Privacy Policy

Who is responsible for your information

This website is operated by Gareth Spenceley, an independent creative director trading as a sole trader, based in West Bridgford, Nottingham, United Kingdom, NG2. Gareth Spenceley is the data controller for the personal information described in this policy, under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

You can contact Gareth Spenceley about anything in this policy through the private enquiry form on this website, or by message via LinkedIn (linkedin.com/in/garethspenceley).

ICO registration number: [to be added once registered with the Information Commissioner's Office].

The short version

Your information is used only to respond to your enquiry and to continue any conversation or working relationship that follows from it. It is never used for marketing, never sold, rented or traded, and never shared with other companies for their own purposes. You can ask for it to be deleted at any time.

Information collected

When you submit an enquiry: your name, business or company name, email address, optional website and phone number, the type of project, what needs to change, the outcome you are looking for, your timing and indicative investment range, and your confirmation of consent.

To protect the enquiry form from spam and abuse: a one-way, irreversible fingerprint (hash) derived from your network address. It cannot be used to identify you and is used only to limit repeated automated submissions.

For journal readership: an anonymous browser identifier is converted into a one-way hash and used only to count one view per article per day. It is not linked to an enquiry, account or identifiable profile.

If you become a client: the contact, project and invoicing details reasonably needed to deliver and manage the work.

This website does not use advertising or cross-site tracking technologies and does not build identifiable visitor profiles.

How and why it is used

To read, consider and reply to your enquiry, and to continue any conversation about it — lawful basis: taking steps at your request before entering into a contract, and legitimate interests in responding to business enquiries.

To deliver, manage and invoice work you commission — lawful basis: performance of a contract, and compliance with legal obligations such as tax and accounting record-keeping.

To keep the website secure and prevent spam — lawful basis: legitimate interests in protecting the website and its visitors.

Your information is never used for automated decision-making or profiling, and never used for marketing.

Who it is shared with

Personal information is not sold or shared with third parties for their own use. It is processed only by carefully chosen service providers who host the website and its secure database, acting solely on instructions and under contractual data protection obligations.

Information may be disclosed where required by law, for example to HM Revenue & Customs for tax purposes or in response to a lawful request from a regulator or court.

International transfers

Some hosting providers may store or process data outside the United Kingdom. Where this happens, transfers are protected by an adequacy decision or by appropriate safeguards such as the UK International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses.

How long it is kept

Enquiries that do not lead to work are deleted within 24 months of the last contact.

Client records, contracts and invoices are kept for six years after the end of the tax year in which the work concluded, as required for HMRC and limitation purposes, then securely deleted.

Spam-protection fingerprints are kept for no longer than necessary to enforce rate limits.

How it is protected

Information is transmitted over encrypted connections, stored in an access-controlled database with row-level security, and can be read only by the website owner after secure sign-in. Public visitors cannot read any enquiry data.

Your rights

Under UK data protection law you have the right to: be informed about how your data is used; access a copy of your data; have inaccurate data corrected; have your data erased; restrict or object to processing; and data portability where applicable. Where processing relies on consent, you may withdraw it at any time.

To exercise any of these rights, contact Gareth Spenceley through the private enquiry form on this website, or by message via LinkedIn (linkedin.com/in/garethspenceley). You will receive a response within one month. There is normally no charge.

Complaints

If you are unhappy with how your information has been handled, please get in touch first so the matter can be put right. You also have the right to complain to the Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF — ico.org.uk — telephone 0303 123 1113.

Changes to this policy

This policy may be updated to reflect changes in law or practice. The date at the top shows when it was last revised.