Privacy policy

We keep this short and plain, because we collect very little. This website has no database and no user accounts. Nothing you do here is stored on the site itself.

Who we are

Bang! Graphics is a trading name of Andrew Luckman, a sole trader in the United Kingdom. Andrew Luckman is the data controller for everything described here. This policy covers this website, banggraphics.co.uk.

You can reach us about anything in this policy through our contact form, or by post at 29 Broomfield Avenue, Leigh on Sea, Essex, SS9 4BL.

The contact form

When you use our contact form we receive your name, your email address, what you told us you need, the budget bracket you picked, and your message. That arrives as an email in our inbox, and we send a short acknowledgement back to your address confirming it got through. The acknowledgement does not repeat your message back to you, so nothing sensitive is sitting in a second email.

We use these details only to reply to you and to talk about the work you asked about. There is no database here - your enquiry exists as an email and nowhere else, and we keep it only as long as we need it. Ask us to delete a past enquiry and we will.

We keep no marketing list and send no newsletters. Getting in touch does not sign you up to anything.

Stopping spam on that form

The form carries two hidden fields a person never sees and never fills in, and a signed token that proves the form was really loaded from this website rather than posted at by a script. It also limits how many times the same address or the same connection can send in an hour. All of that happens on our own server and involves nobody else.

We keep a short record of anything the form refuses, so that a genuine message wrongly caught can be found and answered rather than silently lost. It holds what was typed and the connection it came from, it is stored in a place no web address can reach, and it is deleted automatically after six months.

The form also uses Cloudflare Turnstile, a check that tells a person apart from an automated script. For almost everyone it passes silently and there is nothing to click. To make that judgement Cloudflare receives your IP address, your browser's user agent string, a fingerprint of the secure connection your browser makes, and the identifier of our form along with the page it sits on. Cloudflare uses this to decide whether you are a person, and states that it cannot identify individuals from those signals. It is not advertising, it does not follow you to other websites, and it stores nothing in your browser. Cloudflare describes its part in its own Turnstile privacy policy.

This one runs whatever you chose in the cookie banner. Without it the form cannot tell an enquiry from a spam script, so it is necessary rather than optional. It is on the contact page and nowhere else.

Booking a call

The contact page offers a booking calendar for the free thirty-minute call. It is provided by TidyCal, and its part of the page is loaded from their servers, so opening that page means your browser contacts them. If you go on to book, the name, email address and any note you give go to TidyCal and then to us. Booking is entirely optional - the form beside it reaches the same person without involving anybody else.

Cookies and analytics

Nothing is loaded from Google until you say yes. If you decline, or simply never answer the banner, no analytics script is requested, no analytics cookie is set and no visit is recorded. The only thing kept in your browser at that point is a single preference remembering your answer, held in your browser's local storage rather than in a cookie, so it is never sent to us or to anyone else.

If you accept, we load Google Analytics. It sets two cookies which last two years and let it tell a returning visit from a new one. We use it to count visits and see which pages get read. Google acts as our analytics provider under its data processing terms and handles this data on servers outside the UK, including in the United States; it describes its part in its own privacy policy. Advertising features, ad personalisation and Google Signals are switched off in our account, so nothing collected here is used to build an advertising profile of you.

You can change your mind whenever you like using the Cookie settings link at the bottom of every page. Turning analytics off takes effect immediately, without reloading the page, and deletes the cookies Google set.

Fonts

Our typefaces are served from this website rather than from Google Fonts, so reading a page here does not hand your IP address to a font provider.

Server logs

Like almost every website, our hosting platform keeps standard access logs - IP address, browser type, pages requested - for security and diagnostics. The platform is run for us by a UK data-centre provider under a written contract, the servers are in the United Kingdom, and the provider processes that data only on our instructions.

What we never do

We do not sell your data, run advertising on this website, or use anything we collect to target you with ads anywhere else. There is no advertising pixel, no tracking pixel and no social media tracker anywhere on this site. The acknowledgement email we send you carries no open tracking and no rewritten links.

Why we are allowed to hold any of it

The law asks us to name the lawful basis for each thing, so here it is without the jargon.

• Answering your enquiry - because you asked us to, and because we have a legitimate interest in running an enquiry process that works.
• The record of refused spam - our legitimate interest in keeping the form usable, and in being able to find a genuine message it caught by mistake.
• Booking a call - taking steps at your request before entering into a contract.
• Analytics - your consent, given in the cookie banner and withdrawable at any time.
• Server logs - our legitimate interest in keeping the site up and secure.

If you become a client

Working together means we will hold more than an enquiry: your contact details, the content you send us for your website, invoices, and the login details needed to do the job. That is held to perform our contract with you and for as long as UK law requires us to keep business records. It is not used for anything else, it is never sold, and it is never shared except with the suppliers needed to deliver the work - our host being the obvious one. If you ask us what we hold about you, we will tell you.

Your rights

Under UK data protection law you can ask us what we hold about you, ask us to correct it, or ask us to delete it. Given how little we collect, that will usually mean finding and deleting an email thread, and we will do it promptly. If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office.

Changes

If this policy changes, the new version appears on this page with an updated date at the top.