Legal
Privacy policy.
What data I collect, why I collect it, how long I keep it and what you can ask me to do with it.
Last updated: 14 September 2026
Before you publish: this is a starting template, not legal advice. Fill in your details in build.py. You are set up as a sole trader, so no company number is claimed anywhere. Register with the ICO if you process personal data, and have a solicitor review it if you are handling health or social care records.
1. Who is the data controller
Charis Muzenda, a sole trader established in England, of Nottingham, United Kingdom, is the data controller for personal data collected through this website. As a sole trader I am personally the controller, so any request under this policy comes straight to me rather than to a department. ICO registration: registration pending. Contact: hello@charismuzenda.co.uk.
2. What I collect
When you send an enquiry
Your name, email address, organisation if you give one, the type of work you are asking about, and whatever you write in the message. Alongside it I record which page you sent it from, so I know what you were reading, and the date and time.
I deliberately do not store your IP address or browser details with the enquiry. Less data held means less that can go wrong.
When you simply read the site
No account, no tracking and no analytics cookies unless you accept them. My hosting provider keeps standard server logs, which include IP addresses, for security and troubleshooting.
3. Why I am allowed to use it
For enquiries, the lawful basis is legitimate interests: you contacted me about work, and I need to read and reply. If we go on to work together, the basis becomes performance of a contract.
For any optional analytics, the basis is your consent, given through the cookie banner and withdrawable at any time.
4. How long I keep it
Enquiries that do not become projects are deleted within 12 months. Records relating to actual projects are kept for six years after the engagement ends, which is the period required for tax and for potential contractual claims.
5. Who else sees it
I do not sell your data and I do not share it for marketing. It is handled by a small number of processors so the site can function:
- Vercel hosts the website and keeps standard server logs, including IP addresses, for security and troubleshooting.
- Supabase stores enquiries sent through the contact form, in a database hosted in Ireland (EU).
- Resend delivers the notification email to me and the confirmation email to you.
- Google Fonts. The site loads fonts from Google's servers, which means your browser makes a request to Google and Google receives your IP address as part of that request.
Each of these is a processor acting on my instructions under a data processing agreement. None of them is permitted to use your data for their own purposes.
6. Client data during a project
If you hire me, I may need access to systems holding your data, including in care settings special category data about service users. Where that happens I act as a processor on your instructions, under a written agreement covering it. I access the minimum needed, for as long as needed, and my access is removed at handover.
7. Where your data is held
Systems I build are hosted in the UK or EU by default. Where a provider transfers data outside the UK, it is done under the safeguards UK data protection law requires.
8. Your rights
Under UK GDPR you can ask me to give you a copy of your data, correct it, delete it, restrict or object to how it is used, or provide it in a portable format. Where I rely on consent, you can withdraw it at any time.
Email hello@charismuzenda.co.uk and I will respond within one month. If you are unhappy with how I have handled it, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
9. Security
Access is limited to me. Systems I build use role-based access enforced at the database, encrypted connections, and encryption at rest where the platform supports it. No system is perfectly secure, but these are the measures I consider appropriate to the risk.
10. Children
This website is aimed at businesses and is not directed at children. I do not knowingly collect data about children through it. Note that software I build for children's services may hold data about young people; in that case you are the controller and I am the processor.
11. Changes
If this policy changes materially I will update the date at the top of this page.