Privacy

The controller is Ivan Krupa trading as Cereals Marketing, 36 Chatsworth Ave, Shanklin PO37 7NZ. This is an individual trading under a business name, not a company, so there is no company number to give.

Anything about this page, or about your data, goes to info@cereals.marketing or to the postal address above.

• What you send. Your name, your email address, the address of the site to be reviewed, the page and form counts, your planned launch date and anything else you write in a message or a brief.
• What the hosting produces. This site is served as plain files. The hosting provider keeps ordinary server logs, which include the internet address a request came from, the page asked for and the time it was asked for.
• What the review produces. The pages of your site as they were on the day, the notes taken, and the report written from them.
• Access details, where a site is not yet public. A preview link, a temporary viewer-level account, a holding-page password. They are asked for only where the pages cannot otherwise be opened, and they are asked for in a form you can revoke.

Access details are not to be sent in the body of an ordinary email: use a one-time secret link that destroys itself once read, a password manager's share function, or two separate routes for the username and the password. They are used to open your pages and for nothing else, are never written into the report, and are never passed to anybody.

Nothing is bought from a third party, nothing is collected from social networks, and no tracking or analytics code runs on this site.

• Answering what you ask, and quoting for the work.
• Carrying out a review you have agreed to and sending you the report.
• Keeping the accounting records the law requires a business to keep.
• Keeping this site available, and dealing with abuse of it.

Nothing is used for marketing, and no mailing list is kept.

• A contract, and the steps before one. Article 6(1)(b): answering a brief, quoting, carrying out a review and sending the report.
• A legal obligation. Article 6(1)(c): keeping records of sales and payments for as long as tax law requires.
• Legitimate interests. Article 6(1)(f): keeping the website standing and secure, and keeping a record of what was agreed in case it is ever disputed. The interest is being able to run a small business and to answer for what it did.

No consent is relied on for any of this, because nothing here needs it. There is no mailing list to sign up to and nothing to opt out of.

A review means opening your pages, which may show personal data belonging to your own customers: names in a testimonial, an email address on a contact page, a photograph. None of it is copied out, kept or used for anything, and it does not appear in the report except where the fact of it being on a page is itself the finding.

Forms are tested with invented data. Made-up names and made-up addresses are used, never a real person's, so nothing real is pushed into your systems. Where a form needs a working email address to be tested end to end, one belonging to this business is used and you are told which.

That leaves one thing for you: do not send real customer data as an example, and do not put a live database behind a form you have asked to have tested without telling me first.

Your data is not sold, not shared for anybody else's marketing, and not passed to anyone who does not need it to do a job for this business.

Four sorts of recipient handle it, each doing one job and nothing else:

• The hosting provider that serves these pages. It sees the ordinary server log of a request, and nothing you type, because this site sends nothing anywhere from your browser.
• The email provider that carries the mailbox at the address on this page. It carries whatever you write to it, as any mail provider does.
• Stripe, which takes payment on a page it hosts and gives me back the fact that an order was paid, not your card number.
• A bookkeeper or accountant, where one is used to prepare the accounts and the tax return, who sees the record of the sale rather than your brief or your report.

Each acts on instructions and for this business alone, under a written agreement. Nobody else sees your data unless the law requires it to be handed over, and if that ever happens you are told unless telling you is itself unlawful.

The work itself is done in the United Kingdom, and your brief, your pages and your report are held here. Some data reaches a provider outside it: Stripe is a global payment business and handles a payment partly outside the United Kingdom.

Where that happens the transfer is made lawful in one of the ways the law allows: adequacy regulations covering the country concerned, or the International Data Transfer Agreement, or the Addendum to the standard contractual clauses. Ask and you are told which applies and sent a copy of the safeguard relied on.

• Enquiries that do not become orders: 12 months, then deleted.
• Orders, reports and the correspondence around them: 6 years after the end of the tax year they fall in, which is what tax law requires of the records behind them.
• Notes and screenshots taken during a review: 12 months after the report is sent, then deleted. Ask sooner and they are deleted sooner.
• Access details for a site under review: deleted within 7 days of the report being sent, and not kept in the records above. Switch the access off or change it at your end as well.
• Server logs: for as long as the hosting provider keeps them, which is short and outside my control.

Over your own data you have the right to:

• be told what is held and be given a copy of it;
• have anything wrong corrected;
• have it deleted, where there is no legal reason to keep it;
• have its use restricted while a dispute about it is sorted out;
• object to it being used on the basis of legitimate interests;
• receive what you supplied in a machine-readable form, or have it sent to somebody else.

Write to info@cereals.marketing and you get an answer within one month. There is no charge, and asking costs you nothing else either.

If something has gone wrong, tell me first: that is the quickest way to have it put right, and trying costs you no other right.

You may complain to the Information Commissioner's Office at any time, whether or not you have written to me. Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, and ico.org.uk.

You are under no obligation to give any of it. Nothing here is collected because a rule says it must be.

The consequence is practical rather than punitive: without an address for the site there is nothing to review, and without a way of reaching you there is no way to send a quotation or a report.

No decision about you is made by automatic means, and there is no profiling. Every quotation, every report and every answer on this site is written by a person.

The form that suggests a package from the counts you type is arithmetic on your own screen, and so is the reference it gives your enquiry. Neither decides anything: the package and the price are confirmed by hand afterwards.

The form hands the finished brief to your own email program and stops there. Nothing is transmitted by this website: you read the message, you press send, and what reaches me is the brief you saw and nothing besides. It is used to answer you and to quote for the work.

This site sets no cookies. It stores nothing in your browser: no local storage, no session storage, no identifiers, no tracking pixel, no analytics, no advertising code, and no fonts or scripts fetched from anybody else's server.

There is therefore nothing to consent to and nothing to refuse, which is why you were not asked. If that ever changes, this page will say what is set, what it is for and how long it lasts, and consent will be asked for before anything that is not strictly necessary is stored.

The date of this version is at the top of the page. A material change will be described here rather than slipped in, and the date moved.

The version that applies to your order is the one in force on the day it was confirmed.