Your information, handled properly.

01Who I am

1.1The controller

I’m Karl Chevalier, a sole trader based in the United Kingdom. I’m the controller of the personal information described in this policy. That means I decide how it’s used, and I’m responsible for looking after it under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

• Contact form: karlchevalier.co.uk/contact
• Address: Spring Bank Farm, Tan Yard Brow, Gorton, M18 8UJ

1.2Questions about privacy

I’m not required to appoint a Data Protection Officer, and I haven’t. I deal with privacy questions myself, so send me a message through the contact form about anything in this policy.

1.3Who this policy covers

This policy covers:

• people who visit this website, karlchevalier.co.uk;
• people who contact me or use the website builder;
• my clients, and the people who work with them, such as managers and agents;
• people and agencies who join my referral programme or partner with me; and
• people at businesses I contact about their websites (section 12.1).

It doesn’t cover the websites I build for clients. Section 9 explains those.

02What I collect, and why

Data protection law says I need a lawful reason, called a “lawful basis”, for each way I use personal information. Here’s each situation: what I collect, why, the lawful basis I rely on and how long I keep it.

03Sensitive information

I don’t ask for sensitive (“special category”) information, such as details about your health, religion, sexual orientation or political opinions. Please don’t include it in messages unless it’s genuinely relevant to your website.

If you do share it, for example because your content is about your health, I’ll use it only for your project and treat it with extra care. I rely on your explicit consent, or on the fact that you’ve made the information public yourself.

04Cookies, analytics and third-party content

4.1Your choice

This website uses cookies to count visits (4.2). The law allows cookies used only to count visits and improve a website without asking first, as long as it’s explained and you can easily switch them off, so there’s no pop-up. To switch analytics off, use “Cookie settings” at the bottom of any page: the website works exactly the same without it. Your choice is remembered in your browser’s local storage, and you can switch it back on the same way. If you said no when this website used to ask, analytics stays off.

The website builder for creators also uses your browser’s session storage to keep your choices while you move between pages. That stays on your device and is cleared when you close the tab.

4.2Analytics

This website uses Google Analytics to count visits and show which pages are useful, only so I can improve the website. It sets two cookies, _ga and _ga_YWL9GC2QVZ, which tell visits apart and last up to two years unless you clear them. I look at totals and trends, not individual visitors. I’ve turned off Google’s advertising features, Google signals and Google’s own use of the data for this website, so Google handles it only on my behalf and it isn’t used to personalise ads. If you switch analytics off, the cookies are deleted and nothing more is sent to Google Analytics. How Google uses information from websites that use its services explains more.

4.3Fonts

The typefaces on this website are stored on this website itself, so loading them doesn’t involve anyone else and doesn’t use cookies.

4.4Checkout

When you check out, you’re taken to a payment page run by Stripe on Stripe’s own website. Stripe uses cookies and similar technologies there to process your payment and prevent fraud. For those purposes Stripe acts independently of me, and Stripe’s privacy policy explains how it uses your information.

4.5If this changes

If I add anything else that uses cookies, I’ll update this policy first and ask for your consent wherever the law requires it.

05Who I share it with

I only share your information when it’s needed. It may be received by:

• Stripe, my payment provider, to take payments and manage Care subscriptions.
• Service providers who help me run the business: my email and file-storage provider, the hosting provider for this website, and the infrastructure providers I use to host clients’ websites. They handle information only on my instructions, under contracts that require them to keep it secure.
• GitHub and Anthropic, if I’ve looked at your business or emailed you about its website: my working notes are in a private GitHub repository, and I use Anthropic’s Claude to help with research and drafts (12.1).
• Google, as the provider of the analytics on this website, unless you’ve switched it off (4.2).
• My accountant, and HMRC or other authorities where the law requires it.
• Professional advisers, such as a lawyer or insurer, if I need their help.
• Companies you’ve asked me to work with for your website, for example when I set up your email provider, newsletter tool or payment account in your name.
• A successor, if the business is ever transferred, for example to a limited company I set up. Your information would pass to it under this policy, and I’d tell you.

I don’t sell your information, use it to target adverts, or share it with data brokers or social networks. Ask me and I’ll tell you exactly which providers I use.

06Transfers outside the UK

Some of the providers above, including Stripe, Google, GitHub and Anthropic, are based in other countries, including the United States, or have staff or systems there. When your information is transferred outside the UK, it’s protected by one of the safeguards the UK GDPR requires:

• UK adequacy regulations, which confirm that a country protects personal information properly. These include the UK–US “data bridge” for US companies certified under it; or
• standard contract terms approved for UK transfers: the International Data Transfer Agreement, or the UK Addendum to the EU’s standard contractual clauses.

Ask me if you’d like more detail about a particular transfer.

07How long I keep it

After that, information is securely deleted, or anonymised so that it no longer identifies you. If there’s a legal claim or dispute, I may keep the relevant information until it’s resolved.

08How I keep it safe

I use appropriate technical and organisational measures to protect your information, including:

• two-factor authentication on the accounts that hold your information;
• encrypted connections (HTTPS) for this website and the websites I host;
• encrypted devices, protected by strong passwords;
• a password manager for any access details you share. Please never send a password in an ordinary email; I’ll give you a secure way to share it;
• giving access only where it’s needed, and removing it when it isn’t; and
• keeping software up to date.

