How your information is handled

Who is responsible

Sefton Downes, trading as Inheirit Studio, is the data controller for this site. You can reach me at hello@inheirit.co.uk, by phone on 07906 259167, or through the contact form.

What I collect, and why

Contact form

Your name, email address, and — if you choose to give them — your phone number, the package you are interested in and a budget range, along with whatever you write in the message. I collect this only to read your enquiry and reply to it.

Anti-spam checks

Your IP address is checked briefly to limit how many enquiries can be sent from one source, and Cloudflare Turnstile runs a bot check on the form. The IP address is held in memory only for that check and is not stored or written to any database.

Analytics

If you accept cookies, Google Analytics records which pages you visit, roughly where in the world you are, and what kind of device you used. Your IP address is anonymised. If you decline, no analytics cookies are set and no identifiers are stored.

Server logs

The hosting platform keeps standard technical logs of requests, which include IP addresses. These exist so the site can be kept running and secure.

The lawful basis for each

Replying to your enquiry

Legitimate interests, and where a project follows, steps taken at your request before entering a contract. You asked me to get in touch, and holding your details in order to do so is what you would reasonably expect.

Analytics cookies

Consent. Nothing is stored until you accept, and you can decline without losing any part of the site.

Spam prevention and logs

Legitimate interests — keeping the contact form usable and the site secure.

How long it is kept

Enquiries

Kept while we are in touch and for up to 12 months afterwards, then deleted. If the enquiry becomes a project, the records are kept for six years after the final invoice, because HMRC requires it.

Analytics

Retained by Google Analytics for up to 14 months.

Anti-spam data

Not retained. The rate-limit check holds an IP address in memory for at most an hour and never writes it down.

Who else handles it

I do not sell your information or share it for marketing. A small number of suppliers process it on my behalf, under contract:

• Vercel — hosts the site and keeps the server logs.
• Resend — delivers enquiry emails from the contact form.
• Cloudflare — runs the Turnstile bot check on the form.
• Google — provides Google Analytics, only after you accept cookies.

Where it goes

Some of these suppliers are based in, or store data in, the United States. Where that happens the transfer is covered by the safeguards UK data protection law requires, such as the UK Addendum to the standard contractual clauses or the UK–US data bridge.

Cookies

No cookies are set when you arrive. The banner asks first, and only Google Analytics cookies are set if you accept — nothing is used to advertise to you. Declining leaves no cookies at all. You can change your mind at any time by clearing this site's data in your browser, which brings the banner back.

Your rights

Under UK GDPR you can ask me to do any of the following, free of charge, and I will respond within one month:

• Tell you what information I hold about you, and give you a copy.
• Correct anything that is wrong.
• Delete it, where there is no legal reason for me to keep it.
• Restrict or object to how it is used.
• Provide it in a portable format.
• Withdraw your consent to analytics, which you can also do by clearing the site's cookies.

Complaints

If you think I have handled your information badly, please tell me first and I will try to put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk, or on 0303 123 1113.