Privacy
Last updated: September 2026
Who we are
Cram Limited runs cram.ltd, the consulting site of Heath Cram and Erin Cram. For anything this site collects, Cram Limited is the data controller. Our data protection contact is Erin Cram: erin@cram.ltd.
What we collect
Only what you choose to send us. The enquiry form asks for your name, company, email, an optional phone number and contact preference, the services you are interested in, and your message. If you email us directly, we hold that correspondence. The site has no accounts, no logins and takes no payment details.
From time to time we run a request for information on behalf of a client, on a page linked directly to the people invited to take part. Those forms ask for business contact details, the responding company and its answers, and allow a document to be attached. They are about companies and their products, and we do not ask for personal information beyond who is responding and how to reach them. If you attach a document, please make sure it holds no more personal data than the process needs.
Why, and on what legal basis
We use what you send to reply to you, and to scope and set up an engagement if we take things further. Where you respond to a request for information, we use it to assess and compare responses for the client running that process. Under UK and EU GDPR the bases are: steps taken at your request before entering a contract, our legitimate interest in running and protecting a small consulting business, and legal obligations where records must be kept. We run no newsletters and no marketing lists, and we never sell or share personal data for advertising.
Who else sees it
Enquiries stay with us. Responses to a request for information are shared with the client running that process, and with their advisers where they need to see them, for the purpose of that selection only. The client is named to the people invited to take part, or on request. Nothing is shared more widely, and nothing is used to approach you about anything else.
Anything you send is treated as commercially confidential. Where you would prefer a signed confidentiality agreement before sending commercial information, ask and we will provide one.
Who handles it for us
A short chain of service providers, each acting under its own GDPR commitments: Formspree delivers our forms and stores any file you attach, Namecheap forwards mail sent to our addresses, Google handles the mailbox where replies are written, and GitHub Pages hosts the site and keeps standard server logs. Page fonts are served by Google Fonts, which receives your IP address when they load. Some providers process data outside the UK and EU under recognised safeguards such as adequacy decisions and standard contractual clauses.
Cookies and tracking
None. This site sets no cookies, runs no analytics and carries no advertising, which is why there is no cookie banner: there is nothing to consent to. The free tools do their work inside your own browser. Role Radar saves your filter choices in your browser's local storage, on your device only, and nothing you type into the P&L calculator ever leaves the page. Where we run a request for information, the form saves your answers the same way as you type them, so you can close the page and come back to a part-finished response. That draft stays on your device, is never sent to us until you press submit, and is cleared once you do. Clearing your browser data removes it.
How long we keep it
Enquiries are kept only as long as needed to deal with them. If an enquiry becomes an engagement, records are kept for the period tax and company law require, then deleted.
Responses to a request for information are kept for the selection and for twelve months after it closes, then deleted, unless the response leads to a contract in which case the records follow the rule above. Ask us to delete your response sooner and we will, once the selection has closed.
Your rights
Email erin@cram.ltd to exercise any of these. You can also complain to a supervisory authority: the ICO in the UK, the Information Commissioner in the Isle of Man, or your local authority in the EU.
Changes
If this policy changes, the new version appears here with a new date. It stays this short on purpose.