Privacy policy
Last updated:
This policy explains what personal data this website collects, why, who it is shared with, how long it is kept and what your rights are under UK data protection law (the UK GDPR and the Data Protection Act 2018).
Who is responsible for your data
GR9 is run by a sole trader, who is the controller of your personal data: TODO: controller's full legal name, trading as GR9.
Postal address: TODO: controller's postal address
For anything about your data, email enquiries@gr9.co.uk.
What I collect
When you send an enquiry through the contact form, I collect:
- your name
- your email address
- your phone number, if you give it
- your company name, if you give it
- your message
You don't have to give me any of this, but I need your name, email address and message to reply.
To stop the form being abused, your IP address and email address are held briefly in the server's memory to limit repeated submissions. They are not saved to the database for this purpose.
How I use it and why I'm allowed to
I use your details only to reply to your enquiry and to talk to you about the work you asked about. The lawful basis is that you have asked me to do this, as a step before possibly entering into a contract with you, and my legitimate interest in responding to people who contact me.
I will not send you marketing emails unless you have agreed to receive them. You can change your mind at any time.
Where it is stored and who handles it
- Railway hosts this website and its database. Enquiries are stored in a database in the EU (Amsterdam).
- Resend sends two emails when you submit the form: a notification to me and an automatic acknowledgement to you. Resend is used in its EU region. The acknowledgement is a fixed message and does not repeat what you wrote.
- n8n runs the automation that sends those emails. It is self-hosted on the same Railway infrastructure, so your data is not passed to n8n as a company. If an email fails to send, a record of that attempt, including your name and email address, is kept in n8n so I can fix the problem.
Railway and Resend act as processors on my behalf and may only use your data to provide their service to me. Both are based in the United States. Your data is stored in the EU, but if either provider accesses it from outside the UK or EU, the transfer must be covered by appropriate safeguards. TODO: confirm the transfer safeguards in each provider's data processing terms.
I do not sell your data or share it with anyone else unless the law requires me to.
Cookies and analytics
The public pages of this website do not set cookies. The only cookie is a login cookie used by me in the site's admin area.
I plan to use Umami, a privacy-friendly analytics tool that I host myself, to count visits and see which pages are useful. It does not identify you and no cookies are used for analytics.
How long I keep it
Enquiries are kept for 24 months from the date you contact me and then deleted. If you become a customer, I keep the records I need for that work for as long as the law requires.
Your rights
You have the right to:
- ask for a copy of the personal data I hold about you
- ask me to correct data that is wrong or incomplete
- ask me to delete your data
- ask me to restrict how I use your data
- object to how I use your data
- ask for your data in a format you can take elsewhere
- withdraw your consent at any time, where I rely on consent
To use any of these rights, email enquiries@gr9.co.uk. I will reply within one month. There is normally no charge.
Complaints
If you are unhappy with how I have handled your data, please tell me first so I can try to put it right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator: ico.org.uk/make-a-complaint.
Changes to this policy
If I change how I use your data, I will update this page and the date at the top.