Privacy policy

This explains what we do with personal information when you use this website or work with us. It is written to be read, not to be got past.

Who controls your data

Flintholt of Haywards Heath, West Sussex RH16 2DS is the data controller. Flintholt is a trading name of Tony Begley, a sole trader. Email tony.begley@flintholt.com with anything about this policy. ICO registration number ZC240424.

What we collect, and why

When you send an enquiry: your name, email address, phone number if you give one, what your enquiry is about, your message, and how you told us you heard about us. We also record the time, your browser's user-agent string and a spam score, which is how we keep the form usable without a CAPTCHA. If you arrived through a link carrying a referral or campaign tag — for example one we gave to a partner — we record that tag too. We use this to answer you, to understand which of our efforts are actually reaching people, and, if you become a client, to run the project. Recording where you came from uses no cookies and stores nothing on your device — the tag is read from the address of the page you sent the form from.

If we contact your business first: we sometimes get in touch with businesses we think we could genuinely help — usually because of something specific, like a website that doesn't work well on a phone. To do that we keep a short record: the business name, its trade and website, the business contact details we found publicly or were given, where we came across you, and notes on any conversation. We contact sole traders and partnerships by phone, in person, by post or on LinkedIn — not by marketing email, which the law does not allow without your consent. If you would rather we didn't get in touch, tell us once and we won't again.

When you use the cost calculator: the figures you type stay in your browser and in the page's own address — they are not sent to us unless you ask us to email them. If you do, we use your email address, and your name if you give it, to send you the breakdown. We don't keep your address afterwards: to stop the form being used to fill someone else's inbox, we keep only a scrambled, one-way fingerprint of it for 24 hours, which cannot be turned back into the address. If you also tick the box asking us to get in touch, your name, email, phone number if you give one, and the figures you entered are saved as an enquiry, and kept and used exactly like one.

If you join our email list: only if you tick the box that asks, and then click the link in the email we send to check it was you. We keep your email address, your name if you gave it, the exact wording you agreed to, and when you asked, confirmed and — if you do — unsubscribed. That record is how we can show you agreed. Every email has an unsubscribe link.

When you become a client: the details needed to do the work and get paid — contact details, billing details, and whatever is necessary for the project itself.

When you check a domain name: the name you type into the checker on our homepage is sent to Porkbun, a domain registrar, to see whether it is free. We do not keep it, and it is not linked to you unless you go on to send us an enquiry. If you choose to buy a domain yourself, you do that on Porkbun's own website, under their terms; we do not see your payment details.

When you browse: we use Vercel Analytics, which counts page views without cookies and without building a profile of you. We do not run advertising trackers, and there is no cookie banner because there is nothing to consent to.

We do not buy personal data, and we do not use your information to train anything.

Our legal basis

• Answering your enquiry and doing the work: performance of a contract, or taking steps at your request before entering one.
• Keeping records and preventing spam: our legitimate interests in running the business and keeping the form working.
• Invoices and accounts: our legal obligations.
• Emailing you the calculator's breakdown: taking steps at your request.
• Our email list: your consent, which you can withdraw at any time by unsubscribing.
• Contacting a business that hasn't contacted us: our legitimate interests in finding work, weighed against yours — which is why we keep it to business contact details, get in touch one business at a time for a specific reason, and stop the moment you ask.

Who else sees it

We use a small number of suppliers, and only for the purposes below:

• Vercel — hosting this website.
• Supabase — the database that stores enquiries.
• Porkbun — checking whether a domain name is free, when you use the checker on our homepage.
• Resend — sending our emails, and holding the addresses of people on our email list so we can send to them.
• Stripe — payments, if you become a client. Stripe handles card and bank details directly; we never see or store them.

Some of these may process data outside the UK. Where that happens it is covered by the safeguards those providers have in place, such as the UK addendum to the standard contractual clauses. We do not sell your data to anyone, ever.

How long we keep it

Enquiries that do not become work are kept for 24 months so we can pick up a conversation you started, then deleted. Client records are kept for 7 years because tax law requires it. Anything filtered as spam is deleted after 90 days.

If we contacted your business and nothing came of it, our record is deleted after 12 months. If you asked us not to contact you, we keep only your business name, trade and website — no personal details — for as long as we trade, because that record is the only thing that stops us getting in touch again by mistake.

If you ask to join our email list but never click the confirmation link, the request is deleted after 30 days. If you join, we keep your details until you unsubscribe. After that we keep your address marked as unsubscribed, with the record of what you agreed to and when you left, so we can show we stopped when asked — unless you ask us to delete it, which we will.

Data we hold for our clients

When we host a system for a client, that system may hold personal data about theircustomers and staff. For that data we are a processor, not the controller: we act on our client's instructions, keep it secure, and never use it for our own purposes.

Your rights

Under UK GDPR you can ask us for a copy of what we hold about you, ask us to correct it, ask us to delete it, object to how we are using it, or ask for it in a portable format. Email us and we will respond within one month.

If you are unhappy with how we have handled your information you can complain to the Information Commissioner's Office at ico.org.uk, though we would rather you told us first so we can put it right.

Cookies

This website sets no advertising or tracking cookies. If you sign in to the admin area, a cookie is used to keep you signed in — that is strictly necessary for it to work at all, and it is not used for anything else.

Changes

If we change this policy we will update the date at the top. Anything significant, we will tell clients about directly rather than hoping they re-read the page.