Privacy policy
Last updated 3 September 2026
This explains what we do with personal information when you use this website or work with us. It is written to be read, not to be got past.
Who controls your data
Flintholt of Haywards Heath, West Sussex RH16 2DS is the data controller. Company number . Email info@gb3d.co.uk with anything about this policy.
What we collect, and why
When you send an enquiry: your name, email address, phone number if you give one, what your enquiry is about, and your message. We also record the time, your browser's user-agent string and a spam score, which is how we keep the form usable without a CAPTCHA. We use this to answer you and, if you become a client, to run the project.
When you become a client: the details needed to do the work and get paid — contact details, billing details, and whatever is necessary for the project itself.
When you browse: we use Vercel Analytics, which counts page views without cookies and without building a profile of you. We do not run advertising trackers, and there is no cookie banner because there is nothing to consent to.
We do not buy personal data, and we do not use your information to train anything.
Our legal basis
- Answering your enquiry and doing the work: performance of a contract, or taking steps at your request before entering one.
- Keeping records and preventing spam: our legitimate interests in running the business and keeping the form working.
- Invoices and accounts: our legal obligations.
Who else sees it
We use a small number of suppliers, and only for the purposes below:
- Vercel — hosting this website.
- Supabase — the database that stores enquiries.
- Resend — sending the emails triggered by your enquiry.
- Stripe — payments, if you become a client. Stripe handles card and bank details directly; we never see or store them.
Some of these may process data outside the UK. Where that happens it is covered by the safeguards those providers have in place, such as the UK addendum to the standard contractual clauses. We do not sell your data to anyone, ever.
How long we keep it
Enquiries that do not become work are kept for 24 months so we can pick up a conversation you started, then deleted. Client records are kept for 7 years because tax law requires it. Anything filtered as spam is deleted after 90 days.
Data we hold for our clients
When we host a system for a client, that system may hold personal data about theircustomers and staff. For that data we are a processor, not the controller: we act on our client's instructions, keep it secure, and never use it for our own purposes.
Your rights
Under UK GDPR you can ask us for a copy of what we hold about you, ask us to correct it, ask us to delete it, object to how we are using it, or ask for it in a portable format. Email us and we will respond within one month.
If you are unhappy with how we have handled your information you can complain to the Information Commissioner's Office at ico.org.uk, though we would rather you told us first so we can put it right.
Cookies
This website sets no advertising or tracking cookies. If you sign in to the admin area, a cookie is used to keep you signed in — that is strictly necessary for it to work at all, and it is not used for anything else.
Changes
If we change this policy we will update the date at the top. Anything significant, we will tell clients about directly rather than hoping they re-read the page.
This document is a draft prepared for review. It is not legal advice and has not been checked by a solicitor. The retention periods and the ICO registration position in particular need confirming before this goes live.