Who is responsible
Groundwork is a sole trader business run by Ben Hosking from Olney, Milton Keynes, building and hosting websites for tradespeople. Under UK data protection law I am the data controller for anything collected through this site, which means the decisions about your information are mine and so is the responsibility for them.
Contact me about anything on this page at info@benhosking.co.uk. There is no data protection officer; a business this size is not required to appoint one, so you are dealing with me directly.
What I collect
Only what you type into the enquiry form, or the event sign-up. Nothing is gathered in the background.
| What | Why I ask |
|---|---|
| Your name | So I know who I am replying to |
| Your email address | So I can reply |
| Your trade | So I can point you at the right demo |
| Where you work | Optional. Tells me whether I can help. |
| Your message | Optional. Whatever you choose to tell me. |
If you register interest in the launch event, I take your email address and nothing else.
To stop the forms being flooded by bots, the server also keeps a scrambled version of your IP address for up to a day after you send one. It is used to count how many messages come from one connection, for nothing else, and is cleared out after a day, the next time anyone uses the form.
There is no analytics on this site. No Google Analytics, no Meta pixel, no session recording, no advertising trackers, no heatmaps. I genuinely do not know who visits or how many.
My web host, IONOS, keeps server logs containing IP addresses as a normal part of running a server. Those are theirs, not mine, and I do not read them.
What allows me to hold it
UK GDPR only permits me to use your information if I have a lawful basis for it. Here is each one, plainly:
| What I do | Lawful basis |
|---|---|
| Reply to your enquiry | Legitimate interests. You contacted me asking for a reply, so replying is what you expect and it does not override your rights. |
| Do the work, if you hire me | Contract. I cannot build and host your site without your details. |
| Keep invoices and records for six years | Legal obligation. HMRC requires business records to be kept that long. |
| Email you the event date, if you register | Consent. You asked to be told. Ask to come off and you are removed. |
| Keep a scrambled IP address for a day | Legitimate interests. Keeping the forms working for real people by stopping automated floods. |
| Load the service area map | Consent. Which is why it does not load until you accept cookies, and why declining costs you nothing else. |
What I do with it
The form sends me an email, and saves a copy as a plain text file in a private folder on my web host, so an enquiry is not lost if the email goes astray. There is no database behind this site. Your details sit in my inbox and in that one file.
I use them to reply to you and, if you become a client, to do the work. I do not sell them, rent them, share them for marketing, or add you to a mailing list. The only list is the event one, and only if you sign up to it: one email when the date is set, and nothing else. No decisions about you are made automatically, and there is no profiling.
How long I keep it
- If we do not end up working together: I delete the enquiry, both the email and the saved copy, after about twelve months.
- If you become a client: I keep what I need for as long as I am working for you, then six years after our last invoice, because HMRC requires it.
- Event sign-ups: deleted once the event has happened.
- The scrambled IP address: a day, then it is cleared out the next time anyone uses the form.
- Your cookie choice: stays in your own browser until you clear it. It never reaches me.
Who else is involved
These companies touch this site. None of them are given your enquiry to use for their own purposes.
| Who | What they do | Where |
|---|---|---|
| IONOS | Hosts the site, stores the saved copy of your enquiry, and carries the email it travels in | EU and UK |
| Resend | Delivers the email a form sends me. Your enquiry passes through it on the way to my inbox. | USA |
| Google Fonts | Serves the typefaces. Requesting a font sends your IP address to Google. | USA |
| Google Maps | Shows a service area on some demo sites. Only loads if you accept cookies. | USA |
Information leaving the UK
Google is a US company, so loading a font or a map involves your IP address going to the United States. Google relies on the UK Extension to the EU-US Data Privacy Framework and on standard contractual clauses to make that lawful.
Resend is a US company too, so an enquiry sent through it passes through the United States on its way to me.
If you would rather that did not happen, decline cookies and the map never loads. The fonts are harder to avoid, though they can be self-hosted instead, and on a client site I will do that if asked.
Keeping it safe
- The whole site runs over HTTPS, so anything you type is encrypted in transit.
- There is no customer database. Saved enquiries are plain files in a private folder outside the public part of the site, which a browser cannot reach.
- Where a site of mine does use a database, its credentials live outside the public web folder, so they cannot be downloaded.
- Only I have access to the inbox your enquiry lands in.
No system is perfect. If something did go wrong in a way that put you at risk, I would tell you, and I would report it to the ICO within 72 hours as the law requires.
Your rights
Under UK GDPR you can ask me to:
- Tell you what I hold about you, and give you a copy
- Correct anything that is wrong
- Delete it, where I have no obligation to keep it
- Stop or restrict what I am doing with it
- Object to my using it under legitimate interests
- Receive it in a portable format you can take elsewhere
- Withdraw consent where you gave it, which for this site means clearing your cookie choice
Email info@benhosking.co.uk and I will deal with it within one calendar month. There is no charge and you do not have to give a reason. Withdrawing consent does not undo anything done before you withdrew it.
If you are unhappy with how I have handled something, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. I would rather you came to me first so I can put it right, but that route is always open to you and you do not need my permission to use it.
Children
This site is aimed at people running trade businesses. It is not intended for under-18s and I do not knowingly collect anything from them. If you believe a child has sent me their details, email me and I will delete them.
If this page changes
The date at the top changes with it. If something materially different happens to how I handle enquiries, I will say so here rather than quietly editing the text.
About the demo sites.
The trade sites linked from here are demonstrations. The businesses are not real and the phone numbers are placeholders. Anything sent through their forms comes to me, not to a tradesperson, so please do not use them to book real work or send details you would not want me to see. They are kept out of search engines for the same reason.