Privacy Notice
Effective date · 19 July 2026
This notice explains how ShedReset collects and uses your personal data when you visit shedreset.com (“the Site”). It is written in plain English.
The waitlist is not open yet. The Site does not currently collect email addresses or mobile numbers. If and when we open the waitlist, this notice will be updated with the specific processing terms before the form goes live.
1. Who is responsible for your data
ShedReset, operated by Bull Enterprises (Malta). Contact for all data protection matters: use the in-site contact form.
ShedReset (operated by Bull Enterprises) is the “controller” of your personal data under Article 4(7) GDPR — we decide why and how your data is processed. We have not appointed a separate Data Protection Officer at this stage; the contact above handles all data requests.
2. What data we collect
| Data | When collected | Example |
|---|---|---|
| Message content and contact details you provide | Only when you voluntarily submit the in-site contact form | your email address, optional name, subject, and message body |
| Page interaction data | Automatically, while you browse | timestamps of visit, scroll depth, which sections you engaged with, device type, browser, referring page/URL |
We do not currently operate a waitlist form, do not ask for your name, address, payment details, or any special category data (Article 9 GDPR).
3. Why we process your data and our legal basis
| Purpose | Data used | Legal basis (GDPR) |
|---|---|---|
| Replying to the message you send via the in-site contact form | Your email address and message content | Art. 6(1)(b) — taking steps at your request prior to entering into a contract, or Art. 6(1)(f) — legitimate interest in responding to inbound enquiries |
| Understanding how visitors use the Site, so we can improve it | Page interaction data | Art. 6(1)(f) — legitimate interest, in aggregate only |
4. What we do NOT do
- We do not use your data for profiling or automated decision-making that produces legal or similarly significant effects on you.
- We do not sell your data.
- We do not load third-party advertising or analytics pixels on the Site.
- Fonts are self-hosted on our own domain; the Site does not contact any third-party CDN before or during page load.
5. How long we keep your data
We keep contact-form submissions for 24 months from the date of your message, or until you ask us to delete them — whichever happens first. After that, we delete or irreversibly anonymise them unless a longer retention period is required by law (storage limitation, Art. 5(1)(e) GDPR).
6. Who we share your data with
At present, contact-form submissions are stored on our own backend (shedreset.pplx.app). We use no additional third-party processors. When we adopt an email delivery platform, this notice will name the vendor, its location, and its safeguards before that processor goes live.
7. International data transfers
At this stage we do not intentionally transfer your personal data outside the European Economic Area (EEA). If a US-based processor is later selected, transfers will rely on an adequacy mechanism under Chapter V GDPR — typically Standard Contractual Clauses (Art. 46(2)(c) GDPR) or the EU-US Data Privacy Framework — and this notice will be updated to name the specific safeguard used before that processor goes live.
8. Your rights
Under Articles 15–22 GDPR, you have the right to:
- Access — get a copy of the data we hold about you (Art. 15)
- Rectification — correct inaccurate data (Art. 16)
- Erasure — ask us to delete your data (Art. 17)
- Restriction — ask us to limit how we use your data (Art. 18)
- Portability — receive your data in a portable format (Art. 20)
- Object — object to processing based on legitimate interest (Art. 21)
- Withdraw consent — stop marketing emails at any time, free of charge (Art. 7(3))
To exercise any of these rights, use the in-site contact form. We will respond within one month (Art. 12(3) GDPR).
You also have the right to lodge a complaint with Malta’s supervisory authority: Office of the Information and Data Protection Commissioner (IDPC), Floor 2, Airways House, Triq Il-Kbira, Tas-Sliema SLM 1549, Malta. Email: idpc.info@idpc.org.mt · Phone: +356 2328 7100 · Web: idpc.org.mt.
9. Cookies and tracking
The Site uses first-party JavaScript only to record page interaction data (timestamps, scroll depth, section engagement, device type, browser, referrer). This code runs on our own domain, is not sold or shared with ad networks, and does not set third-party tracking cookies or pixels.
- Strictly necessary technical storage is exempt from consent under ePrivacy Directive Art. 5(3), as implemented in Malta.
- Any non-essential analytics storage that is not strictly necessary will only be activated with your prior consent, obtained via a separate cookie banner mechanism. At present, no such non-essential cookies are set.
- We do not use third-party advertising pixels, retargeting tags, or cross-site tracking of any kind.
10. Changes to this notice
We will update the effective date above whenever we make material changes to this notice, and — where required — seek fresh consent.
11. Contact
Questions about this notice or your data: contact us.
Legal mapping reference: GDPR (EU) 2016/679 Art. 5, 6, 7, 9, 12–22, 28, Ch. V, Recital 26; ePrivacy Directive 2002/58/EC Art. 5(3); Malta Data Protection Act (Cap. 586); Malta Processing of Personal Data (Electronic Communications Sector) Regulations.