Privacy Policy

22 September 2026 · STRATOVA LTD · stratova.work

This privacy policy explains how STRATOVA LTD (“Stratova”, “we”, “us”) handles personal data when you use https://stratova.work and when you contact us about computer systems design, media streaming platforms, telecommunication solutions, custom software, cloud and high-load architecture, or related services. It is written for visitors, prospective clients, and people who correspond with us. It is not a description of every system we might later build for a client. If we process personal data on a client’s instructions inside a platform we have engineered, that processing is governed by the contract and instructions for that engagement, not by this website policy alone.

We operate from 128 City Road, London, EC1V 2NX, United Kingdom. You can reach us about privacy at contact@stratova.work or by telephone on +44 7537 194820. Please use the email address if you want a written record. This policy is meant to be read with our cookie policy, which describes the very limited storage used by the site itself.

1. Who is responsible

For personal data collected through this website and through ordinary business correspondence with Stratova, STRATOVA LTD is the controller. That means we decide why the data is needed and how it is used. We do not appoint the website as a separate controller. There is no user account system, no advertising network, and no separate marketing company standing behind the form.

When a client later asks Stratova to design, build, integrate, or monitor a system that processes that client’s own customers or staff, the client is usually the controller of that operational data and Stratova is a processor, or in some cases a separate controller for limited security and billing records. The role is stated in the relevant agreement. Do not assume that this website policy authorises Stratova to use a client’s end-user data for Stratova’s own purposes. It does not.

We have not published a company registration number on this website. If you need statutory company details for a formal notice, write to contact@stratova.work or to 128 City Road, London, EC1V 2NX, United Kingdom, and we will respond with the details we are required to give you. We will not invent identifiers in this policy.

2. The data this website actually collects

The site is a set of informational pages and a contact form. It does not ask you to create a profile, upload identity documents, or pay online. The personal data we are likely to receive falls into a short list.

Data you send us

If you use the contact form, we receive the name you type, the email address you type, and the message you type. Those fields are required because we cannot answer an anonymous note in any useful way and because we need a return address. Please do not include special-category data in a first message unless you genuinely need to. Special-category data includes information about health, ethnicity, religion, trade-union membership, sexual life, genetic or biometric data, and similar sensitive matters. A project enquiry about streaming, telecommunications, or high-load architecture almost never needs it. If you include it anyway, we will use it only to the extent we must in order to read and reply, and we may ask you not to send more of it.

If you email contact@stratova.work directly, or if you call +44 7537 194820, we receive whatever you choose to say, plus the technical identifiers that come with email or telephony, such as your address, the time of the message, and, for a call, the number presented to us. We do not record calls as a standard feature of this website. If a call were recorded, we would tell you at the start of the call.

Data generated by visiting the site

Like most sites, the server that hosts stratova.work can keep logs. A typical log line contains your IP address, the date and time, the URL you requested, a status code, the amount of data sent, the referring page if your browser supplied one, and the user-agent string, which describes the browser and operating system. We use logs to keep the site available, to diagnose faults, and to investigate abuse such as attempts to misuse the form. We do not use logs to build a marketing profile, and we do not sell them.

The pages load typefaces from Google Fonts. When your browser requests those files it contacts fonts.googleapis.com and fonts.gstatic.com. Google receives the technical data needed to deliver the files, which can include your IP address and user agent. We do not receive a copy of Google’s font logs as a matter of course. Google’s own privacy information describes that processing. If you block third-party font requests, the site remains usable with fallback typefaces.

Data we do not collect through the site

We do not run analytics pixels, advertising cookies, social plug-ins, or embedded video players on these pages. We do not ask for payment card numbers. We do not operate a newsletter signup. We do not knowingly collect data about children. The portfolio descriptions on the site are accounts of the kinds of systems Stratova is prepared to deliver. They are not dossiers about identifiable clients, and you should not read them as such.

3. Why we use personal data, and the lawful basis

UK data protection law requires a lawful basis for each purpose. The bases we rely on for this website are straightforward.

