Tom Gould

Privacy notice

What personal data this site collects, why, how long it’s kept and your rights.

This notice explains what personal data this site collects and what happens to it. The site is run from the United Kingdom, and UK data protection law applies: the UK GDPR and the Data Protection Act 2018.

Who is responsible

I’m Tom Gould, and I run this site as an individual. I’m the controller of the personal data described here. To contact me about your data, use the contact form.

What I collect

The only personal data the site asks for is what you send through the contact form:

  • your name
  • your email address
  • the reason for your message
  • your message

There are no accounts for visitors, no newsletter, no comments and no tracking.

Why I use it

I use your message, and your name and email address, to read it and reply. Nothing else: I don’t add you to a mailing list, and I don’t sell or share your details.

The lawful basis is legitimate interests. It’s in both our interests that I can answer a message you chose to send. If you’d rather I didn’t keep it, say so and I’ll delete it.

Where it goes and how long I keep it

When you send the form, the site emails your message to me. It doesn’t keep the message itself. I keep messages in my email for as long as I might need them to reply to you or pick up the conversation again. If you’d like me to delete yours, ask at any time and I will.

The site also keeps a few short-lived records, to stop the form being used for spam:

  • Its activity log notes that a message was sent, with your name, email address and IP address. It also notes blocked spam attempts, and any spam check that couldn’t be completed, with the IP address. These notes are deleted after 30 days at most.
  • It remembers your IP address for an hour after you send a message, because it allows five messages an hour from one address.
  • If a submission looks automated, it remembers the IP address for five minutes.

Sending the form also starts a session, so the next page can tell you your message was sent. The site’s record of that session holds your IP address. It’s deleted as soon as the confirmation is shown, or about a day later if it never is.

Who else processes data

  • 123 Reg hosts the site on servers in the UK. Like most hosts, its servers may keep short-term technical logs of requests, such as IP addresses and the pages asked for, for security and to keep the service running.
  • Cloudflare sits in front of the site as a content delivery network and to protect it from attacks. Every request passes through Cloudflare, so it processes your IP address and basic details of your browser. Cloudflare may process this data outside the UK, under its own data processing terms. Its privacy policy explains more.
  • The contact form uses Cloudflare Turnstile to tell people from bots. It runs a check in your browser and sends Cloudflare technical information about your browser and connection, such as your IP address and the kind of browser you use. The site only gets a pass or fail back. I use it because it’s in my legitimate interests to keep spam out of the form. Cloudflare’s Turnstile privacy addendum explains what it collects and why.

That’s all. The site has no analytics and no advertising, and the only third-party script is Turnstile, on the contact page. Fonts are served from this site, not from a font service.

Cookies and local storage

The only cookie this site sets for a visitor is a session cookie, when you send the contact form, so the next page can confirm your message was sent. It’s removed as soon as that confirmation is shown. Turnstile, on the contact page, follows Cloudflare’s own policies. If you choose light or dark mode, that choice is kept in your browser’s local storage, not in a cookie, and never sent to me. See the cookies page for the details.

Your rights

Under UK data protection law you have the right to:

  • ask for a copy of the personal data I hold about you
  • ask me to correct it if it’s wrong
  • ask me to delete it
  • object to my using it, or ask me to restrict how I use it

To use any of these rights, send a request through the contact form. I’ll reply within one month.

If you’re unhappy with how I’ve handled your data, please tell me first so I can try to put it right. You can also complain to the Information Commissioner’s Office, the UK’s data protection regulator, at ico.org.uk.

Changes to this notice

If what the site collects changes, I’ll update this page. It shows the date it last changed.