No system is perfectly secure. If something goes wrong that puts your information at risk, I’ll tell you, and I’ll tell the regulator where the law requires it.

09Websites I’ve built for clients

If you’re a visitor, customer, subscriber or member of a website I’ve built and look after for a business or creator, the business or creator who runs it is the controller of your information, not me. I handle it only on their behalf, to host and maintain their website, under a data processing agreement.

Their own privacy policy explains how they use your information, and you should contact them to exercise your rights. If you contact me instead, I’ll pass your request on to them.

10Your rights

10.1What you can ask for

Under data protection law, you have the right to:

• Access: ask for a copy of the information I hold about you.
• Rectification: ask me to correct anything inaccurate or incomplete.
• Erasure: ask me to delete your information.
• Restriction: ask me to limit how I use it, for example while we check whether it’s accurate.
• Objection: object to my using it where I rely on legitimate interests.
• Portability: ask for the information you’ve given me in a machine-readable format, or ask me to send it to someone else, where I use it on the basis of our contract or your consent.
• Withdrawing consent: where I rely on your consent, you can withdraw it at any time.

I don’t make decisions about you based solely on automated processing, and I don’t use your information for profiling.

10.2Exceptions

Some rights have exceptions. For example, I can’t delete financial records the law requires me to keep. If an exception applies, I’ll explain it.

10.3How to use your rights

Send me a message through the contact form, or reply to any email I’ve sent you. There’s no charge. I’ll carry out reasonable and proportionate searches and reply within one month. If a request is complex, I may need up to two more months, and I’ll tell you within the first month if so. I may need to confirm your identity first; if I do, the time limit starts once I have.

11Complaints

11.1Complaining to me

If you’re unhappy with how I’ve handled your information, please tell me first through the contact form, starting your message with “Privacy complaint”. I’ll acknowledge it within five working days, and always within the 30 days the law allows. I’ll look into it without undue delay, keep you updated and tell you the outcome.

11.2Complaining to the regulator

You also have the right to complain to the UK’s data protection regulator, the Information Commission. It replaced the Information Commissioner’s Office on 30 September 2026 and is still known as the ICO. The ICO will usually expect you to have raised your concern with me first.

• Online: ico.org.uk/make-a-complaint
• Helpline: 0303 123 1113
• Post: ICO, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

12Marketing

I don’t run a newsletter or a mailing list, and I don’t buy or sell lists. I do sometimes email a business directly, when I’ve looked at its website and think I can help. Section 12.1 explains how that works.

I’ll still email clients about their projects, Care and important changes. Those are service messages, not marketing.

12.1Emails to businesses

If you’ve had an email from me about your business’s website, here’s what you should know.

• What I hold: your name and role, your work email address, your business’s name, website and public company details, what I noticed about its website, and a record of what I’ve sent you and any reply. I may also keep the address of your public LinkedIn or Instagram profile, and a note if I’ve connected with you there or followed your business.
• Where it came from: your business’s own website, and the public register at Companies House. Occasionally other public listings, such as OpenStreetMap or a web search. I don’t buy contact lists. I don’t use dates of birth or home addresses from Companies House.
• Why, and my lawful basis: legitimate interests, in telling businesses about work that could help them. I’ve weighed that against your rights, and you can ask to see that assessment. I only email companies, LLPs and similar organisations in this way, not sole traders or ordinary partnerships, unless they’ve asked me to.
• How many: at most three emails, about a week apart. I don’t track whether you open them. Any link in them is the same for everyone, so I can’t tell who clicked it: a visit to my website from one is counted like any other visit (4.2).
• Saying no: reply and tell me, and that’s the end of it. You have an absolute right to object to direct marketing. I’ll add your address to a do-not-contact list, which I keep only so you won’t be contacted again.
• How long I keep it: if I decide not to contact you or connect with you, your details are deleted within a month of my finding them. If I do and nothing comes of it, your name, address, our emails and any note of a connection are deleted after 12 months. I keep the name of the business, the dates and the outcome, so I don’t approach it again. If we go on to work together, section 7 applies instead.
• Who else handles it: my email is hosted by Krystal, in the UK. My working notes are in a private repository at GitHub, and I use Anthropic’s Claude to help with the research and drafts. Both are in the United States (see section 6). I read and approve every email myself, and no decisions are made about you by a computer alone. Nothing is shared with anyone else.

13Children

My services are for adults. If you’re under 18, a parent or guardian needs to place any order (see my terms). If a parent or guardian works with me on a younger creator’s behalf, I’ll use the young person’s information only for their project, and with extra care.

This website isn’t aimed at children, and I don’t knowingly collect information from children under 13 except through their parent or guardian.

14Links to other websites

This website links to other websites, such as social networks. They have their own privacy policies, and I’m not responsible for how they handle your information.

15Changes to this policy

I’ll update this policy whenever anything changes, and the date at the top of the page will show when it was last updated. If a change significantly affects how I use clients’ information, I’ll email you before it takes effect.