How ManageHex handles your information

This notice covers managehex.com. Information inside a ManageHex system that a venue runs for its own guests belongs to that venue: they decide what is held and for how long, and we handle it on their instructions.

• What you type into a form. The demo request and contact forms ask for your name, an email address, the kind of venue you run or the topic you are writing about, and your message. We use it to answer you and, if it leads somewhere, to arrange a demo and quote.
• Your email address, if you ask for the newsletter. Used to send the newsletter and nothing else.
• Which pages are read, if you allow it. A count of page views and demo requests per day, so we can tell which pages are worth keeping. This is off until you turn it on.

We do not buy information about you, we do not sell or rent what you give us, and we do not build a profile of you.

• Answering an enquiry: your consent, and steps taken at your request. You tick the consent box before a form will send, and answering you is the point of writing to us.
• Newsletter: your consent. You can withdraw it at any time by replying to any newsletter or writing to us, and we act on it rather than filing it.
• Analytics: your consent. Nothing is recorded until you choose to allow it, and choosing not to changes nothing else about the site.
• Keeping the site working: our legitimate interests. Blocking automated abuse of the forms, and keeping the records that show a message was received and answered. We use the least information that achieves it.

Where we rely on consent, withdrawing it is as easy as giving it, and does not affect anything done before you withdrew it.

There is deliberately nothing loaded from another company on these pages. The typefaces are served from this site rather than a font service, which would otherwise have received your IP address on every page you opened. The only outside content is a video player, and only on a page where a video has been embedded.

If that ever changes, this section changes with it before the service goes live, and anything we are legally required to hand over, we will hand over.

If you need to know the country a particular record is held in before you make a request, ask us and we will tell you. Where information is transferred outside the UK or the European Economic Area, we do it only with the safeguards the UK GDPR and the EU GDPR require.

• mhx_consent, set by this site, kept for six months. It records whether you allowed analytics, so we do not ask again on every page. The same answer is kept in your browser's local storage as a fallback.

That is the whole list for a visitor. There are no advertising cookies, no third-party cookies and nothing that follows you to another website. Signing in to the operator area sets a session cookie, but only for the person signing in.

You can change your answer at any time from the cookie link in the corner of the page, or clear the cookie in your browser. Refusing analytics leaves every part of the site working.

To count returning visitors separately from new ones without knowing who you are, your IP address is turned into a one-way value using a secret held on our server, and only that value is stored. The address itself is never written down, and the stored value cannot be turned back into it by anyone who does not hold the secret. No user agent, no device identifier, no cross-site identifier and no profile.

We do not use Google Analytics or any similar service, so nothing about your visit reaches another company.

• tell you what we hold about you, and give you a copy;
• correct anything that is wrong;
• delete it;
• stop using it for a while, or object to a use we base on our legitimate interests;
• send it to you, or to someone else, in a portable form, where that right applies;
• withdraw a consent you gave.

Ask through the contact page, choosing the privacy or data request topic. We answer within one month and will not charge you for it. If we cannot do what you asked, we will tell you why.

If you are unhappy with how we have handled it you can complain to a data protection regulator: in the UK that is the Information Commissioner's Office, and in the EU it is the authority for the country you live in. We would rather you told us first so we can put it right.

To come off the newsletter, reply to any newsletter, or ask through the contact page, and the address is removed from the list rather than marked as inactive. To remove an enquiry, tell us the email address you used and we will delete the message and our record of the reply.

Analytics counts contain nothing that points to you, so there is nothing in them to delete individually. They expire on their own after 120 days.

What survives a deletion request is only what the law requires us to keep, plus a note that the deletion was asked for and carried out, so we can show it was done. If a venue runs ManageHex for its own guests, ask that venue, because the information is theirs and we act on their instructions.