Privacy Policy
Last Updated: 20 MARCH 2026
1. Introduction
This Privacy Policy explains how David Alston, a sole trader based at Halton Mill, Mill Lane, Halton, Lancaster, LA2 6ND ("we", "us", "our") collects, uses, stores, and protects your personal data when you visit davealston.com ("the Website").
We are the data controller for the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
ICO Registration Number: ZA431043
We are committed to protecting your privacy in compliance with: The UK General Data Protection Regulation (UK GDPR); The Data Protection Act 2018; The Privacy and Electronic Communications Regulations 2003 (PECR); The Data (Use and Access) Act 2025.
2. What Personal Data We Collect
2.1. Information you provide directly via the contact form:
Your name; Your email address; Your message content.
2.2. Information collected automatically when you visit the Website:
IP address (collected by our hosting/CDN provider and by Formspree upon form submission); Browser type and version; Operating system; Device information; Date and time of visit; Referring website.
2.3. Information we do not collect:
We do not use analytics tools (such as Google Analytics) on this Website. We do not set tracking cookies. We do not collect payment information on this Website.
3. How We Collect Data — The Contact Form (Formspree)
3.1. The contact form on this Website is powered by Formspree, Inc., a US-based form processing service.
3.2. When you submit the contact form, your name, email address, and message are: (a) Transmitted directly from your browser to Formspree's servers via HTTPS (encrypted in transit); (b) Stored by Formspree on their servers in the United States; (c) Forwarded to us by email.
3.3. We also access your submissions via the Formspree dashboard.
3.4. Formspree acts as a data processor on our behalf. Formspree may also collect your IP address, browser type, and other technical data when you submit the form. Formspree relies on Standard Contractual Clauses (SCCs) for international data transfers.
3.5. Formspree's Privacy Policy: https://formspree.io/legal/privacy-policy/
3.6. Formspree's Security information: https://formspree.io/security/
4. Lawful Basis for Processing
Under Article 6 of the UK GDPR, we process your personal data on the following lawful bases:
Responding to your enquiry via the contact form: Article 6(1)(b) — Performance of a contract or steps taken at your request prior to entering into a contract.
Complying with legal and tax obligations: Article 6(1)(c) — Legal obligation.
Website security and fraud prevention (via hosting provider): Article 6(1)(f) — Legitimate interests.
Sending marketing communications (only with your consent): Article 6(1)(a) — Consent.
Where we rely on legitimate interests, we have conducted a balancing assessment and are satisfied that your rights and freedoms are not overridden. You have the right to object to processing based on legitimate interests.
5. How We Use Your Data
We use your personal data to: Respond to your enquiry submitted via the contact form; Communicate with you about potential consulting or copywriting projects; Send marketing communications (only where you have given explicit opt-in consent); Comply with legal obligations (e.g., tax records, HMRC requirements).
6. Marketing Communications
6.1. We may in the future send marketing emails using SMTP2Go (email delivery service) and BirdSend (email marketing platform).
6.2. We will only send you marketing communications if you have given explicit opt-in consent.
6.3. Every marketing email will include a clear unsubscribe link. You may withdraw your consent at any time by clicking unsubscribe or emailing help@davealston.com.
6.4. SMTP2Go and BirdSend act as data processors on our behalf. Your email address and name will be shared with these providers solely for the purpose of delivering emails you have consented to receive.
7. Data Sharing
We may share your personal data with the following categories of recipients:
Formspree, Inc. (US) — to process contact form submissions.
SMTP2Go — to send transactional and marketing emails.
BirdSend — to manage email marketing lists and send campaigns.
BunnyCDN (hosting/CDN provider) — to host and deliver the Website.
Legal and regulatory authorities — where required by law or to protect our legal rights.
We do not sell your personal data to third parties.
All third-party processors with whom we share data are bound by data processing agreements or standard contractual clauses ensuring compliance with UK GDPR requirements.
8. International Data Transfers
Some of our third-party service providers are based outside the UK (notably Formspree, Inc. in the United States). Where personal data is transferred outside the UK, we ensure appropriate safeguards are in place, including: UK adequacy decisions; UK International Data Transfer Agreement (IDTA) or UK Addendum to EU Standard Contractual Clauses; Standard Contractual Clauses (SCCs) — Formspree relies on SCCs as confirmed in their security documentation.
9. Data Retention
We retain your personal data only for as long as necessary:
Contact form submissions (Formspree): Retained on Formspree's servers for as long as our account is active. We periodically review and delete old submissions.
Contact form submissions (email): Retained in our email inbox for up to 2 years from the date of enquiry, unless an ongoing business relationship is established.
Marketing subscriber data (SMTP2Go / BirdSend): Retained for the duration of your subscription. Deleted within 30 days of unsubscribing.
Correspondence relating to projects: Retained for up to 6 years after project completion (HMRC legal obligation for tax records).
After the applicable retention period, data will be securely deleted or anonymised.
10. Your Rights Under the UK GDPR
You have the following rights in relation to your personal data:
Right of access (Article 15) — Request a copy of the personal data we hold about you.
Right to rectification (Article 16) — Request correction of inaccurate or incomplete data.
Right to erasure (Article 17) — Request deletion of your personal data ("right to be forgotten"), subject to legal obligations.
Right to restrict processing (Article 18) — Request that we limit the processing of your data.
Right to data portability (Article 20) — Request your data in a structured, commonly used, machine-readable format.
Right to object (Article 21) — Object to processing based on legitimate interests or for direct marketing.
Right to withdraw consent — Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.
Rights related to automated decision-making (Article 22) — We do not carry out automated decision-making or profiling that produces legal effects.
To exercise any of these rights, please email help@davealston.com. We will respond within one month of receiving your request, in accordance with the UK GDPR.
11. Data Security
We take appropriate technical and organisational measures to protect your personal data, including: The Website is served over HTTPS (TLS/SSL encryption in transit); Static HTML hosting with no server-side database (minimising attack surface); Formspree encrypts data at rest (AES-256) and in transit (TLS 1.2 minimum); Access to form submissions is restricted to David Alston only.
12. Children's Privacy
The Website is not directed at individuals under 18 years of age. We do not knowingly collect personal data from children. If we become aware that we have inadvertently collected data from a child under 18, we will take steps to delete it promptly.
13. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated "Last Updated" date. Where changes are significant, we will notify you where reasonably possible.
14. Complaints
If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):
Website: https://ico.org.uk/make-a-complaint/
Phone: 0303 123 1113
Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
15. Related Services
David Alston also operates 'Only One You' Pro Bio Pages at onlyone.you. That service has its own Privacy Policy at https://www.onlyone.you/privacy-policy. If you use that service, its privacy policy applies to the data collected there.
16. Contact Us
For any questions about this Privacy Policy or your personal data, please contact:
David Alston
Halton Mill, Mill Lane, Halton, Lancaster, LA2 6ND
help@davealston.com
ICO Registration Number: ZA431043