When you use our contact form

We collect the information you enter:

• your name and email address
• your organisation and sector, if you choose to give them
• your message and anything else you include in it

Please do not include sensitive information in your message, such as health details or information about someone in custody. We do not need it to answer a general enquiry. If your question is about a specific visit, call or account, contact the support team for that product instead.

When you email or call us

We keep your contact details and a record of the conversation so that we can respond and follow up.

When you browse the website

We do not use analytics, advertising or tracking tools on this website and we do not build a profile of your visit. Like any website, the servers that deliver our pages receive technical information from your browser, such as your IP address, browser type and the page requested. This is used only to deliver the site and to protect it from attacks.

How we use your information and our legal basis

• Responding to your enquiry and any follow-up conversation. Our legal basis is our legitimate interest in responding to people who contact us (Article 6(1)(f) UK GDPR), or taking steps at your request before entering into a contract (Article 6(1)(b)).
• Sending you a copy of your message so you have a record of what you sent. This is part of responding to your enquiry.
• Keeping the website secure and available, including filtering spam and malicious traffic. Our legal basis is our legitimate interest in running a secure website (Article 6(1)(f)).

We do not add you to a mailing list because you contacted us, we do not sell your information and we do not use it for automated decision making or profiling.

Who we share your information with

Only authorised Made Purple staff can access your enquiry. We use a small number of service providers who process information on our behalf and only on our instructions:

• Cloudflare, Inc. hosts this website and processes technical information to deliver pages and block malicious traffic.
• Postmark (ActiveCampaign, LLC) delivers contact form messages to our team and sends you a copy of your message.
• Our email provider stores enquiries in our inbox so that we can reply.

We may also share information where the law requires it, for example to comply with a court order or to prevent fraud.

International transfers

Some of our service providers are based in, or may process data in, the United States. Where personal information leaves the UK we make sure it is protected by an approved safeguard, such as the UK Extension to the EU-US Data Privacy Framework or the International Data Transfer Addendum to the European Commission's standard contractual clauses.

How long we keep your information

We keep enquiries for up to two years after our last contact with you, then delete them. If your enquiry leads to us working together, we keep the relevant correspondence for as long as the contract runs and for six years afterwards to meet our legal and accounting obligations. Our service providers keep technical logs and sent message records for a limited period in line with their own retention settings.

Cookies

This website does not use analytics, advertising or tracking cookies, so we do not ask for cookie consent. Our hosting provider may set a strictly necessary security cookie if it needs to check that traffic is coming from a real browser rather than an automated attack. This cookie does not identify you and is not used for any other purpose.

How we protect your information

Made Purple is certified to ISO 27001 and Cyber Essentials Plus. The website is served only over encrypted connections and contact form messages are sent directly to our team without being stored in a website database. You can read more on our security page.

Your rights

Under UK data protection law you have the right to:

• ask for a copy of the personal information we hold about you
• ask us to correct information that is wrong or incomplete
• ask us to delete your information
• ask us to restrict how we use your information
• object to us using your information on the basis of legitimate interests
• ask for information you gave us to be sent to you or another organisation in a machine-readable format

To use any of these rights, email [email protected] or write to us at the address below. We may need to confirm your identity before acting on a request, and we will respond within one month.

Contact us

Questions about this policy or how we handle your information can go to our Data Protection Officer at [email protected], on +44 (0)1842 558 121 or by post:

Complaints

If you are unhappy with how we have handled your information, please tell us first so that we can put it right. You also have the right to complain to the Information Commissioner's Office, the UK's independent regulator for data protection, on 0303 123 1113, at ico.org.uk/make-a-complaint (opens in new window) or by post:

Changes to this policy

We review this policy regularly and will update it if the way we handle personal information changes. The date at the top of the page shows when it was last updated.