Privacy policy

Last updated: 27 October 2026

Who I am

This website is run by Gareth Davies, a sole trader trading as Gareth Design and Utilis Internet Services, based in Milton Keynes. In this policy, “I”, “me” and “my” mean Gareth Davies, and “you” means anyone who visits this website or contacts me.

I am the “controller” of the personal information described below, which means I decide how and why it is used. For my own contact details, see the end of this page.

• Business address: Flat 2, 15 Padarn Place, Melfort Drive, Bletchley, Milton Keynes, Buckinghamshire, MK2 3FQ
• Email: info@garethdesign.co.uk

What information I collect and why

If you use the contact form or email me

The contact form asks for your name, email address, a subject and (optionally) a message. If you email me, I receive your email address and whatever you choose to tell me.

• Why: to reply to your enquiry and, if you want to go ahead, to prepare a quote.
• Lawful basis: legitimate interests (answering people who contact me) or, if you ask me for a quote, taking steps before entering into a contract.
• How long I keep it: 12 months after the enquiry ends if it does not lead to work. If it leads to work, see “If you become a client” below.

If you become a client

I keep the details needed to do the work and run my business, such as your name, business name, address, email address, phone number, what I have agreed to do for you, and invoices and payment records. If I host your website or email, I also look after the content and email you place on my servers.

• Why: to provide the services, invoice you, give support and meet my legal duties.
• Lawful basis: contract, and legal obligation (for example keeping accounting records for HMRC).
• How long I keep it: accounting records for at least 6 years, as the law requires. Other client records for 6 years after our work ends.
• Where I host or manage data for you (website content, databases, mailboxes), I act as your “processor”: I only use it on your instructions and to provide the service. You remain the controller of that data. If you are a hosting client, I can provide a data processing agreement on request.

Information collected automatically

Like most web servers, my hosting records basic technical information when you visit, such as your IP address, the pages requested, the date and time, and your browser type. This is used to keep the site secure and working and to find faults.

• Lawful basis: legitimate interests (security and reliable service).
• How long: server logs are kept for 30 days.

This website does not use analytics, advertising or tracking tools. I have checked the site and it does not set any cookies of its own. See the Cookie policy for the one third-party cookie the contact form can set.

Spam protection on the contact form

The contact form uses hCaptcha to stop automated spam. When you start filling in the form, your browser connects to hCaptcha’s servers (run by Intuition Machines, Inc.). hCaptcha receives information such as your IP address and some details about your browser and how you interact with the form, to tell people from bots. hCaptcha is a separate controller for that information. You can read how it handles data at https://www.hcaptcha.com/privacy. Because hCaptcha is based outside the UK, the information may be transferred abroad. Its privacy policy explains the safeguards it uses for this.

Who I share information with

I do not sell your information. I only share it where I need to, with:

• my website hosting provider, 20i, who store the website and its logs;
• my email providers, which handle my business mailbox (20i’s email service) and the notification emails sent from the contact form (Proton);
• hCaptcha (see above);
• my accountant, and the software and payment services I use to send invoices and take payment, where needed to keep records and take payment;
• the authorities, if the law requires me to.

Transfers outside the UK

Some of the companies above may process information outside the UK. Where they do, I rely on the UK’s protections for international transfers, such as an adequacy decision or the UK addendum to standard contractual clauses.

Your rights

Under UK data protection law you have the right to:

• ask for a copy of the personal information I hold about you;
• ask me to correct anything that is wrong or incomplete;
• ask me to delete your information;
• ask me to restrict how I use it;
• object to me using it for legitimate interests;
• ask for information you gave me to be sent to you or someone else in a usable format, where I use it under a contract.

To use any of these rights, email info@garethdesign.co.uk. I will reply within one month. There is no charge in most cases.

Complaints

If you are unhappy with how I have used your information, please tell me first so I can put it right. You also have the right to complain to the Information Commissioner’s Office (ICO): https://ico.org.uk/make-a-complaint/ or call 0303 123 1113.

Security

I protect the information I hold with measures such as secure (HTTPS) connections, access controls and regular updates and backups. No system is completely secure, but I take reasonable steps to protect your information.

Links to other websites

This site links to other websites, such as LinkedIn. I am not responsible for their privacy practices, so please read their policies.

Changes to this policy

If I change this policy, I will post the new version on this page with a new date.

Contact

Gareth Davies, trading as Gareth Design and Utilis Internet Services

Flat 2, 15 Padarn Place, Melfort Drive, Bletchley, Milton Keynes, Buckinghamshire, MK2 3FQ

Email: info@garethdesign.co.uk