Privacy Policy

Last updated: 23 August 2026

Written by Shaun Allen.

This Privacy Policy is the main notice for visitors and enquirers. For a shorter summary of how we meet UK GDPR, see our GDPR Policy. Cookies are covered in our Cookie Policy. Security measures are set out in our Security Policy.

1. Who we are and how to contact us

The data controller is Shaun Allen, a sole trader based at 18 Pasture View, Kingswood, Hull, HU7 3AH, United Kingdom, operating https://www.shaunallen.co.uk. We provide website design, secure hosting, business email and related digital services to UK small and medium businesses.

For privacy questions, or to exercise your rights, contact us via the details on our contact page (email and telephone).

We do not appoint a Data Protection Officer. We are not a public authority and we do not carry out processing that requires a DPO under the Data Protection Act 2018. Privacy enquiries come to us directly.

2. The law that applies

We process personal data in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Electronic communications and cookies are also covered by the Privacy and Electronic Communications Regulations 2003 (PECR), as explained in our Cookie Policy.

This notice is written to meet Articles 13 and 14 of the UK GDPR: we tell you who we are, what we collect, why, the lawful basis, who receives it, how long we keep it, and what rights you have.

3. What personal data we collect

We only collect what we need to run this website, respond to enquiries and, if we work together, deliver our services.

3.1 Data you give us

• Name - when you submit the quote form
• Email address - when you submit the quote form
• Telephone number - only if you choose to provide it
• Message content - your project details and anything else you include

If a form submission fails (for example a validation error), we may keep those fields in your session so you do not have to retype them. That session data is cleared after a successful send or when you close your browser.

3.2 Data collected automatically

• Technical data - IP address, browser type, device type and operating system. We use this for security, rate limiting and to operate the site.
• Approximate location - we may infer country from your IP so we can apply our UK-only enquiry rule and reduce abuse.

We do not buy mailing lists, scrape contact details, or collect special category data (such as health, race or political opinions) through this website. Please do not include that kind of information in the form.

4. How and why we use your data

We only process personal data where a lawful basis under UK GDPR Article 6 applies:

• Responding to your quote request - name, email, optional phone and message. Lawful basis: steps at your request before entering a contract (Article 6(1)(b)). If no contract follows, we may keep a short record of the enquiry under legitimate interests (running a business and dealing with follow-up questions).
• Security and abuse prevention - technical data, session tokens, rate limiting and Cloudflare Turnstile. Lawful basis: legitimate interests (protecting the site, our systems and other users from spam, fraud and misuse).
• Legal compliance - where UK law requires us to keep or disclose information. Lawful basis: legal obligation.

We do not send marketing emails from this website. If we ever did, PECR would require a lawful basis and, for most electronic marketing, consent. We do not use automated decision-making or profiling that produces legal or similarly significant effects.

5. Who we share your data with

We do not sell or rent personal data. We may share it only with:

• Service providers acting as processors on our instructions - for example hosting and email delivery. They must keep the data confidential and use it only for the service we have asked them to provide.
• Authorities - where the law requires it, such as a court order or a request from a regulator or law enforcement body.

Quote submissions are emailed to us. That means the message travels through our email and hosting providers. We do not pass enquiries to third-party sales networks.

6. International transfers

We aim to keep personal data in the United Kingdom. Some providers may process data in the UK, the European Economic Area, or another country that the UK has found adequate. If a transfer is ever needed to a country without an adequacy decision, we will use a lawful safeguard (for example the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses) and tell you where the law requires.

Cloudflare Turnstile, used to protect the form, may involve processing outside the UK under Cloudflare’s terms and appropriate transfer tools. See also our Cookie Policy.

7. How long we keep your data

• Quote form emails - we do not store submissions in a website database. Emails are kept only as long as needed to deal with the enquiry, any follow-up, and any legal or accounting need. If we do not work together, we typically delete or archive the correspondence once it is no longer needed (usually within 12 months, sooner if you ask us to erase it and no exception applies).
• Session data - the session cookie lasts until you close your browser. Saved form values and the CSRF token are replaced or cleared after a successful submission; the short submission cooldown remains for the session.
• Rate-limit records - a one-way hash derived from the client IP and submission timestamps are held in temporary server storage to enforce form limits. Stale records are removed after no more than 24 hours.
• Hosting logs - our hosting infrastructure may create standard access and error logs for security and fault diagnosis. We do not maintain a separate analytics or visitor-log database. Retention follows the shortest operational period available under the provider and server configuration, and records are deleted or rotated when no longer needed.

8. Your rights

Under UK GDPR and the Data Protection Act 2018 you can:

• Access a copy of the personal data we hold about you
• Rectify inaccurate data
• Erase your data in certain circumstances (the “right to be forgotten”)
• Restrict processing in certain circumstances
• Port data you provided, where processing is automated and based on consent or contract
• Object to processing based on legitimate interests. We must stop unless we have compelling legitimate grounds that override your interests, or the processing is for legal claims
• Withdraw consent where we rely on consent. Withdrawal does not affect processing already carried out
• Complain to the Information Commissioner’s Office

To use these rights, contact us via the contact page. We will respond within one month. We may extend by up to two further months for complex or numerous requests and will tell you if we do. We may need to verify your identity. There is usually no fee; we may charge a reasonable fee or refuse a request that is clearly unfounded or excessive.

Name, email and a message are not required by law, but we cannot reply through the form without them. A telephone number is optional. Technical data is collected automatically so the site can run securely.

A fuller explanation of these rights is in our GDPR Policy.

9. How we protect your data

We use HTTPS, security headers, a secure session cookie, form validation and Cloudflare Turnstile. We do not keep form submissions in a public website database. More detail is in our Security Policy. If a personal data breach is likely to risk your rights and freedoms, we will notify the ICO and, where the law requires, you.

10. Children

This website is aimed at UK businesses, not children. We do not knowingly collect personal data from anyone under 13. If you believe a child has sent us personal data, contact us and we will delete it.

11. Changes to this policy

We may update this policy when our practices or the law change. The date at the top will change when we do. For significant changes we may also add a notice on the site. Continued use of the site after an update means the new notice applies to later visits. Our Terms of Service explain use of the site more generally.

Return to home