Privacy Notice

01Who we are

IL LOKO Management Ltd is the controller of the personal data that we collect and use as described in this notice. This means that we decide why and how that data is used, and that we are responsible for it under UK data protection law, in particular the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and, for information stored on or read from your device, the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR), each as amended by the Data (Use and Access) Act 2025. Where another organisation decides for itself how it uses information, such as Google or Microsoft when you choose Gmail or Outlook on our contact form, it is a separate controller, and we say so in this notice.

• Registered name (as shown at Companies House): IL LOKO MANAGEMENT LTD
• Company type and number: private limited company registered in England and Wales, company number 16516206
• Registered office: 27 Old Gloucester Street, London WC1N 3AX, United Kingdom
• Email for all privacy matters, including requests and complaints: bookings@illokomngt.io

We provide technology and business development services, including work in artificial intelligence and machine learning, and we also work with the entertainment industry. Our technology partner, Coding Panda, is based in the United States. Where an enquiry concerns a project we may deliver with Coding Panda, we share the relevant details with them, as explained in 'Other organisations involved'.

We have not appointed a data protection officer. Please send any question about this notice or about your personal data to bookings@illokomngt.io. If you put 'Privacy' in the subject line, we can find your message and deal with it promptly. You can also write to us at our registered office.

02Summary

These are the main points. The sections that follow give the full detail.

• When you visit the site, our hosting provider, Netlify, processes the technical details that every website receives with each request, such as your IP address and browser type. In this notice we call these details 'request data'. Netlify processes them on our behalf, to deliver the pages and keep the site secure.
• Netlify, with the sub-processors it uses under its agreement with us, is the only organisation that receives request data when a page loads. Every typeface on the site is served from our own website or is a font already installed on your device, and the site loads no fonts, scripts or other content from Google or any other third party.
• If you choose a language or switch between the light and dark display, the choice is saved on your device so the site remembers it. Nothing is saved unless you make that choice yourself, and one click on 'Forget my choices', in the footer of every page, deletes all the items the site can save. If you do not choose a language, the site uses the language your device or browser is set to, if it is one of the site's six languages, and English otherwise; this happens on your device, without sending or storing anything. On small screens, a clock shows the local time of the office nearest you, chosen on your device from its time-zone setting; you can switch it off with its × button.
• Our contact form does not send anything to us. It prepares an email in your own email app, or in Gmail or Outlook on the web, and you decide whether to send it. If you choose Gmail or Outlook, what you wrote, together with your name and company, is passed to Google or Microsoft as soon as the new tab opens, even if you then decide not to send it. If you send the email, or write to us directly, we use it to reply to you, to discuss a possible project or business relationship and to keep a record of our correspondence.
• Where your enquiry concerns a project we may deliver with our technology partner, Coding Panda, in the United States, we forward the relevant details to Coding Panda by email. Coding Panda uses them only to assess and work on that enquiry or project with us. If you would rather we did not share your enquiry, say so and we will not forward it.
• We do not use analytics, advertising, social media pixels or plugins, embedded videos or maps, third-party fonts or scripts, or fingerprinting. We do not profile you, we make no automated decisions about you, and we do not sell or rent personal data.
• Some of the organisations involved, including Netlify and Coding Panda, are in the United States. We explain the legal protections that apply to those transfers.
• We keep an enquiry that does not lead to a business relationship for up to 24 months after our last exchange. If we go on to work together, we keep our correspondence for as long as the relationship lasts and then normally for a further six years, for tax records and possible legal claims. After that, we delete it or anonymise it.
• You have rights over your personal data, including the right to object to our use of it. You can complain to us, and you can also complain to the UK's data protection regulator, the ICO.

03What personal data we collect and use

When you visit the website

Each time your browser asks for a page or file from illokomngt.io, the servers of our hosting provider, Netlify, Inc., receive and record the standard technical details of that request. These include your IP address, the type and version of your browser and operating system (the 'user agent'), the address of the page or file requested and the date and time of the request. They also include other standard information, such as the page you came from, your browser's language settings and, if you have chosen a language, the il-pick cookie described below. In this notice we call these details 'request data'. Netlify uses request data on our behalf to send you the pages you ask for and to keep our website secure, for example by detecting and blocking abusive traffic.