We use contact details and message content to answer you and to take steps you ask for before a contract. If you are writing on behalf of an organisation about a possible engagement, the lawful basis is steps taken at your request prior to entering a contract, together with our legitimate interest in understanding whether we can do the work. If you are writing only to ask a question about the company, we rely on legitimate interests: responding to people who contact a business at the address it publishes. You can object to processing based on legitimate interests, as described later. We will stop unless we have a compelling reason to continue, such as a need to keep a record of a dispute.

If an enquiry becomes an engagement, we use the relevant contact and project data to perform the contract, to invoice, to provide support that has been agreed, and to keep the records a services business must keep. That later processing is described in the contract. It can include ordinary commercial categories such as statements of work, technical notes, access arrangements, and correspondence. It should not be confused with a right to browse a client’s customer database for our own curiosity. Access to client systems is limited to what the work requires.

We use server logs and basic security records because we have a legitimate interest in keeping the website and our mailboxes reliable and in resisting misuse. Where the law requires us to keep a record, for example a tax record arising from a paid engagement, we keep it to comply with a legal obligation. We do not rely on consent for the contact form. Sending the form is the request. We do rely on a local browser preference, stored in localStorage rather than a cookie, so that the short notice about storage is not shown on every page after you dismiss it. That preference is not used to identify you across sites.

We do not use your data for automated decision-making that produces legal or similarly significant effects. We do not score visitors. We do not sell personal data. We do not buy lists of prospects and match them to people who happen to open the site.

4. Consulting, engineering, and support engagements

Stratova’s work can include IT consulting, custom software development, cloud and high-load architecture, media streaming platforms, social and media networks, telecommunication solutions, network infrastructure management, data analytics and OTT services, cybersecurity and data protection, enterprise API integration, and system support and monitoring, including 24/7 cover where that cover is contracted. Those services often involve personal data that never touches this website.

Examples include account identifiers inside a platform, entitlement records, support tickets, logs from a delivery system, and contact details of a client’s technical staff. When that data is the client’s, the client decides the purpose. Stratova follows documented instructions, applies the security measures written into the agreement, and does not repurpose the data for a Stratova product. If we believe an instruction would break UK data protection law, we will tell the client and pause the relevant action until the instruction is clarified.

Cybersecurity and data protection work can require us to see configurations, access lists, and sometimes samples of logs that contain IP addresses or user identifiers. We ask for the minimum sample that lets us do the task. We do not need a full production export of a user base in order to discuss an architecture. If a fuller export is genuinely required, the agreement should say so, including where the export will sit and when it will be deleted.

Support and monitoring, including round-the-clock cover, can mean that on-call engineers see operational alerts. Alerts should be designed so they do not dump unnecessary personal data into a chat channel or a mailbox. Where a client’s existing alerts do that, part of the work may be to reduce it. Until they are reduced, we handle what we receive as confidential client data.

5. Who we share data with

We do not sell, rent, or exchange contact-form submissions. We share personal data only in the limited ways below.

The contact form is handled by a script on this website, contact.php, which sends the message by email to contact@stratova.work. The hosting provider that serves the website and relays that mail therefore processes the submission on our behalf, as do the providers that host our mailbox. They are processors or service providers. We do not name a hosting brand in this policy because the commercial hosting arrangement can change, and naming a vendor incorrectly would be worse than describing the role. You may ask us which host and mail provider we use at the time of your request, and we will tell you.

Google receives the technical request for font files, as described above. That is a separate processing activity by Google when your browser calls Google’s servers. We do not send the contents of the contact form to Google.

We may share information with professional advisers such as solicitors or accountants if a matter requires it, under duties of confidentiality. We may share information with insurers if a claim or notification requires it. We may disclose information if a law, a court, or a competent regulator requires it, including the Information Commissioner’s Office where that is the lawful route. We may disclose information if we reorganise the business, but a recipient would have to honour this policy or an equivalent protection for website and enquiry data.

We do not permit those parties to use enquiry data for their own advertising. If we engage a sub-processor for a client project, the client agreement describes that chain. Website hosting for stratova.work is not a licence for a host to mine messages.

