Privacy
What we do with your details
The short version: we use what you send us to design your website and to reply to you. We do not sell it, share it for marketing, or add you to anything. If we contacted your business first, section 2 says where we found it and how to stop it. There are no tracking cookies on this site at all.
Last updated 7 October 2026. This is the whole notice, not a summary of a longer one kept somewhere else.
1. Who is responsible
Consult Optio, a trading name of Vishal Khanna, a sole trader, is the data controller for everything described here. That means we decide what is collected and why, and we are the ones answerable for it.
The address for service, and for anything you want in writing, is Daniels Farm, Wash Road, Basildon, SS14 5AZ. You can reach us at hello@consultoptio.co.uk or on 07487 808953. There is no data protection officer, because a business this size is not required to appoint one. Write to the same address and it reaches the person who makes the decisions.
2. What we collect, and when
When you ask for a free design
Four things, because the form asks four questions: your name, your email address, what you told us about your business, and which of the seven pictures you picked for the look of the site. That last one is a single word such as "clean" or "bold", and it is a design instruction rather than anything about you. That is the lot. We do not ask for a phone number, a company size, a budget or anything else, and the form has no hidden fields collecting things you cannot see.
When you email or call us
Whatever is in the message, plus your address or number so we can answer. Emails sit in a mailbox like anyone else's.
When you become a client
The things needed to build and run the site and to get paid: business details, the content you send us, domain registration details, and a billing record. Card numbers go straight to Stripe and never touch us or this website.
When we contact your business first
Sometimes we write to, email or ring a local business that has not been in touch with us, to offer it a website. For that we hold the business's name, its registered or trading address, what kind of business it is and when it was set up. Those come from public registers: Companies House, the Food Standards Agency's hygiene ratings and OpenStreetMap. Where Companies House names a director, we may hold that name so the message is addressed to a person rather than to "the owner". An email address, phone number or website address comes from the business's own website or its public listing.
We only email limited companies and limited liability partnerships out of the blue, never sole traders or partnerships. We check a phone number against the Telephone Preference Service before ringing it. Every message says who we are, where we found you and how to stop them, and one reply saying "no thanks" stops them for good.
When you simply read the site
Nothing that identifies you. Our host keeps short-lived server logs for security, which include IP addresses, in the same way every website on the internet does. We do not look at them unless something is being attacked, and we have no analytics account attached to this site.
3. Why we are allowed to hold it
UK GDPR requires a lawful basis for each use. Ours are:
- Steps before a contract. Designing the free homepage you asked for, and replying to you, is us taking steps at your request before a possible contract.
- Performing a contract. Once you are a client, building and hosting the site is the contract itself.
- Legal obligation. Invoices and tax records have to be kept whether either of us wants to or not.
- Legitimate interests. Keeping the site secure and defending ourselves if a dispute arises. We have weighed this against your privacy and consider it does not override it, because it involves no profiling and no marketing.
- Legitimate interests, when we contact a business first. Telling local businesses that we build websites is how a small firm like this one finds work. We have weighed that against your privacy: we use only details that are already public and are about the business, we get in touch a handful of times at most, and anyone can stop it with one reply. If you object, we stop. You do not have to give a reason.
We do not rely on consent for any of it, which is deliberate: consent is the basis that most often gets abused, and none of the above needs it.
4. How long we keep it
| What | How long, and why |
|---|---|
| A free design enquiry that goes nowhere | Deleted within 30 days of you saying no, or within 24 months if you never reply. Say the word at any point and it goes sooner. |
| Client records and invoices | 7 years after the last invoice. HMRC requires six full years plus the current one, so this is not a choice we get to make. |
| Details of a business we contacted first | Kept while there is a reason to think you might want a website from us. Tell us to stop and we stop for good, keeping only what is needed to make sure that business is never contacted again. |
| Email correspondence | Deleted with the rest of the record it belongs to. |
| Server logs | Days, not months, and handled by our host rather than kept by us. |
5. Who else sees it
Nobody buys it, because it is not for sale, and no advertising network is involved in any part of this site. The only organisations that touch your data are the ones needed to make the thing work:
| Who | What for |
|---|---|
| Cloudflare | Hosts the website and runs the spam check on the form. Their privacy policy. |
| Supabase | Stores what you send through the form, and our list of businesses we have contacted, in a database hosted in London. Their privacy policy. |
| Your email provider and ours | Carries the messages between us. |
| Stripe | Takes the payment, if you become a client. We never see your card number. Their privacy policy. |
Some of these operate outside the UK. Where that happens, transfers are covered by the UK's approved safeguards, which is the standard mechanism every business using mainstream internet services relies on.
We would also hand over data if a court or the police required it by law. We would tell you unless we were forbidden from doing so.
6. Cookies and tracking
This website sets no cookies. There is no analytics, no advertising pixel, no heatmap, no session recorder and no third-party font or script loading from someone else's server. That is why you were not shown a cookie banner: there is nothing to consent to.
If that ever changes, this page changes with it and you will be asked properly before anything non-essential is set. We would rather say that here, in writing, than quietly add a tracker later.
7. What you can make us do
Under UK GDPR you can ask us to:
- Show you everything we hold about you.
- Correct anything wrong.
- Delete it, unless we are legally required to keep it, which in practice only applies to invoices.
- Restrict or object to what we are doing with it.
- Hand it over in a portable format, to you or to somebody else.
Email hello@consultoptio.co.uk and say what you want. There is no form to fill in and no charge. We have a month to respond by law and would expect to do it the same week. We may ask you to confirm who you are first, which protects you rather than us.
8. If we get it wrong
Tell us first, because most things are a mistake and fixable in an afternoon. If you are not satisfied with how we handle it, you have the right to complain to the Information Commissioner's Office, which is the UK regulator for this. You can complain to the ICO or call them on 0303 123 1113. You do not have to come to us first, though it is usually quicker.
Changes to this notice
If it changes materially, the date at the top changes and anyone whose data we are actively holding gets told. We will not rewrite it quietly.