Privacy policy

Who I am

refitmy.co.uk is a subscription website service for UK tradespeople, run by Franco Siorpaes. I am the data controller for the personal data described in this notice.

• Email: franco@refitmy.co.uk
• Phone: +44 7507 639 757

This notice covers refitmy.co.uk, the service agreement page, and the websites I build and host for clients.

Cookies: there aren't any

refitmy.co.uk does not set cookies, and neither do the client websites I build. Nothing is stored on your device and nothing follows you around the internet. That is why you are not being interrupted by a consent banner.

I do measure how many people visit, using Google Analytics configured in cookieless mode. It records the page you landed on, roughly where in the country you are, and what kind of device you used. It cannot identify you, cannot recognise you on a return visit, and is never used for advertising.

If you would rather I did not count your visit at all, email me and I will exclude you, free of charge. You can also block analytics at browser level, which most privacy-focused browsers do by default.

When you visit this site

What is collected

• Pages viewed and how long you spent on them
• Approximate location, at city or region level, from a shortened IP address
• Device type, browser and screen size
• Which site or search sent you here

Why

To see which pages work and which do not, so I can improve them. The lawful basis is legitimate interests: running a small business website effectively, with a genuinely minimal impact on your privacy.

Fonts

This site loads its typefaces from Google Fonts, which means your IP address is briefly visible to Google when the page loads. No cookies are set by this. If you would prefer it did not happen, block third-party requests to fonts.googleapis.com in your browser.

When you sign up

If you complete the service agreement, I collect your email address and a record that you ticked the agreement box, along with the date and time. That record is my proof that the terms were accepted, and yours too.

• Your email address is delivered to my inbox through FormSubmit, a form-forwarding service
• Your Direct Debit is set up through GoCardless. Your bank details go directly to GoCardless and I never see or store them
• Lawful basis: performance of a contract, and legal obligation for the payment and accounting records

Once you are a client, I also hold the ordinary things needed to run the job: your business name, contact details, the content and photos you send me for your site, and billing records.

If I contacted you out of the blue

If you received an email or a call from me about building you a website, you did not give me your details. Here is exactly where they came from and what to do about it.

What I hold

• Business name, trade, and the town or city you work in
• A business phone number and, where one was published, a business email address
• The owner's first name, where it was publicly listed
• Business address, opening hours, and public review counts and ratings
• Whether you currently have a website, and notes on its condition

Where it came from

• Google Maps and the Google Places API
• Your own business website, where you have one
• Public trade directories and business listings
• Public business pages on social media

All of it was already published, by you or on your behalf. I do not buy lists and I do not use data brokers.

Why I am allowed to

Legitimate interests: contacting a trade business, at its published business contact details, about a service directly relevant to that trade. I have weighed this against your interests, and I keep the intrusion low by contacting you once or twice and then stopping.

If you click the link in my email

The example website I link to in my email carries a short code on the end of the address. If you click it, that tells me your record on my list looked at the example, and how many times. That is the whole of it. It sets no cookie, stores nothing on your device, and does not follow you anywhere else. I use it for one thing: knowing whether a message was worth reading, so I only follow up with people who showed some interest.

I do not track whether you opened the email. There is no tracking pixel in my messages and there will not be one. If you would rather I did not count your click either, say so in your reply and I will stop, or simply type the address into your browser instead of clicking.

Client websites I build

Every site I build carries a simple click counter that tallies how many people tapped Call, Email or WhatsApp. It runs in cookieless mode, stores nothing on the visitor's device, and produces a running total only. It cannot tell my client, or me, who made any individual tap.

One exception, for honesty's sake: when I link to one of these sites as an example in my own outreach email, that link carries a code identifying the person I emailed, so I can see they took a look. It is described in full in the section above. It applies only to people I have emailed, never to a client's own customers.

Client sites are hosted on GitHub Pages, which keeps standard server logs for security and abuse prevention. If a client site collects anything beyond this, that client's own privacy notice will say so.

Who else sees your data

I do not sell data and I do not share it for anyone else's marketing. I use these service providers to run the business:

Some of these process data outside the UK. Where they do, the transfer is covered by UK adequacy regulations or by the UK International Data Transfer Addendum. I will also disclose data where the law requires it, for example to HMRC or in response to a court order.

How long I keep things

• Prospect records: deleted 24 months after the last contact, or within 30 days of you asking, whichever comes first
• Suppression list: kept indefinitely, because that is the only way to guarantee you are never contacted again
• Client records and agreements: kept for the life of the contract, then 6 years, for tax and legal reasons
• Analytics: retained by Google for 14 months, then deleted automatically

Your rights

Under UK GDPR you can ask me to do any of the following, free of charge. I will respond within one month.

• See it: get a copy of everything I hold about you
• Fix it: correct anything wrong or out of date
• Delete it: have it erased
• Stop it: object to my use of legitimate interests, including all marketing. If you object to marketing, I must stop. No balancing test, no argument
• Pause it: restrict what I do with it while a dispute is sorted out
• Move it: receive it in a portable format

Email franco@refitmy.co.uk and say which one you want. You do not need to use any particular wording.

Complaints

If you are unhappy with how I have handled your data, tell me first and I will try to put it right. You also have the right to complain to the UK regulator at any time:

• Information Commissioner's Office, ico.org.uk/make-a-complaint
• Helpline: 0303 123 1113
• Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

Complaining to the ICO does not cost anything and does not affect your rights.

Changes to this notice

If I change how I handle data, I will update this page and change the date at the top. If the change is significant and affects existing clients, I will email you about it rather than quietly editing the page.