Privacy

Which seller this notice belongs to

This document is published by AVE17 LTD and governs an order placed on ave17.com, ave17.de, ave17.fr, ave17.es, ave17.it, ave17.uk, ave17.us, ave17.ca or ave17.eu. ave17.ge is a different seller under a different law. It is not operated by AVE17 LTD. Nothing is sold through it yet. Its own details will be published there.

This is a statement about who is answerable, not a formality. A controller is a legal person, and the rights below are exercised against that person and complained about to that person's regulator. Naming the wrong one would make every route in this notice point somewhere it does not go.

Who we are

Company

AVE17 LTD, registered in England and Wales, number 17254143

Address

128 City Road, London, EC1V 2NX, United Kingdom

Data protection

Registered with the Information Commissioner's Office, reference ZC225076

Contact

hello@ave17.com

We are the controller for the personal data described below. There is no separate data protection officer; write to the address above and it reaches the person who decides.

This site asks you for nothing

Nothing on this page is collected from you. The one record that exists is the ordinary server log of a visit, which is three sections below and is the only thing on this site you did not choose to send. No form on this site sends anything to us. Where a page offers to write a letter the boxes are filled in on your own machine, and the button opens a draft in your own mail program: nothing reaches us, and nothing is stored here, until you press send in your own client. Close the panel instead and what you typed goes with it.

The site sets no cookies and loads nothing from any other server. There is no analytics, no tag manager, no pixel, no embedded video, no external font. Your browser talks to us and to nobody else.

The site loads its code, rendering engine and fonts from ave17.com only and makes no request to another server.

What the page keeps in your browser

Three things, all of them settings you chose and none of them sent anywhere. They are kept in your browser's local storage, which is not a cookie and is never transmitted with a request.

Language

the language you picked from the menu, so the page opens in it next time

Theme

light, dark or ours

Areas read

which sections of a long page you have opened, so the page can mark them and you do not start again from the top. Off until you switch it on in the menu, and switching it off again deletes what was kept

Three instruments say the same thing about this and we are held to all three, because the pages are served into the United Kingdom, into Germany and into the rest of the Union: regulation 6 of the Privacy and Electronic Communications Regulations, section 25 of the Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz, and article 5(3) of Directive 2002/58/EC as each Member State has implemented it. Each requires your consent before anything is stored on your device, unless the storage is strictly necessary to provide something you asked for. The first two are that exception: you set them from a menu, and a choice we do not keep is a choice we did not honour. The third is not, so it is off until you switch it on, nothing is written before you do, and switching it off deletes what was kept. None of the three identifies you and none reaches us or anyone else. The menu carries a row that forgets all three at once — the language, the theme and the marks — so you do not have to go looking through your browser's own settings for a switch that would take everything from every site. Clearing your browser data does the same thing, and the site works exactly the same without any of them.

When you write to us

An email is an email. It carries whatever you put in it: your name, your address, your organisation, and what you wanted to say. We read it and we answer it. That is the whole purpose.

Where your message concerns work we might do for you, the lawful basis is Article 6(1)(b) of the UK GDPR — steps taken at your request before entering into a contract. Where it does not, the basis is Article 6(1)(f), our legitimate interest in replying to people who write to us.

Server records

Our web server writes the ordinary record of a visit: the address you connected from, the page requested, the time, and the response. It exists to investigate faults and abuse, and for nothing else. These records are kept for 30 days and then deleted, and they are never combined with correspondence or used to build a profile of anyone.

The lawful basis is Article 6(1)(f) of the UK GDPR. Our legitimate interest is keeping the site up and being able to see who is attacking it. The record is the smallest one that answers those two questions, nobody reads it unless something has gone wrong, and it is deleted after 30 days.

Where it is

Website and correspondence data are held on the company's own infrastructure in France (EEA), at OVH SAS. The systems are administered remotely by the director; access stays within AVE17 LTD. Our mail runs on the same machines; we do not use a third-party mail service.

The machines stand in a data centre operated by OVH SAS in France, which is the one processor behind this site. They are ours alone rather than shared, the disks are encrypted, and OVH has no account on them; what they provide is the building, the power and the network. Transfers from the UK to the EEA are covered by the United Kingdom's own adequacy arrangements for the EEA, so no separate safeguard is needed for them.

