Privacy notice

This notice explains what personal data Cardboard Rocket collects, why, and what rights you have over it. Cardboard Rocket is the data controller, and is a sole trader based in Glasgow, Scotland.

What I collect

If you use the contact form, I collect the name, email address, company name (if you give one), the service and budget range you select, and whatever you write in the message. That is the only personal data this website collects. There is no analytics, no advertising tracking, and no third-party cookies.

Why I collect it

To reply to your enquiry and, if we go on to work together, to deliver and administer that work. The lawful basis is legitimate interest: you have contacted a business asking it to get back to you, and replying is the obvious expected outcome. Where we enter into a contract, the basis becomes performance of that contract.

Who sees it

Me. Enquiries are not sold, shared, or passed to marketing services. Data is processed on hosting and email infrastructure located in the UK or EEA, or under equivalent safeguards where a provider operates elsewhere.

How long I keep it

Enquiries that do not lead to work are deleted within 12 months. Where we do work together, I retain project correspondence and billing records for six years, which is the period HMRC requires for business records.

Your rights

Under UK GDPR you have the right to:

• Ask what personal data I hold about you, and get a copy
• Have inaccurate data corrected
• Ask me to delete your data, where I have no obligation to keep it
• Object to or ask me to restrict how I use it
• Ask for your data in a portable format

To exercise any of these, email hello@cardboardrocket.co.uk. I will respond within one month.

Complaints

If you think I have handled your data badly, please tell me first so I can put it right. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk.

Changes

If this notice changes, the updated version will appear here with a new date at the top.