GDPR Policy

Last updated: 23 August 2026

Written by Shaun Allen.

This page is a compliance summary. The full privacy notice - what we collect, why, and for how long - is the Privacy Policy. If anything here is shorter than that notice, the Privacy Policy is the one that applies to website users.

1. How this sits with our other policies

Shaun Allen processes personal data under the UK GDPR and the Data Protection Act 2018. Cookies and similar technologies are also regulated by PECR - see the Cookie Policy. Technical and organisational measures are described in the Security Policy.

2. Controller and Data Protection Officer

Shaun Allen, 18 Pasture View, Kingswood, Hull, HU7 3AH, United Kingdom, is the data controller for this website and for enquiries and client work that come from it.

We are not required to appoint a Data Protection Officer. We do not process personal data on a large scale as a core activity, and we are not a public authority. Contact us via the contact page for any data protection matter.

3. The seven principles

Article 5 of the UK GDPR requires personal data to be:

• Lawful, fair and transparent - we explain our use in the Privacy Policy and only process on a lawful basis
• Purpose limited - collected for stated purposes (enquiries, security, legal compliance) and not reused in incompatible ways
• Data minimised - we ask only for name, email, optional phone and a message
• Accurate - you can ask us to correct what we hold
• Storage limited - we keep data only as long as needed, then delete or anonymise it
• Secure - appropriate technical and organisational measures, as in the Security Policy
• Accountable - we must be able to show we comply

4. Lawful bases we use

We only process where at least one Article 6 basis applies:

• Contract / pre-contract steps - handling a quote request you sent us
• Legitimate interests - running and securing the website, stopping abuse, and dealing with genuine business follow-up, where those interests are not overridden by your rights
• Legal obligation - where UK law requires us to keep or disclose information

We do not rely on consent for the quote form. Sending the form is a request for us to reply. We do not send marketing from this site. We do not use automated decision-making that produces legal or similarly significant effects.

5. Processors and international transfers

Hosting, email and the Cloudflare Turnstile check are provided by third parties. Where they process personal data for us they act as processors (or independent controllers for their own security products, as their terms set out). We do not sell personal data.

Transfers outside the UK are only made with an adequacy decision or another lawful safeguard (for example the UK IDTA or UK Addendum). Details sit in the Privacy Policy.

6. Your rights in practice

You can ask for access, correction, erasure, restriction, portability (where it applies), and you can object to legitimate-interests processing. You can complain to the ICO.

Write to us via the contact page. We will reply within one month, or tell you if we need up to two extra months. We may ask you to prove who you are. We will not charge a fee unless a request is clearly unfounded or excessive.

Some rights are not absolute. For example we may refuse erasure if we still need the data for a legal claim or a legal duty. We will explain if we cannot do what you have asked.

7. Personal data breaches

If a breach is likely to result in a risk to people’s rights and freedoms, we will notify the ICO without undue delay and, where feasible, within 72 hours of becoming aware. If the risk is high, we will also tell the people affected so they can protect themselves. We keep an internal record of breaches. See the Security Policy for how we reduce the chance of a breach.

8. Accountability

For a business of this size we keep our processing simple: no marketing database, no advertising cookies, and no form archive on the public website. We review this approach if the services or tools we use change. We would carry out a data protection impact assessment if we ever planned high-risk processing (we do not currently).

Use of the site is also governed by our Terms of Service.

9. Changes to this policy

We update this page when the law or our processing changes. The date at the top will change. Significant changes will also be reflected in the Privacy Policy.

Return to home