What we know about you.

Carlton-Blake Digital builds custom software and websites from East Sussex, United Kingdom. For everything on this page we are the data controller, which means we decide what happens to the details below and we answer for them.

Questions about any of it go to support@carltonblake.com. A person replies, usually within one working day.

Details reach us in two ways, and both of them are you choosing to send them.

• Email. When you write to us, we receive your name, your email address and whatever you put in the message.
• The card page form. The short form behind our printed business card asks for a name, a phone number and a message, and sends them to our inbox. Nothing else on this site asks you for anything.

If you become a client, we hold what the work requires: contact details, correspondence about the project, and invoices.

There is no cookie banner on this site because there are no cookies. It sets none, stores nothing in your browser, and that is also why nothing here asked you to accept anything.

• We never sell or rent your details to anyone.
• We run no advertising and no tracking pixels.
• We do not profile you or follow you to other websites.
• We send no marketing emails. If we email you, it is because you emailed us first.

The main site carries no analytics at all. The card page counts its visits using Vercel Web Analytics, which works without cookies and without identifying anyone: we can see that the page was viewed and roughly where in the world from, and we cannot see who you are. That is the whole of it.

Three companies process data on our behalf, each under a contract that binds them to protect it:

• Vercel hosts the site. Like any host, its servers keep short-lived technical logs, including IP addresses, to keep the site running and secure.
• Web3Forms carries the card page form from your browser to our inbox. It delivers the message; it is not stored there as a copy for anyone else.
• Our email provider stores the messages you send us, the same way yours stores our reply.

Some of these companies run servers outside the UK. Where they do, the transfer is covered by the safeguards UK law recognises, such as an adequacy decision or the International Data Transfer Agreement.

Enquiries stay in our inbox while the conversation is live, and for up to two years afterwards in case it picks back up. Records that end up in invoices are kept for six years, because HMRC requires it. Everything else is deleted when it stops being useful.

You can ask us to delete your details sooner at any time, and unless the law says we must keep something, we will.

UK GDPR requires a lawful basis for each use of your details. Here they are:

• Answering your enquiry: legitimate interests. You wrote to us, and replying is the point.
• Doing the work once you are a client: performance of a contract.
• Keeping invoices and accounts: legal obligation.
• Keeping the site secure: legitimate interests.

At any time, and for free, you can ask us:

• what we hold about you, and for a copy of it
• to correct anything that is wrong
• to delete it
• to stop using it, or to restrict what we use it for
• to hand it over in a portable format

Email support@carltonblake.com and you will have an answer within a month, usually much faster. If you are unhappy with how we have handled something, you can complain to the Information Commissioner's Office at ico.org.uk. We would appreciate the chance to put it right first.

If this page changes, the date at the top changes with it. Anything material and we will say so here, plainly. No quietly moved goalposts.