Privacy notice

When you send an enquiry

Your name, email address, what you tell us you would like to talk about, and, if you give them, your company, its website and your phone number. Alongside them the form records the page you sent it from, the time, a scrambled version of your internet address that cannot be turned back into the address (used only to limit abuse of the form), and your browser’s identifying string. We use this to reply to you, to set up the call if you want one, and to keep a record of the enquiry in our own customer system. Our basis is our legitimate interest in answering people who contact us, and, where a call leads to work, taking the steps you ask for before a contract. We keep an enquiry while we might work together. Nothing deletes it automatically: we delete enquiry records by hand, when you ask us to or when we review them and find they are no longer needed. If we work together, the engagement’s own terms apply.

If we want to contact you beyond replying

We may follow up on your enquiry. If we ever want to send you anything beyond that, we will ask first or rely on the rules that allow business-to-business marketing, and every such message will carry a way to stop them.

When we share a document with you

Some documents, such as an audit report, we share by a private link and a six-digit code that we send you separately. With the link we keep your name and, if we email the link to you, your email address. Each time the link is used we record when, the country and town your connection comes from (as our hosting provider reports it), and the kind of browser. We do not record your internet address. We use this to keep the document safe and to know that it reached you, which is our legitimate interest and that of the client the document is about. The document is deleted from our storage ninety days after we share it, or sooner once the issues it describes are fixed; the record of when it was opened is kept with the records of that piece of work.

Measurement of how this site is used

This site counts how its pages are used so we can improve it. By default it records which pages are opened, when (reported by the hour or the day), the website you arrived from (its name only, never the full address), your country and at most a coarse region or city, the kind of device, and the browser and operating system family. It does not record your name, your internet address, an advertising identifier, or anything that follows you to another website. A device identifier supplied by our hosting provider is used only to avoid counting one visit twice and is discarded after twenty-four hours. Individual records are deleted after forty-eight hours; what remains is a daily count that cannot be turned back into a visit. This runs under the UK rules that allow a website’s own statistics without consent, on two conditions we meet: this clear information, and a simple, free way to object. Our basis is our legitimate interest in seeing which pages are used and where something is broken. You can object at any time, free, under “Objecting” below or on the How we measure this site page, at /measurement. The choice shown on your first visit says where. Pressing Reject in that choice does not object to this counting: Reject is your answer about the measurement that needs your consent.

Detailed analytics with Umami, only if you accept it

If you press Accept in the choice shown on your first visit, or switch detailed analytics on below, the site also uses Umami, analytics software we run privately for this site, not a service that sees other websites. It records the pages you visit and in what order, the site or campaign link that brought you here (including any campaign tags in that link), your approximate location (country, region, town or city), your device, browser, operating system, screen size and language, and which links, buttons and forms you use (that a form was sent, never what you typed in it). Your internet address is used to work out your location and to group your page views into a visit, and is not stored: Umami keeps a scrambled code made from it and your browser, which changes every month. Umami sets no cookie. Nothing from Umami loads before you have chosen, and nothing from it is requested from anywhere but this site’s own address. Our basis is your consent, which you can withdraw at any time with the switch below. We keep detailed analytics for twenty-five months; anything older is deleted automatically every night. If you press Reject, Umami never loads, not even its script.

Campaign measurement, only if you accept it

Pressing Accept also turns on campaign measurement, or you can switch it on below. Once it is on, when you arrive from an advert, email or link that names its campaign, the site records which one: the source, medium and campaign names carried in the address you arrived on, and nothing else from that address. The visit on which you first answer is never recorded this way. They are kept in one small note on your device for thirty days, so that an enquiry you send in that time can be matched to them, and the individual records are kept for up to ninety days. Our basis is your consent, which you can withdraw at any time with the switch below. If you press Reject, none of this is recorded.

Accept does not turn on advertising measurement: this site runs no adverts, so it keeps no advert identifier and no scrambled contact details with an enquiry, and it sends nothing to any advertising platform.

Changing your answer

Each switch takes effect straight away, on this page and every other. Switching one off later is as easy as switching it on.

The choice shown on your first visit, again:

Objecting

The law that lets this site count visits without asking also gives you a simple, free way to object to that counting, and this is it. The counting rests on our legitimate interest, and you have the right to object to it at any time. Untick the box and your visits stop being counted, straight away and on every page. One small note is stored on your device so the site remembers, and that note is the only thing kept. It changes nothing else about how the site works.

Your choices about measurement

These are recorded as evidence that a choice was shown and made. When the choice is shown, the site records that it was shown, on which page, the version of the words, the time, and a random reference made for that page alone; showing it sets nothing on your device. When you answer, by accepting or rejecting, the site sets one cookie, consent_ref, holding that random reference (the cookie policy lists it), and records your answer against it: what you chose, and when. No name, no internet address and no advertising identifier are kept with these records; a scrambled address used only to limit abuse is removed after twenty-four hours. The records are kept for twenty-five months.

Counting at the server

Every page request is counted at our server as a path and a verdict on whether it came from a declared crawler. No identifier of any kind is kept with it.

Staff sign-in

Part of this site is a private workspace for the three founders. Signing in uses a one-time code sent by email and sets the cookies described in the cookie policy. Visitors never sign in.

Email

If you email us, your message is handled in our Microsoft 365 mailboxes.