Privacy & Cookie Policy

1. Who is responsible

Midori Ventures Ltd, trading as Midoriweb, company number 17403819, is the controller of information we use to operate this website, manage enquiries and accounts, administer our customer relationships and run our business. Contact us at support@midoriweb.io or Avon House, Avonmore Road, Kensington, London, W14 8TS, United Kingdom. Please mark privacy requests “Privacy”.

Where we access personal data in a customer's website or systems solely to carry out that customer's instructions, we may act as a processor instead. The customer remains responsible for its controller decisions and privacy information; the agreed processing instructions and applicable data-processing agreement govern that work. If your request concerns a shop or website operated by one of our customers, contact that business first. We will assist it where required.

2. Information we handle

• Enquiries and bookings: your name, business, contact details, website address, project requirements, availability, correspondence and files you choose to supply.
• Accounts and orders: account identifiers, contact and billing addresses, order details, licence or service selections and account-security records. Passwords are handled through the account authentication system; do not send your account password in a message.
• Support and development: issue descriptions, platform and server information, screenshots, attachments, messages, agreed scope, access permissions, case events, engineering time and outcomes. These materials may contain information about your staff or customers if you include it.
• Secure access: temporary admin, server or other credentials that you choose to share in the dedicated vault after acceptance, together with access and expiry records.
• Billing: invoice and refund records, payment-provider references and payment/authorisation status. Payment forms send card details to the payment provider; our support case records do not store your full card number or card security code.
• Website and security: connection and device information, IP addresses and technical logs generated by hosting, account security and fraud/abuse prevention, plus cookies and browser storage described below.

Most information comes directly from you or your authorised colleagues. We also receive payment status from our payment provider and information from systems you authorise us to work on. Do not upload unnecessary personal data, special-category information or payment-card details. Remove or mask unrelated customer information in screenshots. Use temporary access accounts with the minimum permissions required.

3. Why we use information and our lawful bases

• Responding to requests, supplying services and administering an individual's order: taking steps at your request before a contract and performing our contract with you.
• Business-contact relationships, delivering work for corporate customers, managing support, improving reliability and resolving disputes: our legitimate interests in providing and administering services and communicating with the people involved, balanced against their rights.
• Securing accounts and systems, controlling abuse, keeping necessary operational records and investigating misuse: our legitimate interests in protecting customers, our services and our legal rights, and legal obligations where applicable.
• Accounting, tax records and responding to lawful requests: compliance with legal obligations.
• Optional marketing or optional device storage where consent is required: your consent. You can withdraw it without affecting processing already carried out lawfully. Where another lawful marketing route applies, you can still object or opt out.

We do not treat agreement to contractual terms as blanket consent to marketing. Service messages about your request, security, payment or contract are distinct from promotional messages. We do not use credentials supplied for a support case for advertising. We do not make decisions producing legal or similarly significant effects about you solely through automated processing in our custom enquiry and support workflow; staff review case acceptance. Payment providers may apply their own fraud checks under their privacy notices.

Some information is needed to respond, fulfil a contract or meet a legal requirement. If you do not provide it, we may be unable to create an account, accept work or process the relevant order. Optional fields can be left blank. We will explain a new materially different use where required.

4. Who receives information

Access is limited according to the work and responsibilities concerned. Authorised staff and contractors may access information needed for support, development, account administration or finance. Permission controls can restrict contact, billing and credential information, but they do not make a customer's website identity anonymous to the engineer working on it.

• Hosting, infrastructure and email providers process information to operate the site, deliver correspondence, maintain security and provide backups.
• Stripe processes current support payments and related billing, authorisation, settlement and fraud-prevention information under its privacy notice.
• Revolut may retain records of historical payments. It handles payment records including the billing and transaction information needed for authorisation, capture, refunds and fraud prevention. Its payment service has its own privacy information.
• Calendly provides consultation booking when you choose the booking feature. Opening it loads Calendly content and shares connection information with that provider; information entered into the booking form is handled under its privacy notice as well as the booking information received by us.
• Telegram is used for internal support-request alerts. Our custom alert contains the case reference, service category and an Admin link, rather than the submitted contact details, issue narrative or credentials. A reference can still relate to a person within our systems. Staff must open the authorised portal to review the case.
• Professional advisers, insurers, regulators and authorities may receive relevant information where necessary for advice, a claim or a legal obligation. Information may also be disclosed as necessary for a genuine business transfer, subject to appropriate safeguards.

