Privacy
Enquiry privacy notice.
This notice applies only to prospective member and partner enquiries submitted through the Sirra marketing site.
Controller
Imran Ali-Farzal is the data controller for this enquiry form.
Business address: 168 City Road City Road, Cardiff, Wales, CF24 3JEEmail: access@sirrahq.com
What we collect
We collect your name, email address and the information you choose to provide. Partner enquiries may also include an organisation, role, relationship type and website. We record the time you ask us to respond, the source page and a keyed fingerprint derived from your connection address to rate-limit repeated submissions. The rate limiter considers the most recent 15 minutes. We keep the fingerprint with the enquiry for bounded form-security investigation and recurring-abuse analysis, not to profile you or combine it with other Sirra data. It is not intended to identify you by itself.
Why and lawful basis
Where it is necessary to take steps at your request before entering a possible contract with you, we use that pre-contract basis. When it does not apply, including when you contact us for an organisation, we rely on our legitimate interests in considering and responding to genuine enquiries. We also rely on legitimate interests to keep a bounded record of how an enquiry was handled, maintain the form's security and protect it from misuse, including through the technical fingerprint and abuse controls. The form confirmation records your request for a response; it is not our data-protection consent basis. An enquiry does not create membership, partnership status, a Sirra account or a service mission.
Do you have to provide it?
You are not legally or contractually required to provide enquiry information. If you do not provide the required name, email and form confirmation, we cannot assess or respond to an enquiry through this form.
Who handles it
Vercel hosts the form and Railway stores enquiries on our behalf. An optional email provider may deliver notifications if that feature is enabled. Providers receive only the information required to perform their service. We do not sell enquiry information. Some processing may take place outside the UK; where a restricted transfer occurs, we use appropriate contractual safeguards, and you may ask us for details.
Retention and deletion
We delete an enquiry from the live database 180 days after receipt. If it remains active, we may extend retention once by up to a further 90 days, recording the reason and review date. A valid erasure request may result in earlier deletion. Backup copies are put beyond routine use and expire within 90 days; they are not used for another purpose.
Your rights
Depending on the circumstances, you may ask for access to, correction of, erasure of or restriction of your information and request portability. We may ask for proportionate evidence to confirm your identity. We aim to respond within 28 days after receiving the request or any information needed to confirm identity.
Your right to object
You may object at any time to processing based on our legitimate interests.
How decisions are made
We do not make a decision about your enquiry solely by automated processing where that decision would have a legal or similarly significant effect on you.
Contact and complaints
To ask a question or exercise a right, email access@sirrahq.com. You also have the right to complain to the Information Commissioner's Office.
Last updated: 20 August 2026.