If you buy something

An invoice needs a name, an address and an email, and company law requires us to keep the record. We hold those for seven years, which is the retention period HMRC expects, and for no other purpose than accounting.

You can pay by bank transfer, in which case nothing passes through a third party at all, or by card. Card payments are handled by Stripe Payments Europe, Ltd., who act as a separate controller for the payment itself: your card details go to them and never to us. We see that a payment succeeded, the amount, and the last four digits.

Who else sees it

Nobody beyond what is written above. We do not sell your data, share it, or pass it to partners. We would disclose it only where the law compels us, narrowly, and we would tell you unless telling you were itself unlawful.

How long we keep it

Correspondence is kept for 24 months after our last exchange with you, then deleted. If an enquiry becomes a contract, the records belonging to that contract are kept as long as company and tax law requires.

Server records

30 days

Job applications

6 months

Correspondence

2 years

Accounting records

seven years

An application for work is kept for six months from our last exchange with you and then deleted, whether or not there was a position open. We do not run a talent pool: nothing is held against a future vacancy unless you ask us to hold it, and you can have it deleted before the six months are up by saying so.

What we never do

There is no automated decision-making on this site and no profiling, in the sense of Article 22 of the UK GDPR. Nothing here decides anything about you, scores you, or sorts you into a group.

Nothing on this site is directed at children, and we do not knowingly collect anything from anyone under 13. If you believe we hold something belonging to a child, write to us and we will delete it.

You are never required to give us anything to read this site. If you write to us, what you choose to put in the message is what we have; there is no statutory or contractual obligation on you to provide any of it, and the only consequence of leaving something out is that we may not be able to answer properly.

A future VPN service

AVE17 LTD will sell a VPN service. It is not offered through this site yet. Before it is offered, a complete VPN privacy notice will identify the controller, data, retention periods, recipients and transfers.

Your rights

Under the UK GDPR you can ask us to:

• show you the data we hold about you
• correct it if it is wrong
• delete it
• stop or limit what we do with it
• hand it to you in a portable form
• stop relying on legitimate interest, by objecting

We do not rely on consent for anything described here, so there is no consent to withdraw. Write to hello@ave17.com. We answer within one month and there is no charge; where a request is manifestly unfounded or excessive we may charge a reasonable fee or refuse it, and we would say which and why rather than go quiet.

If you are unhappy

You can complain to the Information Commissioner's Office at any time, and you do not have to raise it with us first.

ICO

ico.org.uk/make-a-complaint

Phone

0303 123 1113

We would rather you told us first, but that is your choice and not a condition.

Customer data

This notice covers this site and people who write to us. Where we operate a server for a customer, the customer is the controller and we are the processor, under a data processing agreement provided at no charge. What we can and cannot reach in that role is set out plainly on the service pages, along with how to verify it.

If you are in the European Union

The EU GDPR applies where we offer services to people in the Union or monitor their behaviour there. We do not monitor behaviour anywhere: there is no analytics on this site, no advertising network and no profiling of any kind, which is stated above and is the same answer under either regulation.

Your rights under the EU GDPR are the ones listed above, at the same address and on the same clock. You may also complain to the supervisory authority in the Member State where you live, work, or where the thing you are complaining about happened.

No EU representative under Article 27 has been appointed. Before processing that requires one begins, the representative will be named here.

If you are in the United States

We do not sell personal information and we do not share it for cross-context behavioural advertising, as the California Consumer Privacy Act defines those two words. That is why there is no "Do Not Sell or Share My Personal Information" link on this site: a link to a choice nobody has to make would suggest there is something to opt out of.

You may still ask what we hold about you, ask for a copy, ask us to correct it and ask us to delete it, at the address above. We do not charge for it, we do not ask you to make an account to do it, and nothing about your service changes because you asked.

The privacy link in the foot of every page is the one section 22575 of the California Business and Professions Code asks for.

Changes

If this notice changes in a way that affects you, the date below changes with it. We do not make silent revisions.

In force

This document has been in force since 10 November 2026.

10 November 2026

Updated.

5 September 2026

Updated.

1 September 2026

Updated.

28 August 2026

Updated.

27 August 2026

Updated.

24 August 2026

Updated.