1 About this policy and who we are
Space Forge Limited ("Space Forge", "we", "us", "our") is the controller of the personal data collected through its website at www.spaceforge.com (the "website"). Our online store at store.spaceforge.com is a separate, access-controlled service that operates under its own privacy notice and is not covered by this policy. We build space factories to produce compound semiconductors in the space environment. Registered office: Unit 10 Eastgate Business Park, Wentloog Avenue, Cardiff, Wales, CF3 2EY. Company number: 11646188. Our group includes Space Forge Inc. (United States) and an office in Portugal. Where those entities process your personal data, they do so consistently with this policy. ICO registration: we are registered with the UK Information Commissioner's Office under reference ZA708132. Data Protection Officer: our Data Protection Officer is Andrew Bacon. You can contact the DPO at privacy@spaceforge.com. This policy covers personal data collected through the website. Personal data we process in other contexts - for example as an employer, or in our commercial and supplier relationships - is covered by separate notices.
2 Scope - which laws apply to you
Because our website is available internationally, more than one data protection law may apply depending on where you are. This policy is designed to meet each of them; where a specific law givesyou additional rights, the relevant section below applies to you.
• United Kingdom - the UK GDPR and Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR) for cookies and electronic marketing.
• European Economic Area - the EU GDPR and the ePrivacy rules, where we offer goods or services to, or monitor, individuals in the EEA (which our website analytics are capable of doing).
• United States - state privacy laws including the California Consumer Privacy Act as amendedby the CPRA ("CCPA"), and comparable laws in Virginia, Colorado, Connecticut, Utah, Texas and other states, where applicable to us. See section 10.
• Other jurisdictions - where the law of another country applies to our processing of your personal data, we honour the rights it gives you. See section 11
3 The personal data we collect, and why
We collect personal data in the situations set out below. For each, we describe what we collect, why, and - for UK/EU users - our lawful basis under Article 6 of the UK/EU GDPR.
Careers. Job vacancies on the website link through to our recruitment platform, Workable. Any application data you submit is collected on Workable and handled under our separate recruitment privacy notice, not through this website.
Special category data. Please do not include special category data (such as health, religion or ethnicity) in messages you send us. If you choose to provide it, we process it only as far as necessary to handle your enquiry.
4 Cookies and similar technologies
We use cookies and similar technologies on the website. Strictly necessary cookies - including ourform anti-abuse (Cloudflare Turnstile) and your cookie-consent preference - make the site work andare always active. Non-essential cookies, including analytics and any embedded third-party content, are only set after you consent through the cookie banner (provided by Cookiebot) shown on your first visit; we do not load non-essential scripts before consent is given. You can change or withdraw your choices at any time via the "Cookie settings" link on the website or your browser settings, and where required we honour browser-level signals such as Global PrivacyControl (GPC). For the full list of cookies, their purpose, provider and duration, see our Cookie Policy
5 Who we share your data with
We do not sell your personal data for money. We share it only as described here:
• Service providers (processors) who process personal data on our behalf, under contractand on our instructions, currently including: Webflow (website hosting and form handling,including Cloudflare Turnstile form anti-abuse provided through Webflow), Microsoft(Microsoft 365 - the mailbox that receives website enquiries), Google (Google Analytics andTag Manager), and Cookiebot / Usercentrics (cookie-consent management). Each is engaged under a written data processing agreement that meets Article 28 requirements. Processorsused by our online store are covered by the store's own privacy notice.
• Professional advisers (legal, insurance, accounting) where necessary.
• Authorities - regulators, law enforcement or others - where required by law, or to establish,exercise or defend legal claims.• Corporate transactions - a prospective buyer and its advisers in connection with anyreorganisation, merger or sale, subject to appropriate confidentiality.
6 International transfers
Some providers process personal data outside the UK and EEA, including in the United States (forexample Google and Webflow). Cookiebot (Usercentrics) is EU-based and processes consent datawithin the EEA. Microsoft (Microsoft 365) stores mailbox data in the UK/EU under its data-residencycommitments, but as a US-headquartered provider may access or transfer data internationally, forexample for support. Whenever we transfer personal data across a border, we rely on an appropriate safeguard:
• UK / EEA 'adequacy' regulations or decisions where they cover the destination;
• the EU–US Data Privacy Framework and its UK Extension where the recipient holds anactive certification covering the relevant transfer; and
• the UK International Data Transfer Agreement (or the UK Addendum to the EUStandard Contractual Clauses) with a transfer risk assessment, where no adequacy or Framework route is available.
