Privacy Policy
Last Updated: 23 JULY 2026
1. Introduction
This Privacy Policy explains how David Alston, a sole trader based at Halton Mill, Mill Lane, Halton, Lancaster, LA2 6ND ("we", "us", "our") collects, uses, stores, and protects your personal data when you visit davealston.com ("the Website").
We are the data controller for the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
ICO Registration Number: ZA431043
We are committed to protecting your privacy in compliance with: The UK General Data Protection Regulation (UK GDPR); The Data Protection Act 2018; The Privacy and Electronic Communications Regulations 2003 (PECR); The Data (Use and Access) Act 2025.
2. What Personal Data We Collect
2.1. Information you provide directly via the contact form:
Your name; Your email address; Your message content.
2.2. Information collected automatically when you visit the Website:
Our hosting/CDN provider may process limited technical request information needed to deliver and secure the Website, such as an anonymised or truncated IP address, requested URL, user agent, country code, and request time. Formspree may process an IP address and related technical information when a form is submitted.
2.3. Information we do not collect:
We do not use analytics tools (such as Google Analytics) on this Website. We do not set tracking cookies. We do not collect payment information on this Website.
3. How We Collect Data — The Contact Form (Formspree)
3.1. The contact form on this Website is powered by Formspree, Inc., a US-based form processing service.
3.2. When you submit the contact form, your name, email address, and message are transmitted directly from your browser to Formspree via HTTPS, processed or stored in the United States and potentially other countries where Formspree operates, and forwarded to us by email.
3.3. We also access your submissions via the Formspree dashboard.
3.4. Formspree provides form-processing services on our behalf and may also collect an IP address, browser type, access time, referring address, and related technical information when you submit the form. Formspree states that it applies appropriate protections when transferring personal information outside Europe.
3.5. Formspree's Privacy Policy: https://formspree.io/legal/privacy-policy/
3.6. Formspree's Security information: https://formspree.io/security/
4. Lawful Basis for Processing
Under Article 6 of the UK GDPR, we process your personal data on the following lawful bases:
Responding to your enquiry via the contact form: Article 6(1)(b) — Performance of a contract or steps taken at your request prior to entering into a contract.
Complying with legal and tax obligations: Article 6(1)(c) — Legal obligation.
Website security and fraud prevention (via hosting provider): Article 6(1)(f) — Legitimate interests.
Where we rely on legitimate interests, we have conducted a balancing assessment and are satisfied that your rights and freedoms are not overridden. You have the right to object to processing based on legitimate interests.
5. How We Use Your Data
We use your personal data to respond to your enquiry, communicate with you about potential or agreed consulting and copywriting projects, maintain appropriate business records, secure the Website, and comply with legal obligations.
6. Marketing Communications
6.1. The Website does not currently contain a marketing-email or newsletter sign-up. Submitting the contact form does not subscribe you to marketing.
6.2. If we add optional marketing communications later, we will provide the required information and consent choice at that point and will update this Privacy Policy before using a new email provider.
7. Data Sharing
We may share your personal data with the following categories of recipients:
Formspree, Inc. (US) — to process contact form submissions.
BunnyCDN (hosting/CDN provider) — to host and deliver the Website.
Legal and regulatory authorities — where required by law or to protect our legal rights.
We do not sell your personal data to third parties.
Where a provider processes personal data on our behalf, we require appropriate contractual and security protections. A provider may also act as an independent controller for particular activities described in its own privacy information.
8. International Data Transfers
Some providers, including Formspree, may process personal data outside the UK. Where UK data-protection law requires a transfer safeguard, we use an applicable UK adequacy regulation, the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, or another lawful mechanism. You may contact us for further information about the safeguards relevant to your data.
9. Data Retention
We retain your personal data only for as long as necessary:
Contact form submissions (Formspree): Normally deleted from the Formspree dashboard within 2 years of the enquiry, unless needed for an ongoing business relationship, a legal claim, or another legal requirement.
Contact form submissions (email): Retained in our email inbox for up to 2 years from the date of enquiry, unless an ongoing business relationship is established.
Correspondence relating to projects: Retained for up to 6 years after project completion (HMRC legal obligation for tax records).
After the applicable retention period, data will be securely deleted or anonymised.
10. Your Rights Under the UK GDPR
You have the following rights in relation to your personal data:
Right of access (Article 15) — Request a copy of the personal data we hold about you.
Right to rectification (Article 16) — Request correction of inaccurate or incomplete data.
Right to erasure (Article 17) — Request deletion of your personal data ("right to be forgotten"), subject to legal obligations.
Right to restrict processing (Article 18) — Request that we limit the processing of your data.
Right to data portability (Article 20) — Request your data in a structured, commonly used, machine-readable format.
Right to object (Article 21) — Object to processing based on legitimate interests or for direct marketing.
Right to withdraw consent — Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.
Rights related to automated decision-making (Article 22) — We do not carry out automated decision-making or profiling that produces legal effects.
To exercise any of these rights, please email help@davealston.com. We will respond within one month of receiving your request, in accordance with the UK GDPR.
11. Data Security
We take appropriate technical and organisational measures to protect personal data, including serving the Website over HTTPS, using a static site without a customer database, restricting access to form submissions, and using the security controls provided by Formspree and our hosting provider.
12. Children's Privacy
The Website is not directed at individuals under 18 years of age. We do not knowingly collect personal data from children. If we become aware that we have inadvertently collected data from a child under 18, we will take steps to delete it promptly.
13. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated "Last Updated" date. Where changes are significant, we will notify you where reasonably possible.
14. Complaints
If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):
Website: https://ico.org.uk/make-a-complaint/
Phone: 0303 123 1113
Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
15. Related Services
David Alston also operates Sing Yourself Happy at singyourselfhappy.com. That service has its own legal documents, which apply if you use it.
16. Contact Us
For any questions about this Privacy Policy or your personal data, please contact:
David Alston
Halton Mill, Mill Lane, Halton, Lancaster, LA2 6ND
help [at] davealston.com
ICO Registration Number: ZA431043