Privacy Policy
This Privacy Policy is issued by CRADERO LIMITED for the website cradero.technology and for related Apple app development services supplied from Muirhead, Glasgow. It should be read with the Cookie Policy, Terms of Service and Terms and Conditions. Contact: admin@cradero.technology, +44 7411 525634, 25 Belhaven Park, Muirhead, Glasgow, Scotland, G69 9FA.
1. Controller identity and territorial scope
This Privacy Policy explains how CRADERO LIMITED (the “Company”, “we”, “us” or “our”) processes personal data in connection with the website published at cradero.technology, related correspondence, and the provision of Apple app development services, iPhone software development, iOS mobile solutions, Swift application development, iOS UI development, App Store application development, native Apple app solutions, iOS product development, custom iPhone software and Apple mobile technology. The Company is established in Scotland, United Kingdom, with its working address at 25 Belhaven Park, Muirhead, Glasgow, Scotland, G69 9FA. For the purposes of the United Kingdom General Data Protection Regulation and the Data Protection Act 2018, CRADERO LIMITED is the controller of personal data described in this Policy unless a written engagement letter states that we act as a processor for a named client system. Enquiries should be directed in writing to admin@cradero.technology or by telephone to +44 7411 525634 during advertised United Kingdom business hours.
This Policy is drafted for a United Kingdom audience and for visitors and clients who interact with a Scottish-registered supplier. If you are located in the European Economic Area or elsewhere, additional transfer information appears below. Nothing in this Policy creates rights against Apple Inc. or any App Store operator. Those organisations publish separate notices. Our processing is limited to the data we actually receive and hold in the course of operating cradero.technology and delivering contracted development work from Muirhead.
We keep this Policy aligned with the Information Commissioner’s Office guidance as it evolves, including the accountability framework, records of processing, and data protection by design. Because our commercial subject is native Apple software, we also consider privacy nutrition labels, permission strings, and App Store review questions as part of delivery. Those application-level disclosures are client-owned when the product ships. This website notice covers CRADERO LIMITED as a business, not every application we develop for others.
2. Categories of people whose data we process
We process data about website visitors, people who submit a development request note, existing and prospective clients, client staff who join project correspondence, suppliers, job applicants if we run a recruitment process, and other correspondents who write to admin@cradero.technology. We do not knowingly target children. Apple app development services described on this site are business-to-business in character. If a client later commissions software that will be used by children, that product’s privacy design is specified in the engagement documents and is not implied by this website Policy.
A typical record includes a name, a work email, an organisation name, a telephone number, a message describing unclear product material, and technical logs generated by ordinary website delivery. If a contract proceeds we may also hold billing details, purchase-order numbers, source-repository identifiers, TestFlight group emails supplied by the client, and minutes of workshops. We do not require copies of passports to browse the site. Identity checks, if ever needed for anti-fraud reasons, would be described at the time and limited to what is necessary.
3. Sources of personal data
Most personal data comes directly from you when you complete the development request form, send email, telephone +44 7411 525634, or meet us at 25 Belhaven Park, Muirhead, Glasgow, Scotland, G69 9FA. Additional data may come from your colleagues if they copy you into a thread, from public company registers when we confirm that a contracting entity exists, and from limited technical sources such as security logs. We do not buy marketing lists. We do not scrape social networks to build profiles of website visitors. If a client provides end-user data inside a prototype or analytics export, that supply is treated as client-controlled material and is handled under the relevant processor clauses in the engagement.
Search engines and referral sites may send us ordinary referrer information. Payment providers, if used for invoicing, may return confirmation that a transfer completed. Apple, as a platform operator, may send us developer-programme messages related to an account that a client has authorised us to administer. Those messages can include personal names of account holders. We treat them as confidential project data.
4. Purposes of processing
We process personal data to operate cradero.technology, to respond to development requests, to negotiate and perform contracts for Apple app development services, to invoice and keep accounting records required under United Kingdom law, to defend legal claims, to maintain information security, to improve the clarity of our service explanations, and to meet App Store and professional obligations that arise during iOS product development. We do not process personal data to train general public generative models. We do not sell personal data. We do not use your enquiry to bombard you with unrelated advertising.
If you become a client, processing expands in a controlled way to cover project administration: scheduling, source access, TestFlight distribution lists you provide, defect notes, and handover. Those purposes are necessary for native Apple app solutions to be delivered with chemical clarity rather than as an undocumented artefact. When a project ends, we retain only what law and legitimate residual risk require, as described in the retention section.
