Privacy notice

This notice explains how Spaced Consulting handles personal data. Spaced Consulting is the trading name of David Hutton, a sole trader based in Bristol, United Kingdom, who is the data controller for the processing described here. You can contact us about anything in this notice at hello at spacedconsulting dot co dot uk.

This site uses Plausible Analytics, a privacy-focused, EU-hosted service, to count visits in aggregate. It sets no cookies and stores no personal information: the measurements cover pages visited, the referring site, browser and device type, and country, and IP addresses are not retained. There are no marketing cookies and no cross-site tracking, and we do not receive or keep browsing profiles of individual visitors. The site is served by Cloudflare, whose infrastructure processes technical information such as IP addresses in server logs for security and delivery purposes.

If you email us, use the contact form on this site or book a call, we hold your name, contact details and the content of your message in order to reply and to prepare for the conversation. The lawful basis is legitimate interests, or taking steps at your request before entering into a contract. Bookings are handled by Calendly, which processes the details you enter under its own privacy notice.

The contact form does two things with your message. When a message passes the form's checks, including the spam check, it is first written to an enquiry database we run on Cloudflare, and that stored copy is kept. Only then is the message emailed to us and a short acknowledgement emailed to you.

The stored record holds your name, your email address, your company if you gave one, your message, the page you sent it from (the referring page your browser reports) and your browser's user agent string, which describes the browser and operating system you used. Your IP address is not stored in that record: the spam check and a limit on repeated submissions see it while your message is being handled, and we keep no copy of it. The automatic acknowledgement confirms that your message arrived and does not repeat your message back to you.

If you email us directly instead of using the form, nothing is written to that database. Your message is held in our mailbox, not in that database.

A contact form message can exist as two separate copies, the database record and the email in our mailbox, and they are deleted in different ways. Each is set out below.

The database record. Every stored enquiry is given a deletion date at the moment it arrives, and a process that runs once a month deletes the records that have reached theirs. The result is that the stored record is deleted within two years of the date we receive your message, with no action needed from us for that to happen. Where we have started working together, or where we need to keep a message for an ongoing matter, that record can be placed on hold. A record on hold is not deleted automatically and is kept until we release the hold; once released, it goes back on the ordinary schedule and is deleted by the next monthly run on or after its deletion date.

The mailbox copy. The monthly process covers the database record only. Messages that arrive in or are copied to our mailbox, including anything you send by direct email to the published address, are not deleted automatically. We delete those by hand, and we aim to apply the same ceiling of two years from the date the message arrived. The exception is correspondence that becomes part of client work, which follows the retention described under Working together, including the six year rule for tax and accounting records.

We sometimes contact people in their working roles at UK organisations to introduce Spaced Consulting's services. This section explains how that is done.

• What we hold: name, job title, work email address, and basic information about the organisation.
• Where it comes from: public sources only, such as Companies House, the organisation's own website and public business directories. We record the source of each contact's details and will tell you the source of yours on request. We do not buy marketing lists.
• Who we contact: corporate bodies only, such as limited companies and LLPs, in line with the Privacy and Electronic Communications Regulations. We do not send marketing to sole traders, ordinary partnerships or personal email addresses without consent.
• Lawful basis: legitimate interests, namely introducing relevant business services to people whose roles relate to them. A legitimate interests assessment is documented and available on request.
• Your choice: every message identifies us and includes a one-step way to opt out. If you opt out, we stop immediately. Your details go on a suppression list, kept permanently with the minimum information needed, so that you are never contacted again.
• Retention: if you do not respond and no business relationship develops, we delete your details within twelve months of collecting them.

If you become a client, we process the contact and business information needed to deliver the work, under the contract between us. Records needed for tax and accounting purposes are kept for six years in line with UK requirements, then deleted.

We use a small number of service providers to run the business, and this is the whole set. Cloudflare hosts this website and provides its DNS, runs the Cloudflare Turnstile spam check on the contact form, runs the code that handles every submission, and holds the enquiry database described above. Resend delivers the outbound email: the notification to us, the acknowledgement to you, and the monthly deletion notice we receive about the enquiry database. Zoho provides our mailbox, where enquiries arrive and where our replies are sent from. Calendly handles bookings and is reached by a link out from this site rather than being built into it. Gumroad handles the purchase of the templates sold through this site's product links, including payment, file delivery and receipts, under its own privacy notice; it too is reached by a link out, and we do not receive your card details. Plausible provides the aggregate website measurements described above. They process data under contract and only as needed to provide their service. Where a provider processes data outside the UK, recognised safeguards such as adequacy regulations or standard contractual clauses apply.

You have the right to access the personal data we hold about you, to have it corrected or deleted, to restrict how it is used, to receive a copy in a portable format, and to object to processing. Where data is used for direct marketing, your objection is absolute: one message is enough and it will be honoured immediately.

To exercise any right, email hello at spacedconsulting dot co dot uk. If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.