Every typeface on the site is either stored on our own website and delivered by our hosting provider like any other page file (the Great Laker and Quicksand typefaces), or is a standard font already installed on your device (a 'system font'). The site does not load fonts, scripts, images or any other content from Google or from any other third-party service. When a page loads, your browser sends requests only to our hosting provider, so request data goes only to Netlify, Inc. and to the sub-processors it uses to run its network under its agreement with us.

The website has no user accounts, login, newsletter or payments, and none of its forms sends information to our servers.

When you choose a language or display theme

If you choose a language from the language menu, or switch the site between its light and dark display, the site saves that choice on your device. The saved value is only a two-letter language code, or the word 'light' or 'dark', and it does not contain your name or any other identifier. If you do not choose a language, the site uses the language your browser is set to, if it is one of the site's six languages, and English otherwise. That step happens within your browser, sends nothing to us or to anyone else and stores nothing. The section 'What we store on your device' gives the full details, including how long each item lasts and how to remove it.

When you write to us

You can write to us directly at bookings@illokomngt.io from any email account, or use the contact form on our website. If you write directly, we receive the information listed below when your email arrives. The contact form does not send your message to us or to any server of ours. Instead, it prepares an email for you, and you choose how to open it:

• In your own email app: the form hands a draft to the email app on your device, using a standard 'mailto' link. The draft contains our email address, a subject line made up of the topic you picked, your name and your company (if given), and your message followed by your name and company.
• In Gmail or Outlook on the web: the form opens that service in a new browser tab with the same draft already filled in. To do this, the form puts our email address, the subject line and the text of the draft into the web address of the new tab. These details therefore reach Google or Microsoft as soon as the tab opens, even if you then decide not to send the email. Google or Microsoft then handle that information under their own terms and privacy policies, including, if you are signed in, the terms of your account with them (for a Google Workspace account, your organisation's arrangements with Google). They act independently of us and not on our behalf. The Outlook option opens Outlook.com, Microsoft's service for personal accounts.

Whichever option you choose, nothing reaches us until you review the email and send it yourself. When you send it, or when you write to us directly, we receive:

• your name and email address;
• the name of your company or organisation, if you give it;
• your message, any attachments and anything else you choose to include, such as a job title or telephone number in your email signature;
• the technical information that email systems attach to every message, such as the date and time it was sent and the mail servers it passed through.

We do not ask for, and do not need, sensitive information such as details of your health, racial or ethnic origin, religious, philosophical or political beliefs, trade union membership, genetic or biometric data, sex life or sexual orientation, or any criminal convictions or offences. Please leave such information out of your message. If you include it anyway, we will not use it, we will not forward it to Coding Panda, and we will delete it or remove it from our records as soon as reasonably possible, unless we need to keep it to establish, exercise or defend legal claims.

Information about other people

If your email includes details of other people, such as colleagues, clients or artists you represent, we receive their information from you and not from them. This usually means their names, contact details and job titles, and whatever else you tell us about them in connection with your enquiry. We handle it in the same way and for the same purposes as the rest of your message. This includes forwarding it to Coding Panda where it forms part of an enquiry about a project we may deliver with them, as explained in 'Other organisations involved'. Those people have the same rights under UK data protection law as you do. Please include only what your enquiry needs and, where appropriate, let them know about this notice.

Do you have to give us your details?

No. You are not required by law or by any contract to give us personal data. You can use the website without contacting us. If you want a reply, we need an email address to send it to. The contact form asks for your name and a message so that it can prepare the draft, and you can still change the draft before you send it. Other details, such as the name of your company, are optional, although they help us give a useful answer.

