When you get in touch

If you send an enquiry through the Send a brief form, I receive the services and budget you selected, whatever you write in the message, and your email address. The form emails it straight to my inbox — nothing is stored in the website’s own database, so the only copy lives in my email.

I use this to reply to you and, if we end up working together, to run the project. The legal basis is legitimate interest — responding to someone who has deliberately contacted me — and, once there is a project, performance of a contract.

Enquiries that don’t lead to work are kept for up to two years, in case you come back. Correspondence about actual projects is kept for six years, which is how long UK business records generally need to be retained.

Comments on Journal posts

If you leave a comment, the site records what you wrote, the name and email you supply, your IP address and your browser’s user agent string. The last two help identify spam.

An anonymised string derived from your email address may be sent to Gravatar to check whether you have a profile picture there. Gravatar is also run by Automattic, and their privacy notice is at automattic.com/privacy. Comments and their metadata are kept indefinitely so replies stay readable in context — ask me and I’ll remove yours.

Analytics

This site uses Google Analytics 4, connected through the Site Kit plugin. It tells me how many people visit, which pages and projects hold attention, roughly which country or city visitors are in, and whether they arrived from a search engine, a link or social media.

Google Analytics sets cookies in your browser to recognise a returning visit and to group page views into a single session. Google processes this data on my behalf, including on servers outside the UK; those transfers rely on the UK extension to the EU Standard Contractual Clauses. Google’s own description of how it handles this data is at policies.google.com/privacy.

I also use Jetpack Stats, which counts page views in a less detailed way and does not follow you between sites.

Analytics is switched off for logged-in administrators, so my own visits are excluded. Nothing here is used to identify you personally or to target advertising at you.

Cookies

Cookies are small files a website stores in your browser. This site involves three kinds:

• Analytics cookies, set by Google Analytics as described above.
• Comment cookies — if you leave a comment, your name and email are saved in your browser so you don’t retype them next time. These last about a year and are optional.
• Login cookies, which apply only to me as the site’s administrator.

Analytics cookies are only set if you accept them — the site asks on your first visit and remembers your answer for six months. You can change that choice at any time. You can also block or delete cookies in your browser settings; blocking the analytics ones will not affect how the site works for you. If you would rather Google Analytics didn’t record your visit at all, Google publishes an opt-out browser add-on at tools.google.com/dlpage/gaoptout.

Embedded content and video

Some pages include video hosted through Jetpack VideoPress, or content embedded from other websites such as YouTube or Vimeo. Embedded content behaves exactly as if you had visited that site directly: the other site can see your IP address, may set its own cookies, and may track your interaction with what it has embedded. I have no control over what those services collect, so it’s worth reading their own privacy notices if that concerns you.

Keeping the site secure

The site runs security and anti-spam tooling that records IP addresses and failed login attempts in order to block brute-force attacks and automated abuse. The web server also keeps standard access logs containing IP addresses, timestamps and the pages requested. This is necessary to keep the site online and is done on the basis of legitimate interest. Security logs are kept for up to twelve months.

Who else handles your data

I keep the list of third parties deliberately short. Each one acts as a processor on my instructions, and none of them is permitted to use your data for their own purposes.

• Hostinger — hosts this website and its server logs.
• Google — analytics, as described above.
• Automattic — visitor statistics, video hosting and Gravatar.
• Microsoft — my email runs on Microsoft 365, so enquiries and any correspondence with me are stored there.
• A website security provider — monitoring, firewalling and audit logging, as described under Keeping the site secure.

Some are based outside the UK, and those transfers rely on Standard Contractual Clauses or the UK–US Data Bridge. I don’t sell personal data, share it with advertisers, or pass it to anyone else — unless I’m legally required to, for example by a court order.

Connected social media accounts

I schedule my own social media posts using a self-hosted publishing tool that runs on my own server rather than on a third party’s platform. To do that, I connect my own business accounts — such as LinkedIn, Facebook and Instagram — to that tool.

When an account is connected, the platform issues an access token which is stored on my own hardware in the United Kingdom, behind authentication, and is used only to publish content I have written and to read back the resulting engagement figures for my own posts. The tool is used by me alone; there are no other user accounts on it, and it is not offered to anyone else as a service.

This means I do not collect information about you through those platforms beyond what is already visible on my own posts — for example, a public comment you leave on one of them, which remains subject to that platform’s own privacy policy as well as this one. I do not export follower lists, build audience profiles, or use platform data for advertising.

Deleting your data

You can ask me to delete anything I hold about you, and I will do so unless I have a legal obligation to keep it.

1. Email privacy@wageman.co.uk, or use the Send a brief form at the top of any page.
2. Write “data deletion request” in the message, and tell me which platform or email address it relates to so I can find it.
3. I will confirm receipt, delete what I hold, and confirm again once it is done — within one month at the latest, and usually within a few days.

For data connected with social media platforms specifically: revoking my access from your side of the platform, or removing a comment you left, takes effect immediately at the platform. If any copy of it remains in my publishing tool, the request above removes that too. Access tokens for my own connected accounts are deleted whenever an account is disconnected.

What I don’t do

It’s worth being explicit, because plenty of sites do these things and it’s reasonable to wonder:

• There is no advertising on this site and no advertising trackers.
• I don’t buy contact lists or add people to mailing lists because they enquired.
• I don’t take payments through this site, so no card or bank details pass through it.
• There is no automated decision-making or profiling — nothing here decides anything about you without a human involved.
• I don’t ask for, or want, special category data such as health, ethnicity or political views.

Children

This is a portfolio for commercial design work and isn’t aimed at children. I don’t knowingly collect information from anyone under 13. If you believe a child has sent me information, tell me and I’ll delete it.

How your information is protected

The site is served over an encrypted HTTPS connection, so anything you send is encrypted in transit. Administrative access is restricted to me, protected by multi-factor authentication and key-based server access rather than passwords alone. The site is monitored for intrusion attempts and backed up regularly, with backups encrypted before they leave the server.

No system is perfect. If a breach happened that put your rights at risk, I would tell the Information Commissioner’s Office within 72 hours of becoming aware of it, and tell you directly without undue delay if you were affected.

Links to other sites

Portfolio pages and Journal posts link out to clients, suppliers and other people’s work. Once you follow one of those links you’re on someone else’s site, governed by their privacy policy, not this one. I can’t control what they collect and I’m not responsible for it.

Your rights

Under UK data protection law you have the right to:

• Be informed — which is what this page is for.
• Access a copy of what I hold about you.
• Rectification — have anything inaccurate corrected.
• Erasure — have it deleted, where I have no overriding reason to keep it.
• Restrict processing — have me hold it but stop using it.
• Data portability — receive what you gave me in a machine-readable file.
• Object — including objecting to anything I do on the basis of legitimate interest.

Where something relies on your consent — analytics cookies, for instance — you can withdraw it at any time using the cookie settings link, or by clearing cookies in your browser. Withdrawing it doesn’t undo anything already lawfully done beforehand.

Email privacy@wageman.co.uk, or use the Send a brief form at the top of any page and say that your message is a data protection request. I’ll respond within one month. There’s no charge, and you don’t need to give a reason.

If you think I’ve handled your data badly, please tell me first so I can put it right. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. Complaining to me first doesn’t affect that right.

Changes to this policy

If I add a tool that changes what’s collected, I’ll update this page and change the date at the top. There’s no mailing list for policy changes — the date is the honest signal. Previous versions aren’t published, so if you need to know what this page said on a particular date, ask and I’ll tell you.