Privacy Policy

Last updated: 19 August 2026

1Contact for data protection queries

Write to us about anything in this policy, including any request to exercise your rights:

• Email: [email protected]
• Post: Data Protection, Pickydata Ltd, Flat A, 51 Tredegar Street, Newport NP10 8RJ
• Telephone: +44 7480 252 597

We have not appointed a Data Protection Officer; UK GDPR does not require one for a company of our size and activity.

2What personal data we collect

Source	Data
Enquiry form on this website	Your name, email address, company name (optional), the services you tick, and whatever you write in the message field.
Email or telephone contact	Your name, email address, telephone number, and the content of the correspondence.
Web server logs (our hosting provider)	IP address, date and time of request, page requested, browser and operating system string. These are generated automatically by the web server.
Client engagement records	If you become a client: contact details for the people we work with, project correspondence, invoices and payment records.

We do not collect special category data (health, ethnicity, political opinion and the like), and we ask you not to send any in an enquiry. We do not knowingly collect data from children.

3Why we process it, and our lawful basis

Article 6 of the UK GDPR requires a lawful basis for each purpose. Ours are:

Purpose	Lawful basis
Reading and replying to your enquiry; preparing a quote or proposal	Legitimate interests (Art. 6(1)(f)) — responding to someone who has deliberately contacted us about our services. You can object at any time.
Delivering an engagement you have commissioned, and supporting it afterwards	Contract (Art. 6(1)(b)) — performance of the contract between us.
Keeping invoices, accounts and tax records	Legal obligation (Art. 6(1)(c)) — the Companies Act 2006 and UK tax law.
Remembering your answer to the cookie notice on this site	Consent (Art. 6(1)(a)), and the storage itself is covered by regulation 6 of the Privacy and Electronic Communications Regulations 2003.
Keeping the website available and secure	Legitimate interests (Art. 6(1)(f)) — running a working, secure site.

We do not send marketing email, we do not build profiles, and we do not carry out any automated decision-making or profiling that produces legal or similarly significant effects.

4How long we keep it

Record	Retention
Enquiries that do not become work	24 months from the last message, then deleted.
Client project correspondence and files	6 years from the end of the engagement (the limitation period for contract claims in England & Wales).
Invoices, accounts and tax records	6 complete financial years, as required by UK tax law.
Web server logs	Retained by our hosting provider for a rolling period, typically no more than 12 months.
Cookie notice preference	Held in your own browser until you clear your browsing data.

5Who we share it with

We do not sell your personal data, and we do not share it for anyone else’s marketing. It is shared only with the service providers we need to run the business, each acting as a processor under a written contract:

• Our web hosting provider — stores the website and generates the server logs described above.
• Our email provider — carries and stores the correspondence between us.
• Our accountant and accounting software provider — invoices and payment records.
• Fontshare (Indian Type Foundry) and Cloudflare (cdnjs) — this website loads its typefaces and one animation library from these networks. When your browser fetches those files, your IP address and browser string are visible to them. No cookies are set by us through either.

We may also disclose data where we are legally required to, for example to a court, a regulator or HM Revenue & Customs.

6International transfers

Our own records are held in the United Kingdom and the European Economic Area. The font and script networks named above operate global content-delivery networks, so a request from your browser may be served from outside the UK. Where any transfer of personal data outside the UK occurs, it is covered either by UK adequacy regulations or by the International Data Transfer Addendum to the European Commission’s Standard Contractual Clauses.

7Cookies and similar storage

This site sets no advertising, analytics or tracking cookies. It stores a single item in your browser’s local storage to remember your answer to the cookie notice. The full detail, including how to remove it, is in our Cookie Policy.

8Your rights

Under the UK GDPR you have the right to:

• Access the personal data we hold about you, and receive a copy of it.
• Rectification — have inaccurate data corrected and incomplete data completed.
• Erasure — have your data deleted, where we have no overriding legal reason to keep it.
• Restriction — have our use of your data paused while a dispute about it is resolved.
• Portability — receive the data you gave us in a structured, machine-readable format, where processing is based on consent or contract.
• Object to processing carried out on the basis of our legitimate interests.
• Withdraw consent at any time where we rely on it. For the cookie notice, clear this site’s stored data in your browser and the notice will ask again. Withdrawing consent does not affect anything done before you withdrew it.

9How to exercise them

Email [email protected] or write to the registered office. We will respond within one month of receiving your request, as the UK GDPR requires. If the request is complex we may extend that by up to two further months, and we will tell you why within the first month. There is no charge unless a request is manifestly unfounded or excessive.

10Complaints

If you are unhappy with how we have handled your personal data, please raise it with us first — we would rather fix it. You also have the right to complain to the UK supervisory authority:

Information Commissioner’s Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Helpline: 0303 123 1113
www.ico.org.uk

11Changes to this policy

If we change how we handle personal data we will update this page and change the date at the top. This version is dated 19 August 2026.