Privacy policy

Who is responsible for your data

This is the personal website of Tommy Findlay. The data controller is iS3 Ltd, company number 10262769, registered in England and Wales, registered office 128 City Road, London EC1V 2NX. ICO registration reference ZB691926.

Data protection contact: Thomas Findlay, tommy@is3.co.uk.

What I collect and why

If you send a message through the contact or speaking form, I collect your name, email address, organisation if you give one, and what you write. I use it to reply to you and, if we go on to work together, to run that work. The lawful basis is my legitimate interest in answering an enquiry you chose to send.

If you join the newsletter, I collect your email address and the date and wording of your consent. You get one letter a month. The lawful basis is your consent, which you can withdraw at any time with the unsubscribe link in any letter or by emailing the data protection contact above.

Every page view is counted without cookies by Vercel Web Analytics and Speed Insights. They record the page, the referrer, the country, the device type and page speed, hashed so that no visitor can be identified, and store no personal data.

Google Analytics runs only if you accept it in the banner. It sets cookies and sends page views to Google. If you decline, or never choose, nothing is loaded from Google and no analytics cookie is set.

Who processes it for me

Vercel hosts the site, runs its server code and holds request logs, the cookieless visit counts and the page-speed measurements. It is a United States company and this site’s server code runs in the United States, so request data is transferred outside the UK.

GoHighLevel holds form submissions as the CRM used by iS3. It is a United States company, so submissions are transferred outside the UK. Submissions are moving to a system run by iS3, and this page will be updated when they do.

Resend sends the notification that tells me a form has been submitted, so it processes what you put in the form. It is a United States company.

Google processes analytics data only after you accept the banner. It is a United States company.

Sanity hosts the articles and the images in them. When a post carries an image your browser fetches it from Sanity’s content network, which sees your IP address as any web host does. Sanity is a Norwegian company and the content is hosted in the EU.

Nobody else receives your data. It is never sold.

How long I keep it

Contact form submissions are retained for up to 24 months.

Newsletter details are retained until you unsubscribe, then removed from the list within a month.

Analytics data is retained for 14 months (Google Analytics default). The cookies Google Analytics sets last up to two years.

Server request logs are kept for the period Vercel sets by plan, published at vercel.com/docs/logs/runtime: one hour, one day or three days depending on plan, or 30 days with its Observability Plus add-on.

Cookies

tf_cookie_consent records your banner choice for twelve months so it does not reappear on every visit.

_ga and _ga_* are set by Google Analytics only after you accept, and last up to two years.

That is the complete list. Vercel Web Analytics and Speed Insights set none.

Your rights

Under UK GDPR you can ask what personal data I hold about you, ask for it to be corrected or deleted, ask me to restrict or stop using it, ask for a copy in a portable format, and withdraw consent where consent is the basis. Email tommy@is3.co.uk and I will sort it within a month.

If you are unhappy with how I have handled your data you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.

Changes

If this policy changes, the date at the top of this page moves and the change is described here.