Legal

Privacy Policy

Last updated: 25 August 2026

1. Who is responsible for your data

Philip Stinson, an independent consultant trading as a sole trader in England, based in the United Kingdom, is the data controller for personal data described in this policy. Contact: via the enquiry form on the home page.

2. This website

This is a static informational site. It does not use cookies and does not run analytics or tracking scripts. It is hosted on Cloudflare Pages (Cloudflare, Inc.), which also provides the DNS and content-delivery network for this domain; Cloudflare's servers keep standard technical logs (such as IP addresses) to serve and secure the site — see Cloudflare's privacy policy. Fonts are loaded from Google Fonts, which involves your browser requesting font files from Google's servers.

The contact form on the home page is processed by FormSubmit (formsubmit.co), which applies a CAPTCHA to deter spam and forwards your submission (name, email address, company if given, and your message) to my mailbox. That information is used only to respond to your enquiry, and is not added to any marketing list. See FormSubmit's privacy policy.

The invoice-payment page collects your invoice number, the amount, and your email address, and uses a Cloudflare Turnstile check to confirm you're not an automated bot. These details are sent to a small payment service I run on Cloudflare, which creates a payment order with Revolut and passes your invoice number and email to Revolut as order references; you are then handed to Revolut's secure hosted checkout to complete payment. Card details are entered only on Revolut's page and are never seen or stored by me or this site. See Revolut's privacy policy.

3. Data I collect when you work with me

• Enquiries — the details you send through the contact form or by email.
• Contact and correspondence — name, email address, phone number, employer/company, and the content of our correspondence, when you contact me or engage my services.
• Billing information — company details, billing address, VAT/tax identifiers, and payment records needed to issue invoices and account for tax. Card payments are handled by regulated third-party payment providers; I never receive or store full card details.
• Engagement records — proposals, statements of work, deliverables and project records.

4. Why I use it and the lawful basis

• To respond to enquiries and provide services — performance of a contract (or steps taken at your request before a contract).
• To invoice, keep accounts and meet tax obligations — legal obligation.
• To maintain business records and defend legal claims — legitimate interests.

I do not sell personal data, use it for marketing lists, or make automated decisions about you.

5. Who I share it with

Only as needed to run the business: the payment provider (Revolut, to process card payments), my accountant (for bookkeeping and tax), the contact-form processor (FormSubmit), the site host, CDN and bot-check provider (Cloudflare), and the IT service providers I use for email and document storage (Google Workspace). Several of these are based in, or process data in, the United States or other countries outside the UK; where they do, transfers rely on recognised safeguards such as UK adequacy regulations, the UK extension to the EU–US Data Privacy Framework, or standard contractual clauses.

6. How long I keep it

Correspondence and engagement records are kept for the duration of our working relationship and for up to 6 years afterwards, in line with UK limitation periods and HMRC record-keeping requirements. Enquiries that do not lead to an engagement are deleted within 12 months.

7. Your rights

Under UK GDPR you can ask for access to, correction of, or deletion of your personal data, object to or restrict processing, and ask for your data in a portable format. Contact me via the enquiry form (or reply to any email in our correspondence) and I will respond within one month. You can also complain to the Information Commissioner's Office (ico.org.uk).

8. Changes

Any changes to this policy will be published on this page with an updated date.