Privacy Policy

1. Who we are

UFLIX Ltd, trading as Hiway, is the data controller for the personal data described in this policy. That means we decide what is collected and why, and we are responsible for looking after it.

Company details:UFLIX Ltd t/a Hiway
Registered in England and Wales, company number 15270826
Bartle House, Oxford Court, Manchester, M2 3WQ

Contact for data protection:[email protected]. Write to us here about anything in this policy, including any of the rights set out in section 9.

ICO registration:UFLIX Ltd is registered with the Information Commissioner’s Office. Registration number to be confirmed.

2. What this policy covers

This policy covers the public marketing website at onthehiway.com: the pages you can read without signing in, and the enquiry forms on them.

It does not cover the Hiway platform, which is a separate application at a different address. That service holds your account, your content and your customers, uses cookies to keep you signed in, and processes payments through Stripe. Its own terms and privacy notice apply once you sign in.

3. The personal data we collect

We collect very little from this website, and most visitors give us nothing at all.

If you submit an enquiry form:Your name, email address, company, website address, the type of enquiry you select, and whatever you write in the message field. You choose what to put in these fields.

If you subscribe to updates:Your email address.

When you simply read a page:Our analytics record that a page was viewed, which site referred you, and a coarse country and device type. This is aggregated and cookieless. Your IP address is used momentarily to derive the country and is then discarded, not stored. Nothing is kept that would let us recognise you on a later visit, or link one page view to another.

Server logs:Our hosting provider records standard web server logs, which include IP addresses, in order to serve pages and to detect abuse.

What we do not collect:We do not buy personal data, we do not scrape it, we do not build advertising profiles, and we do not use cookies, web beacons or device fingerprinting on this website. There is no automated decision-making or profiling that produces legal or similarly significant effects, within the meaning of Article 22.

4. Why we use it, and our lawful basis

UK GDPR requires us to have a specific lawful basis for each purpose. Ours are set out below.

To answer your enquiry.Purpose: replying to you, arranging a demonstration, and the conversation that follows. Lawful basis: taking steps at your request before entering into a contract, and our legitimate interests in responding to people who ask us to. Article 6(1)(b) and 6(1)(f).

To follow up about Hiway.Purpose: telling you about the product after you have contacted us or asked for updates. Lawful basis: our legitimate interests in marketing to a business contact who approached us, and where required, your consent. You can opt out at any time, in every message we send and by emailing us. Article 6(1)(f) and 6(1)(a).

To understand how the site is used.Purpose: seeing which pages are read and which are ignored, so we can improve them. Lawful basis: our legitimate interests in running and improving our own website. Because the analytics are cookieless and aggregated, this has a very low impact on your privacy, which is why we consider the balance to fall in favour of processing. Article 6(1)(f).

To keep the site working and free of abuse.Purpose: server logs, and the spam checks on our forms. Lawful basis: our legitimate interests in the security and availability of our own service. Article 6(1)(f).

To meet our legal obligations.Purpose: responding to lawful requests, and keeping records we are required to keep. Lawful basis: compliance with a legal obligation. Article 6(1)(c).

We do not collect special category data through this website, and we ask you not to send any in a message field.

5. Who we share it with

We do not sell personal data, and we do not share it with advertising networks. We use a small number of service providers, who process data on our instructions under a written contract.

Slack Technologies:Enquiries you submit are delivered into our internal Slack workspace so that a person sees them and replies. Slack acts as our processor.

Railway:Hosts this website. Their servers handle the requests your browser makes, including your IP address, in order to deliver pages.

Plausible Analytics:Provides the cookieless analytics described above. Plausible is an EU company and processes the data on servers in the European Union.

We may also disclose data where we are legally required to, or in connection with a merger, acquisition or sale of assets, in which case we will tell you before your data becomes subject to a different policy.

6. Where your data is held

Analytics data is processed within the European Union.

Some of our providers are based in, or store data in, the United States. Where personal data leaves the UK, we rely on the UK extension to the EU-US Data Privacy Framework where the provider is certified under it, or on the International Data Transfer Addendum to the European Commission’s standard contractual clauses. You can ask us which applies to a particular provider.

7. How long we keep it

We keep personal data only as long as we need it for the purpose we collected it for.