6. International transfers

We are based in the United Kingdom and we intend ordinary correspondence to be handled in the UK. Some infrastructure may still involve a transfer. Font requests to Google can result in processing outside the UK, including in the United States, under Google’s arrangements. A hosting or email provider may also locate backups or support staff outside the UK.

Where we transfer personal data outside the UK and the destination is not covered by UK adequacy regulations, we use a lawful transfer mechanism. For vendors that offer it, that is typically the UK International Data Transfer Addendum or the equivalent contractual clauses the vendor makes available to business customers, plus any supplementary measures that are actually available to a company of our kind. We will not claim that a transfer is risk-free. We will tell you, on request, the category of safeguard we rely on for a given vendor.

Client project data is transferred only as the client agreement allows. If a client requires UK-only hosting for a platform, that requirement has to be written into the design and the contract. It is not implied by this website policy.

7. How long we keep data

We keep personal data only for as long as the purpose requires, then we delete it or anonymise it so that it no longer identifies you. The periods below are our working rules for the website and for ordinary enquiries. A signed contract can set a different period for project records.

Contact-form messages and the emails they generate are kept for the time needed to respond and to handle any immediate follow-up. If the conversation does not become an engagement, we aim to delete or fully archive-and-restrict the thread within twenty-four months of the last message. We may keep a shorter record of the fact that we replied, without the body of the message, if we need to show that a request was handled. If you ask us to delete an enquiry sooner and we have no duty to keep it, we will delete it.

If an enquiry becomes a contract, contact and project records are kept for the life of the contract and then for as long as we need them to meet legal, tax, and professional duties, or to deal with a claim that could still be brought. Tax records are often kept for at least six years after the relevant financial year. Some technical deliverables and correspondence may need to be kept for a similar period so that we can explain what was built if a dispute arises. We do not keep production exports of a client’s user base “just in case” after the task that required them is finished.

Server logs are kept for a shorter operational window, typically between thirty and ninety days, unless a log has been copied into an incident file because we are investigating abuse or a fault. Incident files are kept until the incident is closed and for a limited period afterwards if we need to show what happened. Font requests are not stored by us as a separate dataset.

The localStorage item named stratova-notice remains in your browser until you clear site data. We cannot delete it from our side because it never reaches our server. Instructions are in the cookie policy.

8. Security

We take security seriously because the subject of the business is systems that have to stay available and intelligible. The website itself is a simple publishing surface, and we describe it that way. We expect the site to be served over HTTPS so that form submissions are encrypted in transit. We keep the contact script limited to validation and mail. We do not store form posts in a database on the website. We strip line breaks from header fields so that a message cannot be turned into an extra email header.

No internet service is free of risk. A mailbox can be attacked. A host can have an outage. A person can mis-address an email. We reduce those risks by limiting who reads contact@stratova.work, by avoiding unnecessary copies, and by not asking the form for data we do not need. We do not publish a claim that the website is impenetrable, and we do not publish uptime figures for stratova.work.

For client systems, security measures are those agreed in the design and the contract: access control, separation of environments, logging appropriate to the service, and handling of secrets. Those measures vary. A streaming platform and a consulting note do not carry the same exposure. If you are asking us to look at cybersecurity and data protection, say so in the message and avoid pasting live credentials into the form. Send secrets through a channel we agree, not through the public form.

If we become aware of a personal-data breach that affects website enquiries or other data we control, we will assess the risk and, where the law requires, notify the Information Commissioner’s Office and the affected people. If the breach concerns data we process for a client, we will notify the client on the timetable in the agreement and in data protection law.

9. Your rights

If UK data protection law applies to you, you have the rights described in this section. They are not absolute. We may refuse or limit a request where the law allows us to, for example where a request is manifestly unfounded, where it would disclose another person’s data, or where we must keep a record for a legal claim. We will explain the reason unless the explanation itself would cause harm.