04How we use personal data

We use the personal data described above only for the following purposes:

• to deliver the website to you and keep it secure and working properly;
• to remember your choice of language and display theme, if you make one;
• to read your enquiry and reply to it;
• to discuss and assess a possible project or business relationship with you or with the organisation you represent;
• where your enquiry concerns a project we may deliver with our technology partner, Coding Panda, to forward the relevant details to Coding Panda by email, so that it can assess and work on that enquiry or project with us;
• if we go on to work together, to manage that relationship or project, together with Coding Panda where the project is delivered with them;
• to keep a record of our correspondence, so that we can deal with follow-up and repeat enquiries, show what was discussed or agreed, and establish, exercise or defend legal claims;
• to comply with our legal obligations, such as keeping business and tax records, and to respond to lawful requests from public authorities;
• to deal with requests and complaints about personal data.

We do not send newsletters, and we do not use personal data for advertising, analytics or profiling. If we ever wanted to send you marketing, we would first update this notice and ask for your agreement where the law requires it. More generally, if we wanted to use personal data for any new purpose, we would update this notice first and, where the change affects you, tell you before doing so.

05Our lawful bases

UK data protection law allows us to use personal data only where we have a lawful basis for doing so. The basis for each purpose is set out below. We do not rely on your consent for any of them. Whichever basis applies, we must use your information fairly, keep it no longer than we need it and respect your rights. Which rights apply depends partly on the basis: for example, you can object where we rely on legitimate interests, and data portability applies only where we rely on steps before a contract, or a contract, with you. 'Your rights' explains this.

• Delivering the website and keeping it secure (request data). Basis: legitimate interests (Article 6(1)(f) UK GDPR). Our interests are to show you the pages you ask for and to protect the website and its visitors against misuse and attack. UK data protection law expressly names keeping network and information systems secure as an example of a legitimate interest.
• Remembering your language or theme choice. Basis: to the extent that these items count as personal data, legitimate interests (Article 6(1)(f)). Our interest is to show the website in the language and display you have chosen. The items contain nothing that identifies you on its own. Storing them on your device is also governed by PECR, as explained in 'What we store on your device'.
• Replying to an enquiry you make for yourself about a possible contract with you, for example as a sole trader or self-employed artist. Basis: taking steps at your request before entering into a contract (Article 6(1)(b)).
• Replying to an enquiry you make on behalf of a company or other organisation, and developing that business relationship. Basis: legitimate interests (Article 6(1)(f)). Our interests are to answer the enquiries people choose to send us and to explore and manage business relationships. We do not use the 'steps before a contract' basis here, because it applies only where you yourself would be a party to the contract.
• Replying to any other enquiry you send us, for example a general question, a press enquiry or a request for information. Basis: legitimate interests (Article 6(1)(f)). Our interest is to answer the messages people choose to send us.
• Forwarding the relevant details of your enquiry to Coding Panda, where it concerns a project we may deliver with them, and assessing and working on that enquiry or project with them. Basis: legitimate interests (Article 6(1)(f)). Our interest is to assess and deliver the project together with our technology partner. Where the enquiry is about a possible contract with you yourself, for example as a sole trader or self-employed artist, the basis is instead taking steps at your request before entering into a contract (Article 6(1)(b)) and, once a contract with you is in place, performance of that contract.
• Managing a contract or project that follows, including sharing with Coding Panda what it needs to work on a project delivered with them. Basis: where the contract is with you, performance of that contract (Article 6(1)(b)). Where it is with your organisation, our legitimate interests in managing the relationship with that organisation and delivering the project (Article 6(1)(f)).
• Keeping a record of our correspondence. Basis: legitimate interests (Article 6(1)(f)). Our interests are to keep an accurate record, to deal with follow-up and repeat enquiries, and to establish, exercise or defend legal claims.
• Keeping records that the law requires, such as tax and company records connected with work we carry out, and dealing with requests and complaints about personal data. Basis: legal obligation (Article 6(1)(c)). Keeping a record of those requests and complaints for three years after they are closed. Basis: legitimate interests (Article 6(1)(f)), namely being able to show how we dealt with them.
• Sharing personal data with our professional advisers, and with courts, regulators, HM Revenue and Customs, law enforcement or other public authorities. Basis: legal obligation (Article 6(1)(c)) where the law requires us to disclose it; otherwise legitimate interests (Article 6(1)(f)), namely obtaining professional advice, cooperating with public authorities, and establishing, exercising or defending legal claims.
• Information about other people that you include in a message, including forwarding it to Coding Panda where it forms part of an enquiry about a project we may deliver with them. Basis: legitimate interests (Article 6(1)(f)) in dealing with the enquiry the information forms part of.

