Short version
Estatovio collects personal data only when you contact us, through the contact form or by email. We use it to reply to you and, if you become a client, to deliver the work. We do not sell it, we do not use advertising or tracking cookies, and we do not add you to any mailing list.
Who is responsible
Estatovio is responsible for the personal data described here (the data controller). Contact us about privacy at hello@estatovio.site.
What we collect and why
| What | When | Why | Lawful basis |
|---|---|---|---|
| Name, email address, optional agency name, topic and message | When you use the contact form | To read and reply to your message | Legitimate interests in answering enquiries, or steps you ask us to take before a contract |
| Anything you include in an email | When you email us | To reply and, if relevant, to prepare a proposal | As above |
| Project correspondence and contract details | If you become a client | To deliver the work and keep business records | Contract, and legal obligation for accounting records |
| A short-lived session cookie and a hashed record of form attempts | When the contact form is shown or used | To protect the form from automated abuse | Legitimate interests in keeping the form secure |
The contact form asks you not to include details about your own clients or their properties. If you include them anyway, we use them only to reply and delete them with the rest of the enquiry.
Form security records
To stop automated spam, the contact page sets a session cookie when it shows the form, which expires when you close your browser, and each submission that passes our checks is recorded against a one-way hash of your connection's IP address, never the address itself. These records are kept in a private folder that the web server does not serve, and any record older than 24 hours is deleted each time the contact page is loaded.
If a message cannot be sent because something needs correcting, the details you typed are held in that session just long enough to show them back to you on the reloaded page, so you do not have to type them again. They are cleared as soon as the page has displayed them, or when the session ends.
Who we share it with
We do not sell or rent personal data. Messages are delivered through our email hosting provider, and the website runs on our web hosting provider's servers. Both act on our instructions. If you become a client, our accountant may see invoices and contract records. We share data with others only if the law requires it. Ask us at any time and we will tell you where your data is held.
How long we keep it
- Enquiries that do not lead to a project: deleted within 12 months of our last exchange.
- Client records: kept for six years after the end of the project, for tax and legal purposes.
- Form security records: deleted after 24 hours, as described above.
Your rights
UK data protection law gives you several rights over your data: you can request a copy of it, have mistakes corrected, have it erased, limit or object to how it is used, and receive it in a portable format, each within the limits the law sets. To use any of these rights, email hello@estatovio.site. We reply within one month.
If something has gone wrong with your data, write to us and we will look into it straight away. You can also take a complaint to the Information Commissioner's Office, the UK data protection regulator, at ico.org.uk.
Cookies
This website sets one cookie, only on the contact page and only when the enquiry form is shown: a session cookie used to protect the form. It holds only a random identifier, expires when you close your browser and is not used to track you. There are no analytics, advertising or social media cookies. The cookie notice has the details.
Links to other websites
Our guides link to official and other external sources. Those websites have their own privacy practices, which this notice does not cover.
Updates
When our handling of personal data changes, this notice and the date at the top are revised to match.