Access

You can ask for a copy of the personal data we hold about you, and for certain information about how we use it. For a website enquiry this is often the message thread. We may ask you to prove you are the person the email address belongs to, because handing a thread to the wrong person would be its own breach. We aim to respond within one month. If a request is complex, or if you make several requests, we may extend that period by up to two further months, and we will tell you within the first month if we do.

Correction

You can ask us to correct inaccurate personal data. If you spelled a name wrongly in the form, tell us and we will correct the thread we still hold. We will not rewrite historical technical logs that were accurate at the time, but we can add a note where that is the right fix.

Erasure

You can ask us to delete personal data in the cases the law describes: the data is no longer needed, you withdraw consent where consent was the basis, you object and we have no overriding ground, the data has been used unlawfully, or deletion is required by a legal duty. Erasure is not available where we must keep the data to comply with the law or to establish, exercise, or defend legal claims. A request to delete a message that is also a contractual record may therefore be narrowed to the parts we can delete.

Restriction

You can ask us to restrict processing while a dispute about accuracy or an objection is unresolved, or where we no longer need the data but you need it for a legal claim. Restricted data is stored and not used, other than with your consent, for legal claims, to protect another person’s rights, or for reasons of important public interest.

Objection

Where we rely on legitimate interests, you can object. We will stop unless we can show compelling legitimate grounds that override your interests, rights, and freedoms, or unless we need the data for legal claims. You can object to direct marketing at any time. We do not run a marketing mailing list from this website. If we ever wrote to you about services without you asking, you could tell us to stop and we would stop.

Portability

Where processing is based on consent or on a contract, and is carried out by automated means, you can ask for the data you provided in a structured, commonly used, machine-readable format, and you can ask us to transmit it to another controller where that is technically feasible. A free-text email enquiry is already in a portable form. Portability does not require us to hand over our own analysis or another person’s data.

Complaint

You can complain to us first, at contact@stratova.work. You can also complain to the Information Commissioner’s Office, the UK regulator for data protection. The ICO’s website is https://ico.org.uk and the ICO can be contacted at Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. We would like the chance to put something right before a complaint, but you are not obliged to wait.

If you are in the European Economic Area and the GDPR applies to a particular processing activity, you may also have the right to complain to a local supervisory authority. The practical contact for this website remains contact@stratova.work, because that is the mailbox we read.

10. Children

The website is a business-to-business site about high-load systems, streaming platforms, and telecommunications. It is not directed at children and we do not knowingly collect personal data from anyone under 18 through the form. If you believe a child has sent us personal data, email contact@stratova.work and we will delete what we can identify.

11. Links and third-party sites

Pages may link to the ICO or to other public resources. Those sites are not operated by Stratova. If you follow a link, their privacy notice applies. We also do not control Google’s font infrastructure beyond the decision to request the typefaces. Blocking or allowing that request is a choice in your browser.

12. Cookies and similar storage

The detailed account is in the cookie policy. In short, the site does not set analytics or advertising cookies. A small script stores a flag in localStorage under the key stratova-notice after you press Continue on the notice, so the notice stays dismissed. That flag does not contain your name. Server logs, described above, are not cookies, but they are personal data when they contain an IP address. You can control cookies through your browser even though this site’s own pages are not built around them. If we introduce a non-essential cookie later, we will update the cookie policy and ask before setting it.

13. Your choices in the browser

You can browse the site without sending the form. You can block third-party requests and the pages will still convey their text. You can clear localStorage for stratova.work and the notice will appear again. You can use the telephone number if you prefer not to send a written message, understanding that a call still shares your number and what you say. You can ask us not to keep an enquiry. None of these choices affects statutory rights you already have.

14. Changes to this policy

We will update this policy if the site starts to collect new categories of data, if we change hosts in a way that matters to your rights, or if the law changes. The date at the top will change when we do. For website visitors, the updated policy applies from the date we publish it. For an existing client, the contract prevails if it conflicts with a later website policy, unless the law requires otherwise. We will not silently expand the contact form into a marketing database.

