Privacy notice.

1. Controller

The data controller for personal data processed in connection with this website is:

HybridBase Global LLP
128 City Road
London EC1V 2NX
United Kingdom
Email: hello@hybridbase.com
Companies House registration: OC459029

HybridBase Global LLP is a limited liability partnership registered in England and Wales. We have not appointed a Data Protection Officer; data protection enquiries should be addressed to the email above.

2. What we collect, and why

2.1 Browsing the website

The website is a static site served by our own infrastructure. We do not use analytics, advertising trackers or third-party cookies. The only logs we retain are server access logs (IP address, requested URL, response status, user-agent string, timestamp), kept for up to 30 days for operational and security purposes.

• Legal basis: legitimate interests (UK GDPR / GDPR Art. 6(1)(f)) — operating the website and protecting it against abuse.
• Recipients: our hosting infrastructure only. No third party.

2.2 Contact form (/contact/)

When you complete the contact form we collect: your name, email address, the firm you represent, and the message you write. The form is processed by our form-handling provider, who forwards the submission to our inbox.

• Purpose: to respond to your enquiry.
• Legal basis: the steps necessary to enter into a contract at your request (Art. 6(1)(b)) and our legitimate interests in responding to commercial enquiries (Art. 6(1)(f)).
• Retention: the email itself is retained in our mail system for up to 36 months from the date of last contact, after which it is deleted unless an active engagement requires it to be kept longer.

2.3 Talent form (/talent/)

When you express interest in joining the network we collect: your name, email address, country of residence, the work you do, your day-rate range, your availability and any links or material you choose to share with us.

• Purpose: to assess whether your profile is a fit for engagements we are working on, now or in the future, and to contact you about specific opportunities.
• Legal basis: the steps necessary to enter into a contract at your request (Art. 6(1)(b)) and our legitimate interests in maintaining a network of specialists (Art. 6(1)(f)).
• Retention: for as long as we believe your profile is reasonably matchable to engagements we work on, and not longer than 36 months from your last contact with us, unless you ask us to keep it longer or to delete it sooner.

3. Recipients and sub-processors

We do not sell or rent personal data. The following processors handle personal data on our behalf:

Web3Forms (form processing)

Web3Forms is a service operated by Web3Creative, registered in Kerala, India. Form submissions transit Web3Forms' infrastructure (hosted in AWS US-East) before reaching our inbox. Web3Forms retains form submissions on their infrastructure for up to one year before automatic deletion. Web3Forms uses CleanTalk and Akismet for spam filtering, which receive the submitter's IP address and email address. Web3Forms' privacy policy is at web3forms.com/privacy.

Microsoft 365 (mail and inbox)

We use Microsoft 365 for the email accounts that receive form submissions and ongoing correspondence. Microsoft Ireland Operations Limited acts as our processor under Microsoft's Data Protection Addendum.

Cloudflare (DNS)

Cloudflare provides authoritative DNS for hybridbase.com. Cloudflare does not see traffic to the site (the site is served directly by our own infrastructure, not through Cloudflare's proxy), but DNS lookups themselves transit Cloudflare's network.

4. International transfers

Some of the processors above are established outside the United Kingdom and the European Economic Area:

• Web3Forms / Web3Creative: India (controller) and the United States (processing infrastructure). India and the United States are not the subject of UK adequacy regulations or an EU Commission adequacy decision in respect of Web3Forms' specific transfer mechanism. We use Web3Forms in reliance on the Standard Contractual Clauses incorporated by reference into Web3Forms' terms of service. We acknowledge that this is an area of legal uncertainty following the Schrems II decision and we keep the choice under review.
• Microsoft 365: primary processing in the European Union (Ireland data residency). Microsoft uses sub-processors in the United States; transfers are covered by the EU-US Data Privacy Framework and the equivalent UK extension.

If your firm's procurement function requires a signed Data Processing Agreement and a Transfer Impact Assessment for either of the above transfers, we will provide what we can on request. Some sub-processor agreements (notably Web3Forms) are accepted by reference rather than negotiated; we will be transparent about which is which.

5. Your rights

You have the right to:

• Access the personal data we hold about you (Art. 15).
• Have inaccurate data corrected (Art. 16).
• Have your data deleted, where applicable (Art. 17).
• Restrict our processing in certain circumstances (Art. 18).
• Receive your data in a portable form (Art. 20).
• Object to processing carried out on the basis of legitimate interests (Art. 21).
• Withdraw consent at any time, where consent is the legal basis (Art. 7(3)).

To exercise any of these, email hello@hybridbase.com. We will respond within one month.

You also have the right to lodge a complaint with a supervisory authority. Our lead authority is the UK Information Commissioner's Office (ico.org.uk). If you are resident in Germany, Austria or Switzerland you may also complain to your local data protection authority.

6. Automated decision-making

We do not make decisions about you using fully automated means (Art. 22). We use AI tooling to widen the search beyond our network when sourcing candidates against a brief; the AI surfaces candidates, but every name reaching a partner is reviewed by us. The decision to put a name forward — and the decision a partner then makes about whether to engage that person — is made by humans.

7. Whether you are required to provide data

You are not required to provide personal data through this website. If you do not provide it via the contact or talent forms, we cannot respond to your enquiry or assess your fit for engagements; that is the only consequence.

8. Security

The website is served over HTTPS (TLS 1.3 where supported by the client). The forms transit Web3Forms over HTTPS. Email is in transit using opportunistic TLS via the recipients' mail servers. Our inbox is protected by multi-factor authentication.

9. Changes to this notice

We will update this notice when our practices change or when the law requires it. Material changes will be reflected in the "last updated" date at the top of the page. Where we hold your contact details and the change is material to you, we will notify you directly.

10. How to reach us

By email: hello@hybridbase.com.
By post: HybridBase Global LLP, 128 City Road, London EC1V 2NX, United Kingdom.

Last updated: 2 May 2026.