Website analytics, if enabled, are used only to understand whether pages remain readable and whether forms fail. They are not used to auction your attention. Cookie detail is set out in the Cookie Policy published on this domain.
5. Lawful bases
Where we take steps at your request before entering a contract, or where we perform a contract with you, Article 6(1)(b) of the UK GDPR is the primary lawful basis. That covers the development request form, scoping calls, statements of work, and delivery of iPhone software development. Where we must keep tax records, respond to a competent authority, or maintain health-and-safety records for a visitor to Muirhead premises, Article 6(1)(c) applies. Where we protect the site against abuse, keep limited logs, improve information architecture, and retain evidence of what was agreed, Article 6(1)(f) legitimate interests applies. We have assessed that those interests are not overridden by your interests or fundamental rights when the processing is limited, relevant, and expected in a professional software context.
We do not rely on consent for core contracting. If a future optional mailing were introduced, consent would be captured separately, recorded, and withdrawable as easily as it was given. Cookie consent, where required by the Privacy and Electronic Communications Regulations, is described in the Cookie Policy. Special category data is not sought through the website form. If a client later requires accessibility or health-related product features, any special category processing would be specified in a dedicated instrument with an appropriate Article 9 condition.
You may object to legitimate-interest processing. If you do, we will consider the objection and stop unless we demonstrate compelling legitimate grounds or need the data for legal claims. Contractual processing cannot be abandoned while a live engagement still requires the data, but it can be minimised.
6. What the website form collects
The development request note collects name, email and message. Those fields are required because a nameless or unreachable note cannot be developed into a professional reply. The form posts to a confirmation page on this domain. Do not include payment card numbers, passwords, medical files, or large identity documents in the message field. If your negative input contains personal data of third parties, confirm you have a lawful basis to share it. We will treat unexpected sensitive material as an incident of overexposure and will ask you to retract or replace it.
Technical fields such as time of submission, browser type, and coarse location derived from IP address may be generated automatically by hosting infrastructure. They are used for security and diagnostics. They are not used to infer political opinions or to profile you for advertising. Email addresses are stored so we can reply. We publish our own address as plain text: admin@cradero.technology. That publication is a contact method, not an invitation to scrape or to send bulk unsolicited mail.
7. Client project data, source and device identifiers
During Swift application development we may receive source code, design files, API keys that should have been rotated, user stories containing staff names, and screenshots. We instruct clients not to place live production secrets in tickets. If secrets appear, we treat them as a security event. Repository access is granted on the principle of least privilege. Device UDIDs, if ever used for ad hoc distribution, are collected only to the extent Apple tooling requires and only from people who know they are being registered.
TestFlight email addresses are supplied by the client. We do not harvest them for marketing. Crash logs, if shared with us for diagnosis, may contain paths or user identifiers. We minimise what we keep once the defect is understood. Custom iPhone software that the client later operates will have its own privacy notice. CRADERO LIMITED does not become the controller of end-user app data merely because we wrote the code, unless a separate processor appointment says so and the data actually flows to us.
Push notification tokens, analytics IDs and advertising identifiers are not harvested by this website. If a commissioned application uses them, the client must disclose that use in the App Store privacy answers. We will help complete those answers as part of App Store application development when contracted to do so.
8. Recipients and processors
Personal data may be seen by principals and authorised contractors of CRADERO LIMITED who need it for the relevant bath of work. Hosting, domain, email and backup providers process data on our instructions. Accountants and professional advisers may see billing and contractual data. Competent authorities may receive data where law requires. Apple may process developer-account data under Apple’s terms when we act on a client’s instruction inside App Store Connect. We do not sell lists to brokers.
If we appoint a processor, we use a written contract that meets UK GDPR Article 28 standards: documented instructions, confidentiality, security, sub-processor control, assistance with data-subject rights, deletion or return at the end, and audit information. We prefer United Kingdom or adequately protected locations. Where a tool is unavoidable and sits outside the UK, we apply the transfer section of this Policy.
Staff of a client who are copied on a thread are recipients in a practical sense. We do not police a client’s internal forwarding, but we recommend that clients keep exposure limited to people who need the print.
9. International transfers
CRADERO LIMITED is based in Scotland. Some infrastructure or correspondence tools may involve processing in the European Economic Area, the United States, or other countries. Where the United Kingdom does not recognise an adequacy decision, we use the UK International Data Transfer Addendum or other lawful transfer tools, plus a transfer risk assessment that considers government access, technical measures, and the nature of the data. We do not send development-request contents to experimental public endpoints.