Where we rely on legitimate interests, we have considered whether your interests and rights outweigh ours, taking into account what you would reasonably expect. You can ask us for more information about this. You also have the right to object, which is explained in 'Your right to object'.

06What we store on your device

The website itself can save up to four small items on your device, and only when you make a choice yourself, by choosing a language in the language menu, by clicking the light/dark button or by switching off the clock that small screens show. None of them contains your name or any other identifier, and no website other than ours can read them. Because the language cookie is sent back to our website with each page request, it also reaches our hosting provider's servers, which receive it on our behalf, but the site uses it only to choose the language. None of these items is used for analytics, advertising, tracking or profiling. Once you have made a choice, the site reads these items each time a page loads so that it can apply your choice, but it does not rewrite or renew them: they change only when you make a new choice or remove them. Separately, your browser keeps ordinary cached copies of files, as explained below.

1. il-pick (cookie)

• Type and where stored: a first-party cookie in your browser, set by our website for illokomngt.io and its subdomains (domain .illokomngt.io).
• What it contains: a two-letter code for the language you chose, for example 'es' for Spanish.
• When it is set: only when you choose a language in the language menu. The site does not set it at any other time, and it does not renew it when you come back. A one-line note inside the language menu says 'Your choice is remembered on this device.' and links to this section.
• Purpose: to show the site in that language on your later visits and across our pages.
• How long it lasts: 12 months from the moment you chose the language. Because it is not renewed on later visits, your browser deletes it automatically when those 12 months are up. If you choose a language again, the new choice replaces it with a new cookie that lasts 12 months from that new choice.
• Other details: marked SameSite=Lax, and sent only over encrypted (HTTPS) connections (the 'Secure' setting). Like any cookie, your browser sends it with its requests to illokomngt.io and its subdomains, where our hosting provider receives it on our behalf. The site itself uses it only inside your browser, to pick the language.

2. il-pick (local storage)

• Type and where stored: an entry in your browser's local storage for this website.
• What it contains: the same two-letter language code.
• When it is set: only when you choose a language in the language menu, at the same moment as the cookie.
• Purpose: a second copy of the same choice, which the site uses when the cookie is not available, for example if your browser blocks cookies or after the cookie has expired. This means that your language choice keeps working after the cookie's 12 months are up, until you remove this entry. The site does not use this copy to re-create the cookie.
• How long it lasts: it has no expiry date. It stays until you remove it using one of the options below.

3. il-theme (local storage)

• Type and where stored: an entry in your browser's local storage for this website.
• What it contains: the word 'light' or 'dark'.
• When it is set: only when you click the light/dark button. The button's tooltip, and its label for screen readers, say that the choice is remembered on this device.
• Purpose: to show the site in the display you chose on your later visits.
• How long it lasts: it has no expiry date. It stays until you remove it using one of the options below.

4. il-clock (local storage)

• Type and where stored: an entry in your browser's local storage for this website.
• What it contains: the word 'off'.
• When it is set: only when you tap the × on the clock that small screens show at the top of the home page.
• Purpose: to keep the clock switched off on your later visits. While it is set, the site does not read your device's time-zone setting.
• How long it lasts: it has no expiry date. It stays until you remove it using one of the options below.

