Privacy policy

Who is responsible

Rocking Horse Digital Ltd (company number 11383821, registered office 54 St James Street, Liverpool, L1 0AB) is responsible for the personal information described here. I'm registered with the Information Commissioner's Office, reference ZA922748. If you have any question about your information, email [email protected].

What this website collects

• No tracking cookies. There are no analytics, advertising or social media scripts on this site. The only cookies are ones it needs to work: when you enter a passphrase to view a private preview, or sign in to edit a site.
• Server logs. Like any web server, ours records technical details of each visit, including your IP address, the page requested and your browser type. I use these only to keep the sites I host secure and working, for example to block addresses that attack them. They're kept for up to 30 days, then deleted or reduced to totals that don't identify anyone. Copies can remain in my database provider’s backups for up to 7 days after that. The legal basis is legitimate interests: keeping the platform safe.
• Page views. I count how many times each page is viewed by real visitors, per day, so each site owner can see their real traffic. Robots, my own monitoring and people editing the site are left out. No cookie is used for this, and nothing about you is stored to do it: the count is just a number per page per day. It can’t tell who you are, or how many different people visited. Links I share in emails, on business cards or elsewhere are counted the same way: a number per link per day, with nothing kept about who followed them.
• Signing in to edit a site. If you edit or manage a site I host, your sign-in activity is recorded: each sign-in, each failed attempt, and each time you sign out or are signed out automatically. Each record shows when it happened, whether it worked, your IP address and a summary of your browser and device (such as “Safari on iPhone”). The site’s admins can see this record and who is signed in at the moment, and can sign people out. This keeps the sites secure and makes a stolen password visible. The record is kept for 90 days, then deleted. Copies can remain in the nightly backups, which are kept for 30 days and fully deleted within 60. The legal basis is legitimate interests: keeping the sites secure.
  Signing in also needs a code from an authenticator app, so a secret linked to your account is stored with it. If you choose to make backup codes, they’re stored with your account too, until they’re used or replaced.

When you contact me

If you email or phone, I use what you tell me (your name, contact details and message) to reply and, if you become a client, to provide the service. The legal basis is taking steps at your request before a contract, or my legitimate interest in replying to enquiries. Enquiries that don't lead to work are deleted after two years. Client records are kept for six years after the work ends, because the law requires it for business and tax records.
If you send a message through the contact form on this site, I keep your name, email address and message so I can read it and reply. It waits in this site’s own inbox, which only I can read. Each message is deleted 60 days after it arrives, and copies can remain in the nightly backups, which are kept for 30 days and fully deleted within 60. Once I reply, the conversation will continue by email, and is kept as described above. To stop junk messages, the form checks how quickly it was filled in and limits how many messages can come from one IP address in an hour: your IP address is held in the website’s memory for that hour, and is never stored with your message. Messages the form stops are not kept, only counted. If a junk message gets through and I mark it as junk, it is deleted, and only how it was sent (how long the form took to fill in, how many links it had and its length) is kept, to improve the filter. The legal basis is legitimate interests: replying to you, and keeping the site free of junk.

Who else handles it

I use a small number of providers to run the service:

• DigitalOcean, which hosts the websites and their images in its London data centre
• Cloudflare, whose network DigitalOcean uses to deliver the websites to visitors, so visitors' requests, including IP addresses, pass through it
• Microsoft Azure, which checks that the websites are working and holds off-site backups, in its UK South region
• Microsoft 365, supplied through GoDaddy, for email

I don't sell your information, and I only share it with anyone else if the law requires it.

Keeping it secure

Everything sent to and from this site travels over an encrypted (HTTPS) connection. Everyone who can edit a site I host signs in with a password and a code from an app on their phone. The database, images and backups are stored with providers that encrypt them at rest, and only I have access to them. Backups are copied to a separate account that the live site can't reach, so a problem with the live system can't affect them. No system is completely secure, so if a breach ever affects your information, I'll tell you and the ICO as the law requires.

Transfers outside the UK

These providers are US-owned, so some information may be handled outside the UK, for example for support or security, or as visitors' requests pass through Cloudflare's worldwide network. Where that happens it's protected by the UK–US data bridge (the UK Extension to the EU–US Data Privacy Framework) or by contract terms approved for UK data.

Websites I look after for clients

For the websites I host for clients, each client is responsible for their own visitors' information, and I handle it on their behalf under a written agreement.

Your rights

Under UK data protection law (the UK GDPR and the Data Protection Act 2018) you have the right to:

• ask for a copy of the information I hold about you (a "subject access request")
• have it corrected if it's wrong, or deleted
• object to how I use it, or ask me to restrict it
• receive it in a format you can take elsewhere

Email [email protected] and I'll reply within one month. None of your information is used for automated decisions or profiling. If you're unhappy with how I've handled your information, you can complain to the ICO at ico.org.uk/make-a-complaint, though I'd welcome the chance to put it right first.