Privacy

Who is responsible for your data

This site is run by Toby Kalkman, trading as Kalkman Code, a sole trader based in Suffolk, United Kingdom. For the purposes of UK data protection law I am the data controller for any personal information you give me through this website or in the course of doing work for you.

You can reach me at hello@kalkmancode.co.uk or on 07364 245403. My postal address is 10 Irex Road, Lowestoft, Suffolk, NR33 7BU.

What I collect, and when

If you fill in the enquiry form, I collect what you type into it: your name, your email address, what you are asking about, and optionally your phone number and any notes you add.

If you email, message or ring me instead, I hold whatever you chose to tell me in that message, and a note of what we agreed.

If I build something for you, I keep what the job needs: the specification, the correspondence, what was delivered and what you were invoiced.

I do not run analytics on this site, I do not use advertising or tracking cookies, and there are no third-party trackers embedded in these pages. Fonts are served from this domain rather than fetched from anyone else. See the cookie notice for the detail.

Work I build for you

Software I build may hold your data or your customers’ data. What it collects and how long it keeps it is decided in the specification, and once the work is handed over you are the controller of everything in it.

Apps I release for free are built not to collect anything — HorseDex, for instance, keeps its records on your own devices. If you turn sync on they are copied between your devices through your own iCloud, using Apple’s CloudKit private database, and backups go to your own iCloud Drive. That is between you and Apple: there is no account to create with me, no server of mine involved, and nothing comes to me. Where a released app differs from that, its own privacy notice says so.

Why I am allowed to hold it

When you send an enquiry, the lawful basis is legitimate interests: you have asked me to get in touch about work, and replying to you is the obvious and expected use of what you sent. Once you commission something, the basis becomes performance of a contract, and some records are then kept because tax law requires it.

Who else sees it

Enquiry form submissions are delivered to my inbox through Web3Forms, a form-delivery service acting as a processor on my behalf. The message passes through their systems in order to reach me.

Web3Forms is based outside the United Kingdom and runs its servers in the United States, so submitting the form sends what you wrote overseas. They do not keep form submissions — each one is processed and forwarded straight to me — but their server logs can hold personal data for a short period, which they delete periodically. If you would rather your message did not leave the UK, email or ring me instead of using the form.

This website is hosted on Cloudflare Pages. Cloudflare processes the technical information that any web server sees when you visit a page, such as your IP address, for security and delivery purposes.

My email runs on Google Workspace, so anything you send me — by the form, or directly — is stored and processed by Google, which operates servers outside the United Kingdom. Beyond those three, I do not share, sell, rent or trade your information with anyone. Nobody is buying a marketing list from me.

How long I keep it

Enquiries that do not turn into work are deleted within twelve months. If you become a client, I keep the job records and correspondence for the life of the working relationship and for six years afterwards, because HMRC requires business records to be kept for six years.

If you want your enquiry deleted sooner than that, ask me and I will do it.

Your rights

Under UK GDPR you have the right to:

• ask what personal data I hold about you, and get a copy of it
• have anything inaccurate corrected
• have your data deleted, where I have no legal reason to keep it
• object to my processing it, or ask me to restrict what I do with it
• ask for your data in a portable format

Email me and I will deal with it. There is no charge, and I will respond within one month.

Complaints

If you think I have handled your data badly, please tell me first so I can put it right. You also have the right to complain directly to the Information Commissioner’s Office at ico.org.uk, or on 0303 123 1113.

Changes

If this policy changes, the date at the top of the page changes with it. I will not quietly alter it and pretend otherwise.