If you open a language address such as illokomngt.io/es/, the site shows that language. Otherwise, if you have chosen a language, the site uses your choice. If you have not, the site uses the first language in your browser's language settings that it offers (English, Spanish, Italian, German, French or Chinese, shown in Traditional Chinese), and English if none of them is set. This step happens only on your device. It makes no network request and stores nothing. On small screens the site also reads your device's time-zone setting, only to choose which of our offices' local time the clock shows; it is used for nothing else, and it is not read once you have switched the clock off. If you have chosen a language and open our home page, the site also changes the address in your browser's address bar to the matching language address, for example illokomngt.io/es/. If you have not chosen a theme, the site uses its standard dark display and stores nothing. Your browser still sends its usual request data, including its language settings, to our hosting provider with every page request, as described under 'When you visit the website'.

Your browser may also keep copies of the site's files, such as images, typefaces and style sheets, in its ordinary cache, as it does for any website, so that it does not have to download them again on every visit. Your browser decides what to keep in its cache and for how long, following the standard caching instructions our website sends with each file. The cache holds only copies of our own files, not information about you, and you can clear it in your browser settings.

How to object to these items or remove them, free of charge

• Do not use the language menu, the light/dark button or the clock's × button. Nothing is then stored.
• Click 'Forget my choices'. The button is in the footer of every page and at the end of this section. One click deletes the il-pick cookie and the local-storage entries (il-pick, il-theme and il-clock) and reloads the page. The page then appears in the language your browser is set to (or in English) and in the site's standard (dark) display, with the clock switched on again.
• Clear both the cookies and the site data (local storage) for illokomngt.io in your browser settings. Clearing cookies alone is not enough, because the site would then go on using the copy of your language choice kept in local storage.

Once all of the items are removed, the site goes back to choosing the language within your browser from your browser's language settings and to its standard dark display, with the clock switched on, and it stores nothing until you choose again.

Why there is no cookie banner

The Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR), as amended by the Data (Use and Access) Act 2025 with effect from 5 February 2026, generally prohibit a website from storing information on a visitor's device, or reading information from it, unless the visitor consents or an exception applies. One exception (paragraph 6 of Schedule A1 to PECR) covers storage or access whose only purpose is to let a website's appearance or functioning adapt to the visitor's preferences. It applies if the visitor is given clear and comprehensive information about that purpose and a simple way to object, free of charge, and does not object. We consider that remembering a language or display theme that you have chosen, or that you have switched the clock off, falls within this exception. The ICO's guidance on storage and access technologies gives remembering the language a user selects, and showing a theme that matches the user's preferences, as examples likely to meet this exception. Reading your browser's language settings to choose a starting language, and, on small screens, your device's time-zone setting to choose which office's local time the clock shows, is different, because nothing is stored. The site's own code reads these settings within your browser, uses them only for those two purposes, and never sends them to us or to anyone else. In our view this is not access to your device by us, because the settings never leave your device. If it were, it would fall within the same exception, because its only purpose is to adapt the site to you. Once you have chosen a language in the menu, the site no longer reads your language settings, and it does not read them whenever you open a language address such as illokomngt.io/en/. Once you have switched the clock off with its × button, it no longer reads your time-zone setting. This section gives you that information, and the options above, including the one-click 'Forget my choices' button on every page, give you a simple and free way to object, so we do not use a consent banner. We also store these items only when you actively make a choice, so you decide whether anything is stored at all. If we ever added something that needs your consent, such as analytics, we would ask for your consent before setting it.

Forget my choicesRemoves the language, display and clock choices saved on this device.

07Other organisations involved

This section names the organisations that receive personal data in connection with the website or with your emails, and explains the part each one plays. When a page loads, request data goes only to our hosting provider, Netlify, Inc., and to the sub-processors it uses to run its network under its agreement with us. The site loads nothing from Google or from any other third-party service.

Hosting: Netlify, Inc.

Netlify, Inc., a company in the United States, hosts the website. It processes request data on our behalf, as our processor, under its data processing agreement with us, to deliver and secure our website. Netlify may use its own sub-processors under that agreement. Netlify keeps these request logs for the period of its standard log retention for our hosting plan, and then deletes them. We do not use these logs to identify or profile visitors. Netlify's privacy policy (https://www.netlify.com/privacy/) covers Netlify's own customers and users. Information about visitors to our website is handled under Netlify's data processing agreement with us.

