[//] Legal
Privacy policy
This explains what personal information I collect through this website, what I do with it, and what rights you have over it. It is deliberately specific rather than generic — everything below describes what this site actually does.
Who is responsible
Smiths SEO is the data controller for information collected through this website. You can reach me at harry@smiths-seo.co.uk about anything on this page, including to ask for a copy of your data or to have it deleted.
What I collect, and when
Three ways, and each of them starts with something you did.
- When you submit the enquiry form
- Your name, email address, website address, the services you selected, and whatever you write in the message box. You choose what to put in it — please do not include anything sensitive.
- When you use the account centre
- If you are a client and I have switched on your login, the site holds the contact details already on your record, your invoices, any subscriptions, and the messages exchanged in your thread. Signing in records the time you last signed in and a session cookie in your browser. Each sign-in link is stored only as a one-way hash — the link itself is never kept.
- Your IP address, briefly
- The enquiry form and the sign-in form are rate limited to stop automated abuse. That check holds your IP address in the server's memory for up to fifteen minutes and then discards it. A sign-in request also records the requesting IP against the token, so an unexpected sign-in attempt can be traced; that record is deleted within seven days.
Why I am allowed to hold it
Under UK GDPR I need a lawful basis for processing personal data. Two apply here.
- Legitimate interests
- Replying to an enquiry you sent me, and keeping a record of work I have done for you. You asked me to get in touch, so responding is what you would reasonably expect.
- Legal obligation
- Invoices and payment records have to be kept for tax purposes whether either of us wants to or not.
Who else sees it
I do not sell data or share it for marketing. It does pass through a small number of service providers that make the site work:
- Google (Gmail)
- Enquiries are delivered to and stored in a Gmail mailbox, and replies are sent from it. Google processes data in the UK, EU and United States under its standard terms.
- Vercel
- Hosts the site. Server logs may briefly contain IP addresses as a normal part of running a web server.
- Supabase
- Stores client records, invoices, subscriptions and account centre messages for existing customers, on servers in the EU. It holds no data about people who have only sent an enquiry.
Some of these providers may process data outside the UK. Where that happens it is covered by the safeguards in their standard data processing terms.
How long I keep it
- Enquiries that do not lead to work: deleted within 12 months.
- Client records and correspondence: kept while we are working together and for a reasonable period afterwards.
- Account centre messages: kept while your account is open, so we both keep a record of what was agreed.
- Sign-in links: single use, expire after 20 minutes, and the records are purged after seven days.
- Invoices and financial records: kept for at least six years, because tax rules require it.
- IP addresses used for rate limiting: discarded within fifteen minutes, automatically.
If you would rather I deleted something sooner, ask and I will, unless I am legally required to keep it.
Your rights
Under UK GDPR you can ask me to:
- Give you a copy of the personal data I hold about you.
- Correct anything inaccurate.
- Delete it, where I have no legal reason to keep it.
- Restrict or object to how I use it.
- Provide it in a portable format.
Email harry@smiths-seo.co.uk and I will respond within one month. There is no charge. If you are not happy with how I have handled it, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
Automated decisions and marketing
There is no automated decision-making or profiling. I do not run an email newsletter and will not add you to a mailing list. If I contact a business address directly about my services, you can tell me to stop by replying and I will not contact you again.
Business details
- Trading name
- Smiths SEO
- Legal name
- Harry Smith (sole trader)
- Address
- 9 Netherwood Avenue, Castleford, WF10 2QW
- VAT
- Not VAT registered