This policy explains what personal data London Web Nerd collects through londonwebnerd.com, why, what happens to it, and the rights you have over it. It’s written in plain English, because that’s how everything else here works too.
Who I am
London Web Nerd is run by Andrew Gomes, a sole trader based in London, United Kingdom. For the purposes of UK data protection law (the UK GDPR and the Data Protection Act 2018), I’m the controller of the personal data described here.
Contact for anything privacy-related: [email protected]
What I collect and why
1. When you use the contact form or email me
The contact form asks for:
- your name
- your business name
- your project name or website URL (optional)
- your email address
- your message
If you email me directly, I’ll also receive whatever you include in that email.
Why: to read your enquiry, reply to it, and (if we go ahead) to prepare a quote and start the project. Lawful basis: steps taken at your request before entering into a contract, and my legitimate interest in responding to business enquiries.
Please don’t send passwords, login details, or other sensitive information through the form. If I need access to something, I’ll arrange a secure way to share it.
2. Spam protection on the form
The form is protected by Cloudflare Turnstile . It checks technical signals from your browser (such as your IP address and browser characteristics) to decide whether you’re a person or a bot, without puzzles or tracking cookies. Lawful basis: legitimate interest in keeping the form and inbox free of spam and abuse.
3. Website analytics (only if you agree)
If you accept analytics cookies, I use Google Analytics 4 (via Google Site Kit) to understand how the site is used. This covers things like which pages are visited, roughly where visitors come from, the device and browser used, and whether the contact form was submitted. Google Analytics 4 doesn’t log or store full IP addresses. Lawful basis: your consent, given through the cookie banner. You can withdraw it at any time.
The site uses Google Consent Mode. If you decline analytics, Google Analytics sets no cookies. Google may still receive limited, cookieless signals (for example, that a page loaded and that consent was declined), which it uses in aggregate modelling. These signals don’t identify you.
4. Security, delivery and server logs
Like every website, londonwebnerd.com necessarily processes your IP address and basic request data (browser type, pages requested, time of request) to deliver pages and keep the site secure. This happens through my hosting provider and through Cloudflare’s network, which includes the __cf_bm bot-management cookie. Some code libraries and fonts that power the site’s design and animations are loaded from public content delivery networks. Those providers also receive your IP address when your browser requests the files. Lawful basis: legitimate interest in running a fast, secure, and available website.
5. Clients
If you become a client, I’ll process the contact, billing, and project information needed to deliver, invoice, and support the work. The details are set out in your proposal or agreement. Lawful basis: performance of a contract and legal obligations (for example, keeping financial records).
What I don’t do: I don’t sell your data, I don’t use it for advertising or personalised ads, I don’t add you to a mailing list without asking, and I don’t make automated decisions about you.
Who I share it with
Only the service providers needed to run the site and the business, acting on my instructions:
- Amazon Web Services (AWS) : hosts the website and its server logs
- Cloudflare, Inc. : content delivery, security, and the Turnstile spam check
- Google LLC / Google Ireland : Google Analytics (only with your consent)
- CookieYes Limited : records your cookie choices so the site can respect them
- Google Workspace (Google LLC / Google Ireland) : receives and stores contact form submissions and emails
- Public code CDNs (cdnjs, unpkg, StackPath/BootstrapCDN, CodePen): serve scripts and styles used by the site
- Trusted freelance collaborators, only where needed for your project and with your knowledge
- Professional advisers (e.g. an accountant) or authorities where the law requires it
International transfers
Some of these providers (including Google, Amazon Web Services and Cloudflare) may process data outside the UK, mainly in the United States. Where they do, the transfer is covered by UK adequacy regulations (such as the UK Extension to the EU–US Data Privacy Framework) or by the ICO’s International Data Transfer Agreement / Addendum to the EU Standard Contractual Clauses.
How long I keep it
- Enquiries that don’t become projects: up to 24 months, then deleted
- Client records and invoices: 6 years after the end of the tax year they relate to, as required by HMRC
- Google Analytics data: 14 months, then automatically deleted
- Cookie consent record: 1 year
- Server and security logs: typically 30 days
Your rights
Under UK data protection law, you can ask to:
- access a copy of your personal data
- correct anything wrong
- have your data deleted
- restrict or object to how I use it (including anything based on legitimate interests)
- receive your data in a portable format
- withdraw consent at any time. For analytics, use the “Cookie settings” link at the bottom of any page.
Email [email protected] and I’ll reply within one month. It’s free.
If you’re unhappy with how I’ve handled your data, please talk to me first. You also have the right to complain to the Information Commissioner’s Office: ico.org.uk/make-a-complaint , 0303 123 1113.
Security
The site is served over HTTPS, kept up to date, and hosted on infrastructure. I configure and monitor it myself. I limit access to enquiries and client data to me and collaborators when a project requires it.
Cookies
For the full list of cookies and how to control them, see the Cookie Policy .
Changes to this policy
If what the site collects changes, this page will be updated and the date at the top will change.