DRAFT for Legal review — not yet approved. Items marked TODO must be completed before this notice is published.

Privacy notice

Last updated: TODO (date of approval)

This notice explains how we use the personal information you give us when you contact us through this website. It is written to meet the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Who we are

The data controller is TODO: full legal entity name, company number and registered office address ("we", "us").

For any question about this notice or your information, contact: TODO: privacy contact email/postal address.

What we collect

When you send us a brief using the enquiry form, we collect:

  • your name
  • your company or organisation
  • your email address
  • your phone number (optional)
  • the description of your campaign or brief, and anything else you choose to include
  • the date and time you sent it

To protect the form from spam and abuse, our hosting provider also processes technical information such as your IP address and browser details when you submit the form (see "Cloudflare" below). We do not use this to identify you.

This website does not use analytics or advertising cookies. TODO: confirm with Legal whether any wording about strictly necessary security processing by Cloudflare Turnstile is needed here.

Why we use it, and our lawful basis

We use your information to read and reply to your enquiry, to discuss and quote for the work you have asked about, and to keep a record of enquiries we have received.

Our lawful basis is our legitimate interests in responding to people who contact us about our services, and, where you are asking us to quote for or provide a service, taking steps at your request before entering into a contract (UK GDPR Article 6(1)(f) and 6(1)(b)). TODO: Legal to confirm.

We will not use your details for marketing unless you have asked us to, and we do not sell your information.

Who processes it for us

We use the following service providers ("processors"), who handle your information only on our instructions:

  • Cloudflare, Inc. — hosts this website, runs the code that receives the form, provides the Turnstile spam check, and keeps a backup copy of each enquiry in a Cloudflare D1 database. TODO: Legal to add wording that Cloudflare also adds Network Error Logging headers (Report-To/NEL), so your browser may send Cloudflare (a.nel.cloudflare.com) a technical report, including your IP address, if a connection to this website fails.
  • Resend — delivers each enquiry to our team by email. TODO: Legal to confirm Resend's contracting legal entity and data processing terms.
  • Google (Google Workspace) — our business email, where enquiries arrive and from which we reply to you.

Some of these providers are based in, or may process data in, the United States or other countries outside the UK. TODO: Legal to confirm the transfer safeguard relied on for each provider (for example the UK Extension to the EU–US Data Privacy Framework, or the UK International Data Transfer Addendum).

How long we keep it

The backup copy of your enquiry held in our website database (Cloudflare D1) is deleted automatically after 90 days. Cloudflare's point-in-time recovery (D1 Time Travel) may keep it for up to 30 further days before it is gone completely. TODO: Legal to confirm the 90-day period and this 30-day wording.

The copy that arrives in our email is kept TODO: set a period for email (for example, enquiries that do not lead to work are deleted after X months; client records are kept for Y years for accounting purposes).

Your rights

You have the right to:

  • ask for a copy of the information we hold about you
  • ask us to correct information that is wrong or incomplete
  • ask us to delete your information
  • ask us to restrict how we use it
  • object to us using it on the basis of legitimate interests
  • ask us to transfer it to you or another organisation, where this applies

To use any of these rights, contact us using the details above. We will reply within one month. There is normally no charge.

Complaints

If you are unhappy with how we have used your information, please contact us first so we can try to put it right.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator: ico.org.uk/make-a-complaint, or call 0303 123 1113.

Changes to this notice

We may update this notice from time to time. The date at the top shows when it was last changed.