15. Other people mentioned in your message

Enquiries sometimes name colleagues, vendors, or end users. If you include another person’s name, role, or contact details, you should have a proper reason to share them and, where fairness requires it, you should tell that person you have done so. We will use those details only to understand and handle the enquiry or the later engagement. We do not add them to a mailing list. If a named person contacts us and asks what we hold, we will consider that request in the same way as any other access request, which may mean we tell you that we have received it if the data is mixed with yours.

Please do not send us a spreadsheet of your customers “for context” in a first email. A description of volumes, data types, and constraints is enough to start. If a later phase genuinely needs sample records, we will agree the sample size, the transfer method, and the deletion point before you send it. That discipline matters for streaming platforms and social or media networks, where production data can include account identifiers, device data, and viewing or entitlement events. It matters equally for telecommunication solutions, where a sample can include numbers, addresses, or session metadata.

16. Business contacts and suppliers

We keep ordinary business contact details for people we correspond with: a name, a role, an email address, a telephone number, and notes of what was discussed. The lawful basis is legitimate interests in running a professional services business, or contract where the person is dealing with us under an agreement. We do not buy contact lists. If a supplier processes personal data for us, such as a mailbox host, we expect a written commitment that covers confidentiality, security, and deletion when the service ends. We review those commitments when we change provider, not on a decorative annual cycle that produces no decision.

Staff and contractors who read contact@stratova.work are limited to people who need the mailbox for the work. We do not publish individual staff names on the website because this policy should not invent a team roster. If you need a named correspondent for an ongoing project, that name will appear in the engagement correspondence, not in a public biography we have not been given.

17. Marketing and PECR

The Privacy and Electronic Communications Regulations sit alongside data protection law for electronic marketing. This website does not drop marketing cookies and does not invite you into an automated campaign. If we send a service message about an enquiry you started, that is not marketing. If we ever wanted to send electronic marketing to an individual subscriber, we would need the consent or the limited “soft opt-in” conditions the regulations describe, and we would offer a simple way to refuse. Corporate subscribers can be contacted with a legitimate-interest analysis and a clear opt-out, but that is not a practice we run from page views of stratova.work. Visiting a page about high-load architecture is not a request for a newsletter.

We do not use the contact form as a hidden mailing-list join. The button sends one message. It does not tick a subscription. If a colleague later replies from the same thread with something you did not ask for, tell us and we will confine the thread to the request.

18. Accountability, records, and requests from authorities

We keep this policy, the cookie policy, and our correspondence as the core record of website processing. For a small informational site the record does not need to pretend to be a multi-volume compliance manual. It does need to be accurate. The purposes, categories, recipients, transfers, and retention rules in this document are that record for website data. Project processing records live with the relevant agreement and instructions.

If a police force, a court, or a regulator asks for personal data, we check that the request is lawful, we disclose what is required and no more, and we record what left our hands. We do not hand over a mailbox because a message sounds urgent and unofficial. If the law prevents us from telling you about a request, we will follow the law. If it does not, we will usually tell you unless doing so would put someone at risk or undermine the request.

We do not recognise “do not track” browser signals with a special server-side profile, because we do not track visitors with analytics in the first place. Sending the signal still does no harm. Blocking cookies in the browser will not break the contact form. The form is a POST request, not a cookie-dependent session.

19. How to contact us about privacy

Write to contact@stratova.work with the subject “Privacy” or post a letter to STRATOVA LTD, 128 City Road, London, EC1V 2NX, United Kingdom. You may also call +44 7537 194820. Tell us what you want, which email address you used, and roughly when you wrote, so that we can find the right thread without searching more widely than we should. If you are writing on behalf of someone else, we will need evidence that you may act for them.

We will not charge a fee for a reasonable request. If a request is manifestly unfounded or excessive, we may refuse it or charge a reasonable fee for the administrative cost, as the law allows. We will tell you if we take that view.

This policy is provided so that you can understand a real, limited set of practices. It is not a promise that every future platform Stratova builds will process data in the same way. Those platforms follow their own instructions, their own notices where a client must provide one, and the agreement that commissions the work.