Email and IT service providers

We use email and IT service providers to receive, store and manage our email and business records. They process personal data on our behalf, as our processors, under written terms that require them to protect it and to use it only on our instructions.

Our technology partner: Coding Panda

Coding Panda, based in the United States, is our technology partner. Where your enquiry concerns a project we may deliver with Coding Panda, we forward the relevant details to them directly by email. These are your name, your business contact details, the name of your company, your message and any attachments. We do not forward the sensitive information described in 'What personal data we collect and use'. Coding Panda uses the details only to assess and work on that enquiry or project with us, and for no other purpose. We forward only what that requires, and we do not forward enquiries that have nothing to do with such a project. If you would prefer us not to share your enquiry with Coding Panda, say so in your message, or tell us at any time afterwards, and we will not forward it, although this may limit what we can offer on a project we would deliver with them. The transfer to the United States, and the safeguards we have put in place with Coding Panda, are explained in 'Transfers outside the United Kingdom'.

Professional advisers and public authorities

Where necessary, we may share personal data with our professional advisers, such as lawyers and accountants, who owe us duties of confidentiality. We may also share it with courts, regulators, HM Revenue and Customs, law enforcement or other public authorities where the law requires or permits this, or where it is needed to establish, exercise or defend legal claims.

Gmail and Outlook on the web

If you use the Gmail or Outlook option on our contact form, Google or Microsoft process your draft and your email under their own terms and privacy policies, and under the terms of your account with them if you are signed in. They are not our service providers, and we have no control over how they handle that information. Their privacy policies are at https://policies.google.com/privacy (Google) and https://www.microsoft.com/en-gb/privacy/privacystatement (Microsoft).

Links to other websites

The website links to other sites, including Companies House, a UK government website. Those sites have their own privacy and cookie policies, which we do not control, and we are not responsible for the cookies or similar technologies they use. Please read their policies when you visit them.

We do not sell or rent personal data, and we do not share it with anyone other than the organisations described in this section.

08Transfers outside the United Kingdom

Our hosting provider, Netlify, and our technology partner, Coding Panda, are in the United States, and some of our email and IT service providers may process data outside the UK. UK law allows personal data to be transferred outside the UK only where it remains protected, and it requires us to tell you how.

• Netlify, Inc. Netlify appeared on the US Data Privacy Framework List as an active participant in the UK Extension to the EU-U.S. Data Privacy Framework when we checked on 28 September 2026. UK law allows personal data to be sent to US organisations certified to the UK Extension without further safeguards. This is set out in the Data Protection (Adequacy) (United States of America) Regulations 2023, known as the 'UK-US data bridge', which now take effect as regulations under Article 45A of the UK GDPR. The data bridge covers only US organisations that are certified to it. Netlify's data processing agreement with us also provides the International Data Transfer Addendum to the EU Standard Contractual Clauses (the 'UK Addendum') as a fallback if the data bridge stops applying.
• Coding Panda. When we forward details of an enquiry to Coding Panda in the United States, we do not rely on the UK-US data bridge. Instead, we protect the transfer with one of the two sets of standard data protection clauses approved for transfers from the UK, which we have signed with Coding Panda: the International Data Transfer Agreement (IDTA) issued by the ICO, or the UK Addendum. Before relying on these clauses, we assessed that the protection your data will receive is not materially lower than in the UK.
• Email and IT service providers. Where any of them processes data outside the UK, we rely on regulations under Article 45A of the UK GDPR that approve transfers to the country concerned or, where there are none, on UK-approved standard data protection clauses.
• Gmail and Outlook. If you use either, Google or Microsoft may process your draft and your email outside the UK under their own terms.

If the UK-US data bridge stops applying to Netlify, we will rely instead on the UK-approved standard data protection clauses in its data processing agreement, after assessing that the protection is not materially lower than in the UK, or we will stop using Netlify.