Apple’s own platforms may transfer data according to Apple’s notices when you or we use App Store Connect, TestFlight, or Xcode services. Those transfers are governed by Apple, not by this Policy. We will tell you when a delivery step requires you to accept Apple terms personally as the account holder.
10. Retention
Website enquiry data that does not become a contract is retained only as long as needed to complete correspondence and to evidence that we responded, typically up to twenty-four months unless a dispute is foreseeable. Contract files, invoices and accounting records are retained for at least six years in line with ordinary United Kingdom commercial and tax practice, and longer if a limitation period or HMRC enquiry requires. Source snapshots that are purely residual after handover are deleted or returned according to the engagement, except for a minimal professional copy if needed to defend a claim of defective iOS product development, in which case access is locked and the copy is not used for new work.
Security logs rotate on a shorter cycle unless they record an incident. Recruitment records, if any, follow a shorter cycle measured in months, not years, unless the candidate is hired. Backup media follow the production retention in delayed form and are overwritten on a rolling schedule. When retention ends, we delete or irreversibly anonymise. Paper notes, if used in Muirhead, are destroyed by a method that does not leave readable shadow detail.
11. Security measures
We apply organisational and technical measures proportionate to a small professional firm handling commercial software: access control, unique credentials, encryption in transit for the public website, careful handling of signing certificates, separation of client repositories, and a bias against copying production data into personal devices. No method is perfect. You must not send plaintext passwords. We will never ask for your Apple ID password by email. If a message claiming to be CRADERO LIMITED does so, it is hostile light, not our print.
Offices at 25 Belhaven Park, Muirhead, Glasgow, Scotland, G69 9FA are treated as a working address with ordinary physical care. Remote work uses locked screens and private networks where practicable. Incidents are assessed promptly. Where UK GDPR requires notification to the Information Commissioner’s Office or to data subjects, we will do so without undue delay after we become aware of a qualifying breach.
12. Your rights
You have the right to be informed, to access, to rectification, to erasure in the circumstances the statute allows, to restrict processing, to object to legitimate-interest and direct-marketing processing, to data portability where processing is automated and based on contract or consent, and to withdraw consent where consent was the basis. You also have rights in relation to automated decision-making. CRADERO LIMITED does not make solely automated decisions with legal or similarly significant effects about website visitors.
To exercise rights, write to admin@cradero.technology from an address we can reasonably associate with the record, or post to 25 Belhaven Park, Muirhead, Glasgow, Scotland, G69 9FA. We may need to verify identity if the request is unusual. We will respond within one month, with an extension where the law permits for complex or numerous requests. Access is provided in a concise, transparent and intelligible form. We will not charge a fee unless a request is manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse, explaining why.
If you believe we have not handled data correctly, you may complain to the Information Commissioner’s Office, the United Kingdom supervisory authority. We would prefer the chance to fix the exposure first, but that preference does not limit your statutory right.
13. Children
The website and the Apple app development services marketed here are aimed at organisations and adult professionals. We do not knowingly collect children’s data via the contact form. If you believe a child has submitted personal data, contact us and we will delete it unless a legal duty requires a short retention. If a client commissions an application directed at children, additional design duties apply under Apple’s rules and under UK children’s privacy codes. Those duties are scoped in the engagement and are not discharged by this Policy alone.
14. Marketing and electronic mail
We do not operate a high-volume marketing list. If we ever send unsolicited electronic mail for similar products to existing clients, we will comply with PECR, including screening against suppression requests. Service messages about an active project are not marketing. You can tell us to stop optional updates at any time by writing to admin@cradero.technology with a clear subject. Telephone +44 7411 525634 may also be used. We will not sell your number to third-party callers.
15. Automated tools, logs and cookies
The site may use strictly necessary cookies or similar storage to keep a session stable and to remember a cookie preference. Non-essential cookies are described in the Cookie Policy and are not set without a lawful PECR basis. Server logs may record IP addresses, user-agent strings, timestamps and requested paths. Those logs exist to keep the safelight room secure, not to build a personality dossier. We do not deploy invasive session replay on the legal pages. If a future analytics product is introduced, this Policy and the Cookie Policy will be updated before it goes live on cradero.technology.
16. Apple platforms and third-party terms
When we help a client with App Store application development, Apple requires privacy answers, permission text, and sometimes nutrition labels. Those disclosures concern the shipped application and the client’s use of Apple services. They are not a substitute for this Policy. CRADERO LIMITED does not control Apple’s processing of developer or end-user data. You should read Apple’s legal pages if you use Apple IDs, iCloud, or App Store Connect. We will not ask you to circumvent Apple privacy requirements as a way of speeding a print.
