Privacy Notice

1. Data Controller

The data controller responsible for your personal data is:

2. Information I Collect

I may collect and process the following types of data:

Personal Data: Name, email address, and any other information you provide when contacting me or subscribing to communications.

Non-Personal Data: Information collected via cookie-less analytics, such as site visits and traffic patterns, which cannot identify you directly.

3. Lawful Basis for Processing

Under GDPR, I must have a lawful basis to process your personal data. The lawful bases I rely on are:

• Consent (Article 6(1)(a)): Where you have given clear consent for me to process your personal data for a specific purpose, such as subscribing to my newsletter or marketing communications.
• Contract (Article 6(1)(b)): Where processing is necessary for the performance of a contract with you, or to take steps at your request before entering into a contract, such as providing services you have purchased.
• Legal Obligation (Article 6(1)(c)): Where processing is necessary to comply with a legal obligation, such as tax or regulatory requirements.
• Legitimate Interests (Article 6(1)(f)): Where processing is necessary for my legitimate interests or those of a third party, provided those interests are not overridden by your rights. This includes improving my services, website analytics, and fraud prevention.

4. How I Use Your Data

I use your data to:

• Provide and improve my services.
• Respond to your inquiries or requests.
• Send relevant marketing information (if you have opted in).
• Monitor and analyze website performance using GDPR-compliant analytics.

5. How I Protect Your Data

I implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. While I strive to secure your data, no method of transmission over the internet is entirely secure.

6. Sharing Your Data

I do not share your personal data with third parties, except:

• When required by law or regulation.
• To protect my legal rights.

7. International Data Transfers

Your personal data may be transferred to, and processed in, countries outside the European Economic Area (EEA). Where this occurs, I ensure appropriate safeguards are in place, such as:

• Standard Contractual Clauses approved by the European Commission.
• Adequacy decisions by the European Commission for countries with adequate data protection laws.

8. Cookies and Analytics

• Only with your consent. PostHog and the site visit log do not run, and nothing is stored on your device for analytics, until you choose "Accept analytics" in the cookie banner. If you choose "Essential only", or make no choice, neither is loaded.
• PostHog. With consent, I use PostHog, hosted in the EU (Frankfurt), to understand how the site is used. It records the pages you visit, the site you came from, your browser and device type, approximate location derived from your IP address, and a few key actions such as submitting an enquiry or starting a checkout. If you are signed in, it links this to your account ID only, never your name or email. Session recording and automatic click tracking are switched off. PostHog stores a random identifier in a cookie and in your browser's local storage.
• Cloudflare Web Analytics. I use Cloudflare Web Analytics, which is cookieless and does not track individual visitors. It counts page visits without storing anything on your device, so it runs without a consent choice. It never runs in signed-in areas.
• Site visit log. With the same consent, the site also keeps its own simple log of page visits (page, referring site, device and browser type) with a random visit identifier stored in your browser.
• Why. To see which pages are useful and improve the site. The lawful basis is your consent (UK GDPR Article 6(1)(a) and PECR).
• Retention. PostHog event data is kept for up to 12 months, then deleted. The PostHog identifier stays in your browser for up to 12 months unless you withdraw consent or clear it.
• Withdrawing consent. Use the "Cookie settings" link in the footer of any page and choose "Withdraw consent". Analytics stops immediately and its cookies and stored identifiers are removed from your browser.
• Essential cookies, such as those that keep you signed in and remember your cookie choice, do not track you and cannot be switched off.

9. Your Data Subject Rights

Under GDPR, you have the following rights regarding your personal data:

To exercise any of your rights, please contact me at info@leonhardwick.com. I will respond to all requests within one month, as required by GDPR. In complex cases, this period may be extended by up to two further months, and I will inform you of any such extension.

10. Right to Lodge a Complaint

If you believe that your data protection rights have been violated, you have the right to lodge a complaint with a supervisory authority. In the UK, this is the Information Commissioner's Office (ICO):

11. Data Retention

I retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, including any legal, accounting, or reporting requirements. Specific retention periods include:

• Enquiry data: Retained for 2 years from the last communication, unless you become a client.
• Newsletter subscriptions: Retained until you unsubscribe.
• Transaction records: Retained for 7 years as required by tax legislation.
• Analytics data: Collected only with consent. PostHog events are kept for up to 12 months.

12. Third-Party Websites

This website may link to third-party websites. I am not responsible for the privacy practices of those websites, and I encourage you to review their privacy notices before providing personal information.

13. Children's Privacy

This website is not intended for children under the age of 18, and I do not knowingly collect personal data from children.

14. Changes to This Privacy Notice

I may update this notice from time to time to reflect changes in my practices or legal requirements. Updates will be posted on this page, and material changes will be communicated to you where required.

15. Contact Information

If you have any questions, concerns, or requests regarding your personal data, please contact me at:

Email: info@leonhardwick.com