We do not publish customer credentials or make support attachments publicly available as part of the service. Third-party providers may act as processors or as independent controllers for their own legal and service purposes. Their own notices explain those activities. If a particular project requires another provider or subprocessor to handle customer-system data, that arrangement must be addressed in the relevant project and processing terms.

5. International processing

Our providers and authorised personnel may process information in countries outside the UK. Where we arrange a restricted international transfer, we must use the appropriate lawful basis and safeguards, such as applicable UK adequacy arrangements or approved contractual safeguards with any necessary transfer assessment and additional measures. We do not claim that every provider stores all information in the UK. Contact us for information about the recipients, relevant locations and safeguards for your particular service, including how to obtain a copy where applicable.

6. Retention and security

We retain personal information for as long as reasonably necessary for its purpose, subject to applicable legal obligations, disputes and holds. The criteria differ by record:

• Enquiries: for responding, following up and keeping a necessary record of the discussion. Temporary delivery-queue copies are subject to configured cleanup; deleting a queue copy does not delete correspondence already delivered to a mailbox.
• Accounts and support/project records: while needed for the relationship, active work, support history and relevant contractual or legal claims. When assessing continued retention we consider the record's sensitivity, whether the relationship continues, statutory limitation periods and whether a smaller record would suffice.
• Invoices and payment records: for applicable accounting and tax requirements and necessary payment disputes. Account closure does not require deletion of records we must lawfully retain.
• Credentials: access through the secure vault is time-limited, normally 24 hours from submission as shown in the case interface. Expired or removed entries are unavailable through the vault; scheduled cleanup removes stored credential content, including after case closure. This is separate from retention of case/audit records and does not promise immediate erasure from every historical backup. Expiry does not revoke the original account on your system: revoke temporary access or change passwords when work finishes.
• Logs and backups: for the period needed for security, troubleshooting, recovery and applicable legal requirements. Copies in backups may remain until those backups are rotated or expire; they must remain protected and are not a substitute for a live marketing or customer database.

We use access controls, encrypted transport and encryption for the custom enquiry store and support vault/attachments, alongside operational safeguards appropriate to the service. No online system is risk-free. Please use strong account credentials, protect your devices and report suspected compromise promptly. We will handle security incidents and notifications as required by law. This notice does not claim that every administrator currently uses multi-factor authentication.

7. Cookies and similar browser storage

Magento uses cookies and browser storage to keep account sessions secure, manage a basket, protect forms, remember relevant preferences and refresh private account/cart information. These functions can involve session identifiers, form-security values and Magento customer-data storage. Duration varies by the function and configuration: some end with the browser session, while others remain until expiry, replacement or clearance. We do not present a standard Magento example-cookie list as a verified inventory of this installation.

The custom support form also uses session storage to preserve an unfinished request across sign-in within the same tab. Its application expiry is two hours; it is cleared after successful submission or when detected as expired or belonging to a different account. Closing the browser tab normally ends that session storage. Do not put passwords or unnecessary sensitive data into the triage form.

Booking and payment features can load their providers' content and technologies when you use them. Their notices explain their use. Optional analytics or advertising technologies must not be introduced on the assumption that this notice itself grants consent. Where consent is required, it must be obtained through an appropriate choice before those technologies operate; continuing to browse is not consent.

You can inspect or remove cookies and local/session storage in your browser's site settings and block third-party cookies where supported. Blocking essential storage may prevent login, checkout or form recovery. Browser controls are not a substitute for a site's duty to obtain consent where required. Contact us with any question about a cookie or request a current list for the feature you are using.

8. Your rights, contact and complaints

Depending on the applicable law and circumstances, you may request access to your personal information, correction, erasure, restriction or portability; object to processing based on legitimate interests; and withdraw consent where we rely on it. You can object to direct marketing at any time. These rights are not absolute: for example, some financial or claims records may need to be retained. We will explain any applicable restriction.

Send requests to support@midoriweb.io. We may need proportionate information to verify identity or understand a request. We normally respond within one month, subject to any lawful extension or adjustment, and normally do not charge a fee. You do not need to close an account to raise a privacy concern.

Please contact us if you think we have handled your information incorrectly. You also have the right to complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint or another competent data-protection authority where applicable. Our services are intended for adult business users, not directed at children. If you believe a child has supplied information unnecessarily, please contact us.

We will update this notice when our services or data handling change and draw attention to material changes where required. The date above identifies this version.