17. Processor role on client systems
If an engagement states that CRADERO LIMITED is a processor, we will process personal data only on documented instructions, keep it confidential, implement appropriate security, assist with data-subject requests that the client cannot fulfil alone, assist with DPIAs where relevant, delete or return data at the end of the service except where UK law requires storage, and make available information needed to demonstrate compliance. Sub-processors will be bound to equivalent duties. International transfers in that processor context follow the client’s documented instructions plus the tools this Policy describes. End-user support inside a live application is not offered unless the statement of work says so.
18. Records, DPIA and accountability
We maintain records of processing activities proportionate to a small organisation, covering purposes, categories, recipients, retention and security. We consider data protection impact assessments when a project is likely to result in high risk to individuals, for example large-scale profiling inside a commissioned iOS mobile solution. Website enquiry handling is not high risk. Location tracking, biometric unlock beyond ordinary device passcodes, or covert monitoring would be high risk and would not be implemented as a casual extra. Accountability means we can explain our decisions, not that we publish every internal note.
19. Sharing inside a group and change of control
CRADERO LIMITED is presented on this site as a single company. If in future we form a group, data would be shared only as needed for the same purposes, under the same standards. If the company is sold or merged, personal data may transfer to the successor as part of the assets, still bound by this Policy until the successor issues a new notice. You would be informed of a material change where the law expects notice.
20. Accuracy and your duty to keep records current
We rely on you to give accurate names and emails. If you change role or leave an organisation, tell us so we do not send project files to a stale address. Clients must keep TestFlight lists accurate. Incorrect exposure of a build to the wrong person is often a client-list error, not a website error. We will correct our records when you show us they are wrong.
21. Links and embedded maps
The contact page embeds a Google Map centred on 25 Belhaven Park, Muirhead, Glasgow, Scotland, G69 9FA. Google may process data under Google’s terms when you interact with that iframe. That processing is not CRADERO LIMITED’s core filing. If you do not wish to load third-party map scripts, do not interact with the map; the address is also printed as plain text. Other outbound links, if any, lead to destinations we do not control.
22. How to contact us and the ICO
Write to CRADERO LIMITED, 25 Belhaven Park, Muirhead, Glasgow, Scotland, G69 9FA. Email admin@cradero.technology. Telephone +44 7411 525634. Website https://cradero.technology. The Information Commissioner’s Office can be reached via ico.org.uk. We will cooperate with lawful investigations. We will not provide a theatrical privacy dashboard that pretends this small professional site is a social network. We will provide the statutory substance: a named controller, a real address, a real mailbox, and a real explanation of the baths in which your data is developed.
This Policy may be updated. The date at the top of the page is the version marker. Material changes to purposes or lawful bases will be highlighted by a revised page on cradero.technology. Continued use of the site after an update constitutes notice of the new text for website visitors. Contracts in force are varied only by the variation mechanics in those contracts, not by a silent website edit.
Nothing in this Policy excludes liability that cannot be excluded under the Data Protection Act 2018 or other mandatory United Kingdom law. Nothing in this Policy gives Apple, Google, or any other platform a right to your project files. Nothing in this Policy requires you to accept cookies that are not strictly necessary. For cookies, read the Cookie Policy. For use of the website generally, read the Terms of Service. For commissioned development, read the Terms and Conditions and the statement of work. Together those sheets are the legal contact print of CRADERO LIMITED.
23. Additional detail for recruitment and suppliers
If you apply to work with us, we will process your CV, correspondence and, if we progress you, right-to-work information required by United Kingdom law. Equal-opportunity monitoring, if used, is separated from selection where feasible. Unsuccessful-applicant data is not kept longer than needed to defend a short limitation period for hiring claims. Supplier contacts are processed to manage purchase orders, due diligence and payment. We may check that a supplier is not a sanctioned party. Those checks are limited and are not a consumer-credit search on a private individual unless a separate notice is given.
24. Closed-circuit and visitor records
If you visit 25 Belhaven Park, Muirhead, Glasgow, Scotland, G69 9FA, we may keep a visitor note of your name, organisation, time and host. We do not operate a hidden surveillance product on this website. Any premises camera system, if present in future, would be signed and limited to security. We will not use visitor logs to profile your politics. We will use them to know who was in the building if an incident occurs.
25. Language, accessibility and complaints about this notice
This Policy is in English because the site language is English and the company operates in the United Kingdom. If a provision is hard to read, write to us and we will explain it in plainer sentences without diluting the legal meaning. Accessibility of the website is a design duty we take seriously as an iOS UI development firm; if a screen reader fails on a legal page, tell us. A complaint about tone is not a data-protection complaint, but we will still read it. A complaint about unlawful processing is a data-protection complaint and will be handled under section 12.