You can ask us for a copy of the relevant safeguards, including those we have put in place with Coding Panda, by writing to bookings@illokomngt.io.

09How long we keep personal data

We keep personal data only for as long as we need it for the purposes described in this notice. For most of it, UK law sets no fixed period, so we have set the periods below and give our reasons. When a period ends, we delete the data or anonymise it so that it no longer identifies anyone.

• Enquiries that do not lead to a business relationship: up to 24 months after our last exchange. This lets us deal with follow-up questions and recognise a repeat enquiry without keeping correspondence indefinitely.
• Details we forward to Coding Panda: kept by Coding Panda only for as long as it needs them to assess or work on the enquiry or project with us, and never for longer than we keep our own copy. It then deletes them, as our agreement with Coding Panda requires.
• Financial and transaction records, for example invoices and the emails that support them: six years from the end of the company financial year they relate to, as HMRC requires, or longer where HMRC's rules require it, for example if HMRC has opened a compliance check.
• Other correspondence with a client or business contact: for as long as the relationship lasts and then normally for six years after it ends, because a claim under a contract can usually be brought within six years in England and Wales. We keep it for longer only while we need it for a claim or dispute that is still open.
• Records of requests and complaints about personal data: three years after the matter is closed, so that we can show how we dealt with it.
• Request data: kept by Netlify on our behalf for the period of Netlify's standard log retention for our hosting plan, and then deleted by Netlify.
• Items stored on your device: your browser deletes the il-pick cookie automatically 12 months after you chose the language, as it is not renewed on later visits. The il-pick, il-theme and il-clock local-storage entries have no expiry date and stay until you remove them. You can remove all of them at any time with the 'Forget my choices' button, as explained in 'What we store on your device'.
• Drafts and emails in your Gmail, Outlook or other email account: kept under your own account settings.

10Security

We use technical and organisational security measures that are appropriate to the kind of personal data described in this notice and to the risks involved in handling it. They include:

• The website is served over an encrypted connection (HTTPS). It has no accounts, login or server-side forms that could expose visitor data, and it loads no fonts, scripts or other content from third-party services.
• We use established providers for hosting, email and IT, on terms that require them to protect the data they handle for us.
• We limit access to enquiry correspondence to the people in our company who need it.
• We forward enquiry details to Coding Panda only in the circumstances described in 'Other organisations involved', we forward only what the enquiry or project needs, and we do so under the safeguards described in 'Transfers outside the United Kingdom'. With everyone else, we share only what the purpose in question needs.

No website, email system or internet transmission can be made completely secure. Ordinary email can pass through several systems on its way to us, or when we forward it to Coding Panda, and may not be encrypted at every stage. Please bear this in mind before sending confidential or commercially sensitive material, and ask us if you would like to agree a different way of sharing it.

If a security incident affects personal data we hold, we will act promptly to contain it and to assess the risk to the people affected. Where the law requires it, we will report the incident to the ICO without undue delay and, where feasible, within 72 hours of becoming aware of it. We will tell you without undue delay if the incident is likely to result in a high risk to your rights and freedoms.

11Your rights

UK data protection law gives you the rights listed below. Some apply only in certain circumstances, which we explain. To use any of them, email bookings@illokomngt.io, ideally with 'Privacy' in the subject line, or write to us at our registered office. You do not need to use a particular form or particular wording.

• Access. You can ask whether we hold personal data about you, and ask for a copy of it together with information about how we use it. We will search for it carefully, as far as is reasonable and proportionate.
• Correction. You can ask us to correct personal data that is inaccurate, and to complete data that is incomplete.
• Erasure. You can ask us to delete your personal data, for example where we no longer need it, where you have successfully objected to our use of it, or where it has been used unlawfully. This right is not absolute. We may keep information that we need to comply with a legal obligation or to establish, exercise or defend legal claims, and if so we will tell you.
• Restriction. You can ask us to limit our use of your personal data in certain cases. These include while we look into a concern you have raised about its accuracy or about an objection, and where you need us to keep data for a legal claim that we would otherwise delete.
• Data portability. This right applies where we use data you gave us on the basis of steps before a contract, or a contract, with you, and the processing is carried out by automated means, which includes email. In that case you can ask for the data in a structured, commonly used and machine-readable format, or ask us to send it to another organisation where that is technically feasible. It does not apply to data we use on the basis of legitimate interests or a legal obligation, such as request data or correspondence with you as a representative of an organisation.
• Objection. You can object to our use of your personal data where we rely on legitimate interests. This right is explained in full in the next section, 'Your right to object'.

