LegalPrivacy and cookies.

Who I am

Samcot Digital is run by me, Sam Cotterill, as a sole trader based in Blackpool, Lancashire. I build websites and systems for local businesses. I'm responsible for the personal data described here (the "controller", in data protection terms).

If you have a question about this policy or your data, email me at info@samcotdigital.com.

What I collect and why

I only collect what you give me, plus basic analytics if you allow them. I never sell your data or use it for anything you wouldn't expect.

When you send a message

The contact form asks for your name, email address and message, and optionally your phone number, business name and how you found me. I use it to reply to you, and if we go on to work together, to set up your project. You also get an automatic email to confirm your message arrived.

When you email yourself a quote

The cost calculator asks for your email address, and sends you the guide price you worked out along with your answers. I get a copy too, so I know a quote was sent. I won't add you to a mailing list.

When you call or message me on WhatsApp

I'll have your phone number and anything you send me, and I use them only to reply and help with your enquiry. WhatsApp messages are handled by WhatsApp (Meta).

When you book a call

The booking calendar on the contact page is run by Cal.com. It collects your name, email address, the time you pick and any notes you add, so we can have the call.

If you become a client

I keep your contact and billing details, our agreement, and the words, photos and other content you send for your website, so I can do the work, invoice you and keep proper accounts.

When you browse the site

If you accept analytics cookies, Google Analytics records how the site is used: pages visited, time on the site, device type and rough location (such as country or region). It also records actions such as opening a question, using the cost calculator, clicking a quote button, sending a message or booking a call. It identifies your browser with a random ID rather than your name. I use it to see what works and improve the site.

If you haven't accepted, no analytics cookies are set and nothing identifies you, but Google may still receive a basic, cookieless signal that a page was viewed or something was clicked. Google uses these to estimate overall visitor numbers.

Like any website, the hosting also processes technical details such as your IP address and browser type to deliver pages and keep the site secure.

The legal basis

UK GDPR requires a legal basis for using personal data. These are the ones I rely on:

• Steps before a contract: replying to your message, sending a quote you asked for, and arranging a call.
• Contract: delivering the work for clients who sign an agreement with me.
• Legal obligation: keeping financial records for tax.
• Consent: analytics cookies, set only after you accept them on the cookie banner.
• Legitimate interests: keeping the site secure and working, and keeping a record of past enquiries.

Who handles it for me

I use a few trusted services to run the site and my business. They only use your data to provide their service to me:

• Resend sends the emails from the contact form and the cost calculator. Emails are processed in its EU region (Ireland).
• Google Workspace is my email, where your messages arrive.
• Google Analytics and Google Tag Manager measure how the site is used, only if you accept analytics cookies.
• Vercel hosts the website.
• WhatsApp (Meta) carries messages if you contact me on WhatsApp.
• Cal.com runs the booking calendar (cal.eu).

Some of these companies are based in the US. Where your data leaves the UK, it's protected by the safeguards UK law requires, such as the UK-US data bridge or approved contract terms.

Cookies and browser storage

Always on

• cookie_consent remembers whether you accepted or declined analytics. It's kept in your browser's local storage rather than as a cookie, and stays until you clear it or change your choice.

Only if you accept

• _ga and _ga_* are Google Analytics cookies that tell visits and visitors apart. They last up to 2 years.

Until you accept, no analytics cookies are set. Google Tag Manager loads the analytics but doesn't set cookies of its own. If you decline after accepting, the Google Analytics cookies are deleted.

The booking calendar

On the contact page, the booking calendar loads from Cal.com and may store what it needs to work, such as your time zone. See Cal.com's own privacy policy for details.

You can change your choice any time with Cookie Settings, also in the footer, or by clearing your browser's site data.

How long I keep it

• Enquiries and quotes: up to 2 years after we last spoke, unless we go on to work together.
• Client records: 6 years after the end of the tax year a project ends in, as tax law requires.
• Analytics: 14 months, set in my Google Analytics account.
• Hosting logs: a short period, as set by Vercel.

Your rights

Under UK GDPR, you can ask me to:

• Show you the personal data I hold about you.
• Correct anything that's wrong or incomplete.
• Delete your data, where I don't need to keep it by law.
• Limit how I use it, in certain circumstances.
• Stop using it where I rely on legitimate interests.
• Send it to you or someone else in a common format.

You can also withdraw consent for analytics at any time with Cookie Settings. To use any of these rights, email info@samcotdigital.com. I'll reply within one month.

How to complain

If you're unhappy with how I've handled your data, please tell me first at info@samcotdigital.com and I'll do my best to put it right. You can also complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.

Changes to this policy

If anything changes, such as a new service that handles your data, I'll update this page and its "last updated" date.