We record that CRADERO LIMITED offers Apple app development services from Glasgow and that privacy is part of chemical clarity: hidden personal detail must not leak as a light streak across a public print. That is why the contact form is short, the email is plain, the address is real, and the purposes above are finite. If a future product of our own collects more, this Policy will grow before the product ships, not after.
26. Practical examples of processing
Example one: you submit a development request describing a field-inspection idea. We store your name, email and message, reply with questions about offline use, and delete the thread on the enquiry timetable if no contract forms. Example two: you become a client. We store the contract, invoices, repository invitations and TestFlight emails you supply, for the life of the project plus the accounting retention. Example three: a stranger attempts to inject hostile content into the form. We keep logs long enough to block the abuse. Example four: a data-subject access request arrives. We search mailboxes and project stores for that person and disclose what UK GDPR requires, masking other people’s data. These examples are illustrative, not extra purposes.
Example five: a client asks us to help complete App Store privacy answers. We process the client’s descriptions of third-party SDKs. We do not silently add an SDK that collects extra identifiers. Example six: a journalist writes to admin@cradero.technology. We process that email as correspondence, not as a sale lead, unless they ask for services. Example seven: a supplier sends a quote. We process contact details to pay them. Each example stays inside the purposes already listed. If an example would require a new purpose, we would update this Policy first.
27. Data minimisation in Apple work
iPhone software development tempts teams to log too much. CRADERO LIMITED’s internal method is to ask whether a log is needed to develop the print or only to satisfy curiosity. Curiosity is not a lawful basis. Device logs shared with us should be stripped of unnecessary account content. Screenshots should not show unrelated customer names. Workshop recordings are not made by default. If a client insists on recording, they are the controller of that recording unless we agree otherwise in writing. Minimisation is how shadow detail of private lives is protected while still allowing native Apple app solutions to be built.
We also minimise our own staff access. A contractor who is only drawing an icon does not receive the production database. A billing adviser does not receive source. A web host does not receive your App Store issuer keys. This compartmenting is part of exposure control. It is not a guarantee against every mistake, but it is a genuine design choice of CRADERO LIMITED in Glasgow.
28. Supervisory cooperation and law-enforcement requests
CRADERO LIMITED will cooperate with the Information Commissioner’s Office and with United Kingdom courts. If a law-enforcement body requests personal data, we will check that the request is lawful, limited and correctly addressed. We will not volunteer extra files. We will notify the affected client unless the law forbids notice. We keep a short internal note of such requests for accountability. We do not operate a back door in custom iPhone software for any authority. If a client asks us to build covert access that would be unlawful in the United Kingdom, we will refuse. Lawful intercept duties, if they ever applied, would fall on operators under specific statutes, not on a small Muirhead development company by implication.
We may disclose data to prevent serious harm where the law permits. We will not disclose data to a private litigant without a court order or your instruction. We will not treat a journalist’s enquiry as a compulsory process. We will not treat a competitor’s letter as a warrant. Precision in recipients is part of highlight control: only the people who must see a file should see it.
29. Research, statistics and anonymisation
We may produce internal statistics such as how many development requests arrived in a quarter, without naming people. If we ever publish a case study, we will mask identities unless a client gives written permission. Anonymisation, if used, will be designed so that re-identification is not reasonably likely, taking into account other information we hold. Aggregated numbers about iOS product development methods are not personal data. Quotes from a named director in a public print require permission. This section does not create a research programme; it limits how leftover numbers may be used.
We do not contribute website form contents to industry benchmarks. We do not sell insight reports about our enquirers. If a university asked for data, we would refuse unless the data were fully anonymous and the ethics were sound. CRADERO LIMITED’s business is Apple app development services, not data brokerage.
30. Closing statement on chemical clarity of data
Personal data is a form of hidden detail. It becomes valuable only when exposure is controlled and the structure is developed correctly. That is why this Policy is long, specific to Glasgow, and tied to a real mailbox at admin@cradero.technology. If you remember only the practical path: we collect little on the website, we collect more only when hired, we keep it for defined periods, we do not sell it, we honour UK rights, and we can be visited at 25 Belhaven Park, Muirhead, Glasgow, Scotland, G69 9FA. Telephone +44 7411 525634 remains a human line in United Kingdom hours. The controller is CRADERO LIMITED. The domain is cradero.technology. The work is native Apple software. The standard is the UK GDPR and the Data Protection Act 2018. That is the final print of this notice.