Because none of the uses described in this notice relies on your consent, the right to withdraw consent does not apply. You can still object to our use of your personal data, or ask us to delete it, as explained in this section and in 'Your right to object'.

How we deal with requests

• Time limit. We will respond without undue delay and in any event within one month. The month runs from when we receive your request or, if we need information to confirm your identity, from when we receive that information. If a request is complex, or you have made several requests, we may extend the time by up to two further months. If we do, we will tell you within the first month and explain why. For an access request, if we reasonably need you to clarify what you are asking for, the time limit pauses until you reply.
• Fees. There is normally no charge. If a request is manifestly unfounded or excessive, we may charge a reasonable fee or refuse to act on it, and we will explain why.
• Identity checks. To protect your information, we may ask for information to confirm your identity before we act, particularly if a request comes from an email address we do not recognise. We will ask only for what we reasonably need and will use it for no other purpose.
• If we decide not to act on your request, we will tell you why without undue delay and in any event within one month of receiving it. We will also remind you that you can complain to us, complain to the ICO, or ask a court to enforce your rights.

13Complaints

Complaining to us

If you are unhappy with how we have handled your personal data, you have a legal right to complain to us (section 164A of the Data Protection Act 2018). You can email bookings@illokomngt.io, with 'Privacy' in the subject line, or write to IL LOKO Management Ltd, 27 Old Gloucester Street, London WC1N 3AX, United Kingdom. We will acknowledge your complaint within 30 days of receiving it. We will then look into it, keep you informed of progress and tell you the outcome without undue delay.

Complaining to the ICO

You also have the right to complain to the ICO, the UK's data protection regulator, at any time. Until 30 September 2026 the ICO is the Information Commissioner's Office. From that date its functions pass to the Information Commission, which continues to be known as the ICO and to use the same website. The law does not require you to complain to us first. However, the ICO recommends giving the organisation a chance to deal with the complaint, and in most cases it will ask you to do so before it looks into it. At the date of this notice, the ICO publishes these contact details:

• Online complaints: https://ico.org.uk/make-a-complaint/
• Website: https://ico.org.uk
• Helpline: 0303 123 1113 (Monday to Friday, 9am to 5pm, excluding bank holidays)
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

Going to court

You also have the right to take legal action in the courts if you believe your data protection rights have been infringed. This includes claiming compensation if you have suffered damage, including distress, as a result. You may wish to take independent legal advice first.

14Children

The website is intended for businesses and professionals. It is not directed at children, and we do not knowingly seek personal data from them. If you believe a child has sent us personal data, please let us know at bookings@illokomngt.io.

15Automated decisions and profiling

We do not make any decision about you based solely on automated processing, meaning a decision taken without meaningful human involvement that has legal or similarly significant effects on you. We do not profile visitors to the website or people who write to us.

16Changes to this notice

This version is dated 28 September 2026. We review this notice regularly, and whenever we change how the website works or how we handle personal data. When we update it, we will publish the new version on this page with a new date. Each version applies from the date shown on it. If a change is significant, we will highlight it at the top of this page for a reasonable period. Before we use personal data for a new purpose, we will update this notice and, where the change affects you and we hold your contact details, tell you directly.

17Language versions

This notice is available in English, Spanish, Italian, German, French and Traditional Chinese. Each translation is intended to say exactly what the English text says. The English text is the original. If you notice a difference between a translation and the English text, please tell us at bookings@illokomngt.io and we will correct it. We will not rely on any such difference to your disadvantage.