Privacy policy

Who is responsible for your data

This site is run by Toby Kalkman, trading as Kalkman Digital, a sole trader based in Suffolk, United Kingdom. For the purposes of UK data protection law I am the data controller for any personal information you give me through this website.

You can reach me at hello@kalkmandigital.co.uk or on 07364 245748. My postal address is 10 Irex Road, Lowestoft, Suffolk, NR33 7BU.

What I collect, and when

If you fill in the enquiry form, I collect the information you type into it: your name, your email address, and optionally your phone number, your current website, the area your customers are in, what kind of business you run, what you are trying to achieve, your rough timescale, and any notes you add.

If you email, ring or message me instead, I hold whatever you chose to tell me in that message.

If I look after your business’s IT, I will see what is on the screen and, at times, what is in your files and mailboxes. I do not go looking beyond what the job needs, I do not copy anything off your systems except where you have asked me to move or back up your data, and I do not discuss what I have seen with anyone. I would rather be added to an account on my own login than be told its password; where you do give me one, I do not write it down and I will ask you to change it afterwards.

If I host a wedding or memorial page for you, then for the five-year hosting term you are the controller of your guests’ photographs and words and I am your processor. The page runs on a server I manage, and nothing in it is used for anything else. A guest, or anyone in a photograph, can ask for it to be taken down by writing to hello@kalkmandigital.co.uk, and it is removed within seven days.

I do not use advertising or tracking cookies, and there are no third-party trackers embedded in these pages beyond Cloudflare Web Analytics, which sets no cookies and does not track you across sites. See the cookie notice for what it records.

Messages to AC Guttering (AC Inbox)

I build and look after AC Inbox, a private app that lets AC Guttering’s staff read the messages people send to its Facebook Page and its WhatsApp Business number in one place. If you message AC Guttering on Facebook or WhatsApp, Meta passes the message on to AC Inbox: your name or Facebook ID as Meta provides it, your WhatsApp number, what you wrote and when. AC Guttering is the controller of those messages and I am its processor; its own privacy notice explains why it keeps them.

Meta delivers the messages and they are stored in a database in AC Guttering’s own Cloudflare account. Only AC Guttering’s staff read them in the app, and I see them only when I am fixing or supporting it. Nothing is sold or used for advertising, and AC Inbox itself does not send you messages.

They are kept while AC Guttering needs them to deal with your enquiry and its job records. To have them deleted from AC Inbox, write to hello@kalkmandigital.co.uk or ask AC Guttering, saying which Facebook name or WhatsApp number they came from. AC Guttering decides on the request and replies within one month. This does not delete the copies Facebook, WhatsApp or the person you wrote to hold; those are deleted in Facebook or WhatsApp.

Why I am allowed to hold it

When you send me an enquiry, the lawful basis is legitimate interests: you have asked me to get in touch about work, and replying to you is the obvious and expected use of what you sent. If you go on to become a client, the basis becomes performance of a contract, and some records are then kept because tax law requires it.

Who else sees it

Enquiry form submissions are delivered to my inbox through Web3Forms, a form-delivery service acting as a processor on my behalf. The message passes through their systems in order to reach me.

Web3Forms is based outside the United Kingdom and runs its servers in the United States, so submitting the form sends what you wrote overseas. They do not keep form submissions — each one is processed and forwarded straight to me — but their server logs can hold personal data for a short period, which they delete periodically. If you would rather your message did not leave the UK, email or ring me instead of using the form.

This website is hosted on Cloudflare Pages. Cloudflare processes the technical information that any web server sees when you visit a page, such as your IP address, for security and delivery purposes.

My email runs on Google Workspace, so once your message reaches my inbox it is stored on Google’s servers, which are also outside the UK. Beyond those three — Web3Forms, Cloudflare and Google — I do not share, sell, rent or trade your information with anyone. Nobody is buying a marketing list from me.

How long I keep it

Enquiries that do not turn into work are deleted within twelve months. If you become a client, I keep project correspondence for the life of the working relationship and for six years afterwards, because HMRC requires business records to be kept for six years.

If you want your enquiry deleted sooner than that, ask me and I will do it.

Your rights

Under UK GDPR you have the right to:

• ask what personal data I hold about you, and get a copy of it
• have anything inaccurate corrected
• have your data deleted, where I have no legal reason to keep it
• object to my processing it, or ask me to restrict what I do with it
• ask for your data in a portable format

Email me and I will deal with it. There is no charge, and I will respond within one month.

Complaints

If you think I have handled your data badly, please tell me first so I can put it right. You also have the right to complain directly to the Information Commissioner’s Office at ico.org.uk, or on 0303 123 1113.

Changes

If this policy changes, the date at the top of the page changes with it. I will not quietly alter it and pretend otherwise.