Privacy Policy

Last updated [DATE]

1. Who is responsible

This site and service are operated by [LEGAL ENTITY NAME], registered in [JURISDICTION], company number [COMPANY NUMBER], registered office [REGISTERED ADDRESS]. We are the data controller for the information described in this policy, except where section 4 says otherwise.

Data protection enquiries: [PRIVACY EMAIL].

2. What we collect

When you fill in the signup form

Everything on that form, because you typed it:

• Your name
• Your position
• Your company
• Your work email address
• Your three survey answers — what you would hand off, roughly how many hours a week, and which weekly budget band fits
• Anything you write in the optional notes box

Collected automatically when you submit

• Your IP address
• Your browser's user-agent string
• The date and time of the submission

We record these to stop the form being abused — they drive a rate limit of five submissions per hour per IP address — and to give us a record of when an enquiry arrived. Our server also writes a short line to its log when an enquiry comes in, containing the email address, company and IP.

Just browsing

If you read the site and do not submit the form, we do not build a profile of you. We do not run analytics. There is no advertising pixel, no session recording, no chat widget and no third-party script of any kind on this website. The pages load entirely from our own server.

3. Why, and on what basis

What	Why	Lawful basis
Signup form details	So a person can contact you about the service you asked about, and scope the work	Legitimate interests — responding to a business enquiry you initiated. Steps toward a contract where you go on to become a client.
Survey answers	To judge fit before either side spends time on a call, and to route you to the right person	Legitimate interests
IP address, user-agent, timestamp	Abuse prevention, rate limiting, security	Legitimate interests — keeping the service available and unabused
Client account and billing records	To run your account, take payment and meet our accounting obligations	Performance of a contract, and legal obligation for the records we must keep

We do not use your details for unrelated marketing. If we ever want to, we will ask you first, and you will be able to say no without losing anything.

4. Client and task data

Once you are a client, you will send us material to work on. That material often contains personal data about other people — your customers, staff or suppliers.

For that material you are the controller and we act as your processor: we handle it on your instructions and for no other purpose. We do not use it to train anything, we do not sell it, and we do not use it for our own ends. Where you need a formal data processing agreement, we will sign one — ask at [PRIVACY EMAIL].

Please do not send us payment card numbers, health records or government identity documents unless we have agreed the right controls with you in advance. Our acceptable use terms cover this.

5. Cookies and tracking

This website sets no cookies. It runs no analytics and no third-party trackers.

The only cookies our systems set are on the staff admin panel at /admin, which is not part of the public website: a session cookie and a CSRF token cookie, both strictly necessary for our own staff to log in securely. They are not set for site visitors and are not used to track anyone.

6. Who we share it with

We do not sell your personal data, and we do not share it for anyone else's marketing.

We share it only with:

• Our own staff and assistants, where they need it to do your work.
• Our hosting provider, [HOSTING PROVIDER], which runs the server this site sits on.
• Our payment processor, [PAYMENT PROCESSOR], for billing. Card details go to them, not to us.
• Our email provider, [EMAIL PROVIDER], for correspondence with you.
• Professional advisers and authorities, where the law requires it or to establish or defend legal claims.

If we bring in another supplier who handles personal data, we will update this list.

7. Where it goes

Our assistants work from the Philippines, so client material and the contact details needed to do your work are accessed from there. Our servers are located in [SERVER LOCATION].

Where personal data protected by UK or EU law moves outside those areas, we rely on [TRANSFER MECHANISM — e.g. Standard Contractual Clauses] and put appropriate safeguards in place. You can ask us for details of the mechanism we use.

8. How long we keep it

Data	Kept for
Enquiries that do not become clients	[N] months from the last contact, then deleted
Client account records	The life of the account, then [N] months
Billing and accounting records	As long as tax law requires, typically [N] years
Client task material	Returned or deleted on request, and within [N] days of your account closing
Server logs containing IP addresses	[N] days

9. Your rights

Depending on where you live, you have some or all of these rights over your personal data:

• Access — a copy of what we hold about you.
• Correction — have inaccurate details fixed.
• Deletion — have it erased, where we have no overriding reason or legal duty to keep it.
• Restriction — have us pause processing while a dispute is sorted.
• Portability — receive it in a machine-readable format.
• Objection — object to processing we base on legitimate interests, including any direct marketing, which we will always stop on request.
• Withdraw consent — where we relied on consent, withdraw it at any time without affecting what came before.

To use any of these, email [PRIVACY EMAIL]. We will respond within one month. We will not charge you, and we will not make the service worse for you because you asked.

If you are unhappy with how we have handled it you can complain to your data protection authority — in the UK the Information Commissioner's Office, in the EU your national authority. We would appreciate the chance to fix it first.

10. How we protect it

• The whole site is served over HTTPS, and plain HTTP requests are redirected to it.
• Enquiry data is stored on our own server with access restricted to the account that runs the service, in a directory readable only by that account.
• The admin panel is password-protected with hashed credentials, session cookies, CSRF protection and lockout after repeated failed logins.
• Staff and assistants get access only to what they need for the work in front of them, and are under confidentiality obligations.

No system is perfectly secure. If a breach affects your personal data and is likely to present a risk to you, we will tell you and the relevant authority within the time the law requires.

11. Children

This is a business service and is not directed at children. We do not knowingly collect personal data from anyone under 18. If you think a child has given us data, tell us and we will delete it.

12. Changes

If we change this policy we will update the date at the top. If a change materially affects how we use data you have already given us, we will tell you by email before it takes effect.

13. Contacting us

Privacy questions and rights requests: [PRIVACY EMAIL], or write to [REGISTERED ADDRESS]. Other ways to reach a person are on our Contact page.