Privacy policy.

Who is responsible for your data

This website is run by Shaun Dower, a sole trader based in Stevenage, trading as Dower Digital. That means I am the "data controller" for the information described here — legally, the buck stops with me personally, not with a company.

• Email shaun.dower@gmail.com
• Phone 07958 429676
• Location Stevenage, Hertfordshire, United Kingdom

For anything about your personal data — a question, a request, or a complaint — email is the fastest route and reaches me directly.

What is collected, and why

Project enquiries

When you send a briefing through the contact form, it collects your first and last name, email address and phone number, and optionally your company name, current website and a message.

This is used for one thing: to reply to your enquiry, discuss the work and prepare a quote. It is not added to a marketing list and you will not receive unsolicited follow-ups.

Lawful basis: taking steps at your request before entering into a contract (UK GDPR Article 6(1)(b)), and legitimate interests in responding to people who contact the business (Article 6(1)(f)).

Email, phone and WhatsApp

If you contact me directly rather than through the form, the message and your contact details sit in my inbox or phone and are used to reply to you. Email is handled by Google (Gmail); WhatsApp messages are handled by WhatsApp under its own privacy terms.

Analytics — only with your consent

This site uses Google Analytics 4 to understand which pages are useful and where visitors get stuck. It is switched off by default. The analytics tag loads with consent denied and is only enabled if you choose "Accept all" on the cookie banner. Choose "Essential only" and no analytics cookies are written.

When enabled, it collects pages visited, approximate location (city level, derived from your IP address, which Google does not store), device and browser type, and how you arrived at the site. It is not used to identify you personally, and advertising and personalisation signals are switched off.

Lawful basis: your consent (UK GDPR Article 6(1)(a) and PECR Regulation 6). You can withdraw it at any time — see cookies below.

Server logs

The site is hosted by Netlify, which keeps standard technical logs (IP address, request time, page requested, browser type) to serve pages and protect against abuse. These are Netlify's own operational records and are not used to build any profile of you.

Lawful basis: legitimate interests in running a secure, working website (Article 6(1)(f)).

Cookies and browser storage

Here is the complete list. There is nothing hidden behind it.

The first two are stored in your browser's own local storage rather than as traditional cookies, and are strictly necessary for the site to behave sensibly. They never leave your device.

Changing your mind

Withdrawing consent is as easy as giving it. Use the button below to clear your saved choice — the banner will reappear so you can choose again.

You can also block or delete cookies in your browser settings, or opt out of Google Analytics across all sites with Google's opt-out browser add-on.

Who else sees your data

Your data is never sold, rented or traded. It is shared only with the services needed to actually run the business, each acting on my instructions:

• Netlify — website hosting and contact form delivery. Form submissions are stored in a Netlify account only I can access.
• Google — Google Analytics (only with your consent) and Gmail, which handles enquiry emails.

Both are based in the United States, so some data is transferred outside the UK. Those transfers rely on the UK's adequacy decision for the EU–US Data Privacy Framework and on standard contractual clauses with the UK International Data Transfer Addendum, which are the safeguards UK law requires.

Beyond that, data is only ever disclosed where the law requires it — for example, a valid request from a court or regulator.

What this site deliberately does not do

• No advertising or remarketing pixels — no Meta pixel, no Google Ads tags, no LinkedIn insight tag.
• No third-party fonts. Typefaces are served from this site, so loading a page does not send your IP address to a font CDN.
• No session recording, heatmaps or scroll tracking.
• No automated decision-making or profiling.
• No newsletter or mailing list.

How long it is kept

• Enquiries that do not become projects — deleted after 24 months.
• Client records, contracts and invoices — kept for 6 years after the end of the working relationship, as HMRC requires.
• Analytics data — retained by Google for 14 months, then automatically deleted.

If you would like your enquiry deleted sooner than that, just ask and it will be.

Your rights

Under UK data protection law you have the right to:

• Access — get a copy of the personal data held about you.
• Rectification — have inaccurate details corrected.
• Erasure — have your data deleted, where there is no legal reason to keep it.
• Restriction — ask that processing be paused while a dispute is resolved.
• Portability — receive your data in a portable format.
• Object — object to processing based on legitimate interests.
• Withdraw consent — turn analytics back off at any time, with no effect on anything that happened before.

Email shaun.dower@gmail.com and you will get a response within one month, free of charge. You may be asked to confirm your identity first, so that data is not handed to the wrong person.

If you are unhappy with how your data has been handled, you can complain to the Information Commissioner's Office — the UK's data protection regulator — at ico.org.uk/make-a-complaint or on 0303 123 1113. Raising it with me first is welcome, but it is not a prerequisite.

Security

The site is served over HTTPS, so traffic between your browser and this server is encrypted. Form submissions and email are protected by strong, unique passwords and two-factor authentication on the accounts that hold them. Access is limited to one person: me.

No system is perfectly secure, and anyone claiming otherwise is selling something. If a breach ever affects your rights and freedoms, you will be told, and the ICO will be notified within 72 hours as the law requires.

Changes to this policy

If this policy changes materially, the date at the top of the page changes with it. Substantial changes affecting how your data is used will be flagged on the site rather than slipped in quietly.