This website is operated by Harrison Baghurst, trading as Harrison Baghurst Digital, based in Durham, England. I am the data controller for the personal data described in this policy, which means I decide how and why it is used.

For anything relating to this policy, including any request to exercise your rights, email me at 070806harrison@gmail.com. My full postal address is available on request by email.

This policy covers personal data collected through this website. If you go on to book maths tuition or freelance web development work, additional information is handled as part of that arrangement, which is explained in section 8.

When you use the contact form, I collect your first name, last name, email address and the content of your message. These are the only fields on the form, and it is entirely your choice what you put in the message.

Once your message has been sent, it arrives in my email inbox and is stored there in the same way as any other email I receive.

The form includes a hidden field that people cannot see but automated bots tend to fill in, and it measures how long the form took you to complete. Both are used only to decide whether a submission is automated. Neither is stored after the submission has been dealt with.

When you submit the form, your IP address is used to apply a rate limit, currently 3 submissions per hour per visitor, alongside a site-wide limit. This stops the form being used to send bulk spam.

Your IP address is held only as a short-lived counter in a rate-limiting database. It is not stored alongside your message, is not used to identify or profile you, and is deleted automatically when the relevant time window expires.

Like any website, this site is served by a hosting provider that keeps standard technical logs of requests. These can include your IP address, browser and device type, the page requested, the time of the request and the response. These logs are used for security and troubleshooting.

There are no user accounts on this site. I do not collect payment or card details through it, I do not build profiles of visitors, and I do not deliberately collect any special category data such as information about health, ethnicity or beliefs. Please do not send information of that kind through the contact form.

This website sets no cookies of its own. It uses no analytics, no tracking pixels, no advertising, and no third-party embeds that profile you. Fonts are served from this site rather than from a third party. There is nothing here for you to consent to or opt out of.

If this ever changes, I will update this policy and put an appropriate consent mechanism in place before the change goes live.

Data protection law requires me to have a lawful basis for using your personal data. My bases are:

• Replying to your enquiry. Legitimate interests, namely responding to someone who has deliberately contacted me. Where your enquiry is about booking a service, this is also taking steps at your request before entering into a contract.
• Preventing spam and abuse, and keeping the site secure. Legitimate interests, namely protecting the site and my inbox from misuse. I have considered your interests here, and use the minimum data needed for the shortest time that works.
• Keeping records where an enquiry leads to paid work. Legal obligation, namely my tax and accounting record-keeping duties.

I do not use your data for marketing, and I will not add you to a mailing list.

I use a small number of service providers to run this site. They process data on my instructions and are not permitted to use it for their own purposes:

• Vercel — hosts this website, serves it to your browser, and keeps the server logs described above.
• Resend — delivers your contact form message to me by email.
• Upstash — stores the short-lived rate-limiting counters keyed to your IP address.
• My email provider — stores your message once it has been delivered to my inbox.

I do not sell your personal data, and I do not share it with anyone for their own marketing. I may disclose it where I am legally required to, for example in response to a valid legal request.

Some of the providers listed above are based in, or store data in, the United States or other countries outside the UK. Where personal data is transferred outside the UK, I rely on the safeguards each provider has put in place, which are generally the International Data Transfer Addendum to the EU standard contractual clauses, or an adequacy decision covering the country concerned. The details are set out in each provider's data processing terms, and I can point you to them on request.

This website is intended for adults. I do not knowingly collect personal data from anyone under 18 through it, and tuition enquiries should be made by a parent or guardian. If you believe a child has submitted information through the contact form, contact me and I will delete it.

Tuition itself is delivered using WhatsApp for video calls and messaging, and ChalkieChalkie.com for scheduling, the collaborative workspace and lesson feedback. Those services handle data under their own privacy policies, and this policy does not cover them.

If you go on to book tuition, I will agree with you, as the parent or guardian, what information I hold about the student and how it is used, before lessons begin. That includes whether I have direct contact with the student, which is always your choice. The relevant tuition terms are in section 6 of my terms of service.

• Contact form enquiries are kept for 12 months from our last correspondence, then deleted.
• Records relating to paid work are kept for as long as I need them for tax and accounting purposes, which is normally 6 years from the end of the tax year they relate to.
• Rate-limiting records expire automatically, after one hour for per-visitor counters and 24 hours for the site-wide counter. No action is needed to remove them.
• Server logs are kept by the hosting provider under their own retention periods, which are short.

Under UK data protection law you have the right to:

• be told how your data is used, as in this policy
• ask for a copy of the personal data I hold about you
• have inaccurate data corrected
• ask me to delete your data
• ask me to restrict how I use it
• object to my using it, including where I rely on legitimate interests
• ask me to transfer it to you or another provider in a portable format

To exercise any of these, email me at 070806harrison@gmail.com. I will respond within one month, and there is normally no charge. I may need to confirm your identity first, so that I do not disclose your data to someone else.

If you are unhappy with how I have handled your personal data, please tell me first so that I have the chance to put it right.

You also have the right to complain to the Information Commissioner's Office, the UK regulator for data protection. You can reach them at ico.org.uk, by telephone on 0303 123 1113, or by post at Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

This site is served over an encrypted HTTPS connection. Contact form submissions are validated and length-limited, rate limited per visitor and site-wide, checked for automated submission, and accepted only from this site's own pages. No payment details are ever collected through this website.

No system can be completely secure. Please do not send confidential or sensitive personal information through the contact form.

This site links to other websites. This policy applies only to this site, and I am not responsible for the privacy practices of any site you reach by following a link. Please read their own policies.

I may update this policy from time to time. The date at the top of this page shows when it was last revised. If I make a material change to how your data is used, I will make that clear here.