Privacy Policy
This policy explains what we do with your personal data, why we do it, and what you can make us do about it. It is written in plain English on purpose. If anything here is unclear, email us and we will explain it properly.
1. Who we are
This website is operated by Rebecca Hobson Ltd. We are the data controller for the personal data described in this policy — meaning we decide why and how it is processed.
Rebecca Hobson Ltd
Corby Park, Derwent Close, Hornsea, HU18 1HD, England
Registered in England & Wales · Company No. 17178016
Email: [email protected] · Phone: +44 7446 389 602
We have not appointed a Data Protection Officer, as we are not required to under UK GDPR. Data protection queries go to the address above and are handled by Rebecca Hobson.
2. What we collect
We collect very little, and only what we need.
Information you give us
- Contact form: your name, your email address, any services you tick, and the message you write.
- Email or phone: whatever you choose to tell us when you contact us directly.
- Client records: if you go on to work with us — billing contact, company details and correspondence.
Information collected automatically
- Server logs: our hosting provider records your IP address, browser type and the pages requested, as a normal part of serving the site securely.
- Your cookie choice: stored on your own device (see section 7).
We do not collect special category data (health, ethnicity, beliefs, biometrics), and we do not ask for payment card details anywhere on this website.
3. Why we use it, and our lawful basis
Under Article 6 of the UK GDPR we must have a lawful basis for each purpose. Ours are set out in full below.
| What we do | Data used | Lawful basis (Art. 6) |
|---|---|---|
| Reply to your enquiry and discuss what you need | Name, email, services ticked, message | Legitimate interests — Art. 6(1)(f). Our interest is responding to someone who has asked us to. You asked; we reply. Your rights are not overridden by this. |
| Prepare a quote or proposal, then deliver agreed work | Contact and company details, correspondence | Contract — Art. 6(1)(b). Steps taken at your request before, and during, a contract. |
| Issue invoices and keep accounting records | Billing details, invoice history | Legal obligation — Art. 6(1)(c). UK tax and company law require us to keep these. |
| Keep the site online, secure and working | IP address, server logs | Legitimate interests — Art. 6(1)(f). Our interest is site security and preventing abuse. |
| Optional analytics, if we ever switch them on | Usage data via cookies | Consent — Art. 6(1)(a), plus PECR. Only ever after you press Accept. Nothing loads if you Decline or ignore the banner. |
We do not use your data for automated decision-making or profiling, and we will not add you to a marketing list because you sent us an enquiry.
4. How long we keep it
| Data | Retention period |
|---|---|
| Enquiries that do not become work | 24 months from your last contact, then deleted |
| Client correspondence and project files | 3 years after the engagement ends |
| Invoices and accounting records | 7 years — required by UK tax law |
| Server logs | Typically 30 days, per our hosting provider's default |
| Your cookie preference | Held on your device until you clear it (see section 7) |
When a period ends we delete the data or anonymise it so it can no longer identify you.
5. Who we share it with
We do not sell your personal data. We never have and we will not. We do not share it with third parties for their own marketing purposes.
We do rely on a small number of service providers who process data on our behalf, under contract and on our instructions only:
- Our web hosting provider — stores the website and generates server logs.
- Our email provider — carries the message you send us.
- Cloudflare, Inc. (cdnjs) — delivers the animation library this site uses. It receives your IP address as an unavoidable part of serving those files. It sets no cookies here.
- Indian Type Foundry (Fontshare) — delivers the typefaces this site uses. It receives your IP address for the same reason. It sets no cookies here.
We will name our current hosting and email providers on request — just ask. We may also disclose data where the law requires it, or to establish or defend a legal claim.
6. Sending data outside the UK
Our client and enquiry data is held in the UK or the European Economic Area.
Two exceptions are worth naming plainly. The content delivery networks in section 5 (Cloudflare and Fontshare) operate global networks, so serving a script or a font to your browser may involve a server outside the UK. Where that happens, the transfer is protected by an adequacy decision or by the UK's International Data Transfer Agreement / Addendum to the EU Standard Contractual Clauses. The only data involved is the IP address needed to deliver the file. Nothing you type into our form is transferred this way.
7. Cookies and similar storage
This site sets no cookies at all until you choose. The only thing stored by default is your own decision about cookies, saved in your browser's local storage under the key hobsonlens_cookies — so that we stop asking you.
Full details, including the category list and how to change your mind, are in our Cookie Policy.
8. Your rights
Under UK GDPR you have the following rights. They are free to use.
- Access — get a copy of the personal data we hold about you.
- Rectification — have inaccurate data corrected, or incomplete data completed.
- Erasure — have your data deleted, where we have no overriding reason to keep it.
- Restriction — have us pause processing while a dispute about accuracy or grounds is resolved.
- Portability — receive data you gave us in a structured, machine-readable format, or have it sent elsewhere.
- Objection — object to processing based on legitimate interests, including any direct marketing. If you object to direct marketing, we must stop, full stop.
- Withdraw consent — where processing relies on consent (analytics cookies), withdraw it at any time. Withdrawing does not affect anything done before you withdrew.
How to exercise them
Email [email protected] and say what you want. We will respond within one month, as UK GDPR requires. If a request is genuinely complex we may extend by two further months, and we will tell you within the first month if that happens, along with why. We may ask you to confirm your identity first, so we are not handing your data to somebody else.
To withdraw cookie consent, clear this site's data in your browser or follow the steps in the Cookie Policy.
9. Complaints
If you think we have handled your data badly, tell us first — we would rather fix it. Email [email protected].
You also have the right to complain to the UK's supervisory authority, the Information Commissioner's Office (ICO), at any time. You do not have to come to us first.
Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline: 0303 123 1113
Website: www.ico.org.uk
10. Security
The site is served over HTTPS. Access to enquiry and client data is limited to people who need it to do the work. We keep the amount of data we hold deliberately small, because the safest data is the data we never collected.
11. Changes to this policy
If we change how we handle your data, we will update this page and change the date at the top. Where a change is significant — a new processor, a new purpose — we will say so here rather than hope you notice.