Privacy Policy

This policy explains how personal information is handled on this website. The website is operated by Olly Whitehead, trading as Olly Whitehead Lighting, who is responsible for the personal information described here. In this policy, "I", "me" and "my" refer to Olly Whitehead.

Contact

If you have a question about this policy or your personal information, please use the enquiry form and choose "Something else" as the enquiry type. If I have already emailed you, you can also simply reply to that email.

Information I collect

Enquiries

When you send an enquiry through the contact form, I receive:

• your name and email address;
• the company or production, venue and dates, if you give them;
• the type of enquiry and your message;
• the date and time you sent it.

Only your name, email address and message are required. The form also contains a simple anti-spam check (a hidden field and the time taken to complete the form); it does not record your IP address or details about your device.

When you send an enquiry, it is saved in the website's database and a copy is emailed to me privately so that I see it promptly. I reply to you by email from my own email account, and any further correspondence takes place by email. The website does not send you any automatic emails, hold conversations or create an account for you.

Browsing the website

You can view the website without giving any personal information. It does not use analytics, advertising or tracking cookies, and it does not include social media plug-ins, embedded videos or maps that would share your visit with other companies.

Like most websites, the services that deliver it to your browser (see "Who your information is shared with") may process technical information such as your IP address and browser type to deliver pages securely and to protect the website from misuse.

The administration area

The website has a private administration area, used only by me. Signing in to it uses a secure session cookie (explained in the Cookie Policy), and a record of administrative actions — such as signing in and changes to the website's content — is kept for security. Visitors never need to sign in.

How your information is used

I use the information you send through the contact form only to:

• receive and respond to your enquiry;
• discuss potential work with you;
• arrange and administer any work that results;
• keep appropriate business records;
• meet legal, accounting and tax obligations where they apply;
• establish, exercise or defend legal claims where necessary.

There is no mailing list, and I do not send marketing emails. Sending an enquiry does not subscribe you to anything, and your details are never sold.

The tick box on the contact form confirms that you have seen this policy. It is not consent to marketing.

Lawful bases

Under UK data protection law, I rely on the following lawful bases:

• Responding to your enquiry and discussing potential work: my legitimate interests in responding to people who contact me and, where you are asking about work, taking steps at your request before entering into a contract.
• Arranging and administering work that results: performance of a contract.
• Keeping business, accounting and tax records: legal obligation, and my legitimate interests in keeping proper records.
• Establishing, exercising or defending legal claims: my legitimate interests.
• Keeping the website and its administration area secure: my legitimate interests in protecting the website.

Who your information is shared with

I use trusted service providers to run the website. They process information on my behalf and only for that purpose:

• Supabase — provides the website's database (where enquiries are stored), the sign-in system for the administration area and image storage.
• Resend — sends me the email that notifies me of each new enquiry (it contains what you entered in the form).
• OVH (the server that runs the website) and Cloudflare (which delivers it to your browser) — deliver the website securely and help to protect it from misuse.

When I reply to your enquiry by email, our correspondence is held in my email account by the provider of that account, as with any email.

I may also share information where the law requires it, or with professional advisers (such as an accountant) where reasonably necessary.

Where your information is stored

The website's database and image storage are hosted by Supabase in its London (UK) region, and the server that runs the website is in OVH's London (UK) data centre. Backups of the database and images are kept on my own encrypted computer in the UK. Resend, which sends me the notification email for each enquiry, stores those emails in the United States. Supabase and Resend are based in the United States, and some service providers — such as Cloudflare, or the provider of an email account — may process information outside the UK. Where personal information is transferred outside the UK, I rely on the safeguards those providers put in place for international transfers, such as UK adequacy regulations (including the UK Extension to the EU-U.S. Data Privacy Framework) or approved contractual clauses (the International Data Transfer Addendum).

How long information is kept

Enquiries are generally kept for 24 months from the last relevant correspondence. Where an enquiry leads to work, relevant information may be kept for longer where reasonably necessary for contractual records, legal, accounting or tax obligations, or to establish, exercise or defend legal claims.

Enquiries are deleted manually — they are not deleted automatically. I review them and delete those that are no longer needed, both from the website's database and from my email account. A deleted enquiry can remain in the website's backups for up to 13 months, after which those backups are deleted automatically; backups are only used to restore the website if something goes wrong.

Copies of notification emails held by Resend are deleted automatically after 30 days. The server's access logs — which record technical information such as IP addresses, the pages requested and the browser used — are kept for 14 days and then deleted automatically.

Records of administrative actions are kept for as long as they are useful for keeping the website secure. They do not contain the content of enquiries.

Keeping information secure

I take reasonable steps to protect personal information. Enquiries can only be read by signing in to the private administration area, and access rules in the website's database stop anyone else from reading them. No method of storing or sending information over the internet is completely secure, but I aim to protect your information appropriately.

Your rights

You have rights over your personal information, including the right to:

• ask for a copy of the information I hold about you;
• ask me to correct information that is wrong or incomplete;
• ask me to delete your information;
• ask me to restrict how I use your information;
• object to my use of your information where I rely on legitimate interests;
• ask for information you gave me to be provided in a portable format, where this applies.

To make a request, use the enquiry form or reply to any email I have sent you. You can make a request in any way you like — you don't need to use particular words. There is normally no charge, and I will respond within one month. I may need to confirm your identity before acting on a request.

Complaints

If you have a concern about how your information is handled, please contact me first so I can try to put it right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator: ico.org.uk/make-a-complaint (opens in a new tab).

Links to other websites

This website links to other websites, such as professional bodies and Live Q Solutions (liveqsolutions.co.uk). Their privacy practices are their own, so please read their policies when you visit them.

Changes to this policy

I may update this policy, for example if the website changes. The current version will always be on this page.