Draft — not legally approved
Privacy notice
This is a working draft that describes the enquiry flow as implemented in this website. It is not legal advice and has not been reviewed by a solicitor. Business identity, lawful basis wording and retention periods still need a real decision.
Who we are
The site currently uses the placeholder name Agency Name. The legal entity, ICO registration (if required), and a contact address have not been confirmed. When those details exist they should replace this paragraph.
What we collect
The enquiry form collects your name, business name, email address, optional phone number, optional website, and a message. A hidden honeypot field is used only to filter automated submissions.
How we use it
We use these details to reply to your enquiry. Submitting the form is not consent for marketing emails, SMS or advertising. We do not add you to a mailing list from this form.
Who we send it to
In production, enquiry messages are sent by email using Resend, from a configured sender address to a configured inbox. Your email is used as the reply-to address. Operational logs do not store the message body or raw personal details.
Rate limiting
To reduce abuse, the form is rate limited. In production this uses a persistent store (Upstash Redis) keyed to a network address supplied by the hosting platform. Development can use a labelled mock store.
Retention
Enquiry bodies are not stored in an application database. Emails sit in the recipient inbox and in the email provider according to that provider’s retention. A retention period for inbox copies has not been decided.
Analytics
We use a self-hosted Umami instance at umami.thenas.us to understand how the site is used. It records page views, named button and link clicks, and basic performance data. Custom events do not include names, email addresses, phone numbers or message contents. A click on “Send enquiry” is not treated as a successful submission.
A separate recorder script is used for session replays and heatmaps: mouse movement, clicks and scroll. Input fields and the enquiry form are masked or blocked from those recordings where the software allows it. Replay data is stored by that Umami instance according to its retention settings (typically about 30 days for replays).
Analytics and session recordings only run after you accept on the tracking banner. You can reject them, or change that choice later via “Tracking choices” in the footer. A solicitor should still confirm the lawful basis under UK GDPR and PECR. This page remains a draft.