Enquiries and demo requests:Twenty-four months from our last contact with you, after which we delete them, unless you have become a customer and a longer period applies under the platform’s own terms.

Marketing contacts:Until you opt out, and then we keep a minimal record of the fact you opted out so that we do not contact you again by mistake.

Analytics:Held only in aggregate. It contains no personal data and there is nothing in it to delete.

Server logs:Retained by our host for a short period for security and diagnostics, then deleted.

8. Code and services running on this website

This section lists every piece of third-party code this website loads. It is written from the site’s source, not from a template, and is kept in step with it.

Plausible AnalyticsThe only analytics on this site, loaded from plausible.io. Cookieless, no fingerprinting. It records the page visited, the referring site, and a coarse country and device type. Used to see which pages are read and which are ignored. There is no Google Analytics, no Google Tag Manager, no Meta Pixel, no LinkedIn Insight Tag and no Hotjar on this site.

Custom eventsAlongside page views, Plausible records a small number of named actions: opening the demo form, submitting it, and clicking through to sign up. These are counts only. They carry no name, email address or form content.

Enquiry formsSubmitted to our own server, then forwarded to our internal Slack workspace. Used only to reply to you and to follow up about Hiway.

Spam protectionForms include a hidden field that people do not see and bots tend to fill in, and a short-lived token issued when the form opens. Both are used to reject automated submissions. Neither tracks you, and there is no third-party CAPTCHA on this site.

Fonts and imagesTypefaces and images are served from this website, not from Google Fonts or any other third party, so loading a page makes no request to anyone else for them.

Cookies and local storageThis website sets no cookies of its own and stores nothing in your browser’s local storage. That is why you are not asked to accept cookies when you arrive. The separate cookies policy explains this in full. If we later add advertising or retargeting cookies, we will ask for your consent first and update this policy and the cookies policy before switching them on.

9. Your rights

Under UK GDPR you have the following rights. They are free to use, and we will respond within one month. To use any of them, email [email protected].

Access.You can ask for a copy of the personal data we hold about you, and an explanation of what we do with it. Article 15.

Rectification.You can ask us to correct anything inaccurate, or complete anything incomplete. Article 16.

Erasure.You can ask us to delete your personal data where we no longer need it, or where you withdraw consent and there is no other basis for keeping it. Article 17.

Restriction.You can ask us to pause our use of your data while a dispute about its accuracy or our basis for holding it is resolved. Article 18.

Portability.Where we process data you gave us by automated means on the basis of consent or a contract, you can ask for it in a common machine-readable format, or ask us to send it to someone else. Article 20.

Objection.You can object to processing we carry out on the basis of legitimate interests, and we will stop unless we can show compelling grounds that override your rights. You can object to direct marketing at any time and we will always stop. Article 21.

Withdrawing consent.Where we rely on your consent, you can withdraw it at any time. That does not affect anything we did before you withdrew it. Article 7(3).

We may need to confirm who you are before acting on a request, so that we do not disclose your data to someone else.

10. Complaints

If you are unhappy with how we have handled your personal data, please tell us first at [email protected] so we can try to put it right.

You also have the right to complain to the Information Commissioner’s Office, the UK supervisory authority for data protection. You can reach the ICO at ico.org.uk, on 0303 123 1113, or by writing to Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Complaining to us first does not affect your right to go to them.

11. Security

The site is served over HTTPS. Enquiry data is sent to our own server rather than straight to a third party, and the credential that forwards it to Slack is held server-side and never reaches your browser. Access to enquiries is limited to the people who need to answer them.

No method of transmission over the internet is completely secure, so we cannot guarantee absolute security. If a breach occurs that is likely to result in a risk to your rights, we will report it to the ICO within 72 hours and tell you where the law requires it.

12. Children

This website is aimed at people working in film, television and music, and is not intended for children. We do not knowingly collect personal data from anyone under 13. If you believe a child has sent us personal data, email us and we will delete it.

13. Changes to this policy

We update this policy when what we do changes. The date at the top shows when it was last revised. Where a change materially affects how we use your personal data, we will bring it to your attention rather than relying on you to re-read the page.

14. Contact us

For anything in this policy, including any of the rights in section 9:

UFLIX Ltd t/a Hiway
Bartle House, Oxford Court
Manchester, M2 3WQ
Email: [email protected]