Our current US providers - Google, Webflow and Microsoft - are certified under the Data PrivacyFramework, and we rely on it (including the UK Extension) where their certification covers the transfer;Microsoft additionally keeps mailbox data in the UK/EU under its EU Data Boundary. Webflow's formanti-abuse uses Cloudflare Turnstile as a Webflow sub-processor, covered by Webflow's own transfersafeguards. Because the Data Privacy Framework remains subject to legal challenge, we keep an IDTA / Standard Contractual Clauses fallback and a transfer risk assessment in place for material transfers, and periodically re-check each recipient's certification on the DPF list. You can ask us formore information about these safeguards using the contact details in section 15
7 How long we keep your data
We keep personal data only as long as necessary for the purposes above, then delete or anonymise it. Indicative periods:
8 Your rights (UK and EEA)
If UK or EU GDPR applies to you, you have the right:
• to be informed about how we use your data (this policy);
• to access a copy of your data;
• to have inaccurate data corrected;
• to have your data erased in certain circumstances;
• to restrict or object to processing in certain circumstances (including processing based on legitimate interests, and direct marketing at any time);
• to data portability; and
• to withdraw consent at any time where we rely on it (this does not affect processing already carried out).
To exercise any right, contact privacy@spaceforge.com. We may need to verify your identity. We respond within one month, though we may extend this for complex requests and will tell you if so. You can also complain to a supervisory authority. In the UK that is the ICO (ico.org.uk, helpline 0303123 1113, Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK95AF). In the EEA you may complain to your local data protection authority. We would appreciate the chance to address any concern first.
9 Automated decision-making
We do not make decisions producing legal or similarly significant effects based solely on automated processing through this website.
10 Your US state privacy rights
This section applies if you are a resident of a US state with an applicable privacy law (for example California, Virginia, Colorado, Connecticut, Utah or Texas). It supplements the rest of this policy.Some laws apply only where a business meets certain thresholds; we provide these disclosures where they apply to us.
Categories of personal information. In the last 12 months we may have collected the followingCCPA categories: identifiers (such as name, email, IP address); internet or network activity (browsing and interaction data); commercial information (store orders); and audio/electronic information (thecontent of your messages). We collect these from you directly and automatically through the website, and use them for the business purposes described in section 3.
Sale and sharing. We do not sell personal information for money, and we do not use advertising cookies. Our use of analytics cookies may involve "sharing" or a "sale" as broadly defined by certainstate laws (for example, sharing for cross-context behavioural advertising). Where that is the case, you can opt out via the "Cookie settings" link and we honour the Global Privacy Control browsersignal. We do not knowingly sell or share the personal information of anyone under 16.
Your rights:
• to know the personal information we collect, use, disclose and (where applicable) sell orshare;
• to access and to obtain a portable copy;
• to correct inaccurate personal information;
• to delete personal information, subject to legal exceptions;
• to opt out of any sale or sharing, and to limit the use of sensitive personal information; and
• not to be discriminated against for exercising these rights.
To exercise these rights, contact privacy@spaceforge.com. You may use an authorised agent. We will verify your request and respond within the time your state law allows (generally 45 days). Where your state provides a right to appeal a decision, you may appeal by replying to our response; if we deny the appeal you may contact your state Attorney General.
11 Other jurisdictions
If you are in a country whose data protection law applies to our processing (for example Canada,Australia, Brazil or others), we honour the rights that law gives you. Contact privacy@spaceforge.com and we will handle your request in line with the applicable law.
12 How we protect your data
We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss or misuse, and we require our service providers to do the same. No method of transmission or storage is completely secure, but we take reasonable steps to protect your information and keep our measures under review.
13 Children
The website is intended for a professional and general adult audience and is not directed at children. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.
14 Third-party links
Our online store at store.spaceforge.com runs on Shopify and operates under its own separate privacy notice; this policy does not cover it. The website also links to genuinely third-party sites andservices, such as our social media profiles. We are not responsible for the privacy practices of those third-party sites, and we encourage you to review their notices.
15 Changes and how to contact us
We may update this policy from time to time. When we do, we revise the "Last updated" date above and, where changes are significant, take reasonable steps to bring them to your attention. Questions, requests or complaints: privacy@spaceforge.com, or write to Space Forge Limited, Unit10 Eastgate Business Park, Wentloog Avenue, Cardiff, Wales, CF3 2EY.
