Privacy Policy

Who I am

This is the personal website of Duncan Hann. I decide what happens to any personal data the site collects, which makes me the data controller under UK data protection law (the UK GDPR and the Data Protection Act 2018). You can reach me at [email protected].

What I collect and why

When you send me a message

The contact form asks for your name, your email address, what you're getting in touch about and your message. I use them to read and reply to your message, and for nothing else. The lawful basis is my legitimate interest in answering people who contact me, which is also why you're writing.

If you email me directly, I get your email address and whatever you write, and use them the same way.

Spam protection

The contact page uses Google reCAPTCHA to keep spam out of the form. It looks at how the page is used (such as your IP address and browser details) to judge whether you're a person. The lawful basis is my legitimate interest in keeping the form usable. Google's use of this data is covered by the Google privacy policy (opens in a new tab).

Analytics, only if you accept

If you accept analytics cookies, Google Analytics, Microsoft Clarity and Mida record how the site is used: the pages you visit, where you click and scroll, the device and browser you use and roughly where you are (to the town or region, from your IP address). Clarity also records anonymised replays of visits, with form fields masked. I use this to see what works and to test changes. The lawful basis is your consent, which you can withdraw at any time from the cookie policy. If you don't accept, none of these cookies are set. The full list is on the cookie policy.

Live demos

A few project pages are live demos that call free public services straight from your browser. They send what the demo needs (a place, a query, made-up order events) and, like any website you visit, the service sees your IP address. None of it is personal data I collect or keep. The cookie policy lists each service.

Server logs

Like every web server, the one that hosts this site keeps short-lived logs of requests, including IP addresses, to keep it running and secure. I don't use them to identify anyone.

Who else sees it

I don't sell or share your data with anyone for marketing. These services handle it on my behalf:

• Formspree receives contact form messages and passes them to my inbox. It is based in the United States. Formspree's privacy policy (opens in a new tab).
• Google runs reCAPTCHA, Google Tag Manager and Google Analytics.
• Microsoft runs Clarity.
• Mida runs A/B tests.
• My email provider stores the messages I receive and send.
• My web host serves the site and keeps its server logs.

Some of these services store data outside the UK, mainly in the United States. Where they do, they rely on safeguards the UK recognises, such as the UK Extension to the EU-US Data Privacy Framework or standard contractual clauses.

How long I keep it

• Messages: as long as we're in touch about what you wrote, then I delete them within two years of the last reply.
• Analytics: Google Analytics keeps event data for up to 14 months. Clarity and Mida keep theirs for the periods in their own policies.
• Your cookie choice: in your own browser, until you clear it.

Your rights

You can ask me for a copy of the personal data I hold about you, and ask me to correct it, delete it, stop using it or limit how I use it. Where I rely on your consent, you can withdraw it at any time. Email [email protected] and I'll reply within a month.

If you're unhappy with how I've handled your data, please tell me first so I can put it right. You also have the right to complain to the Information Commissioner's Office (opens in a new tab), the UK's data protection regulator.

Changes to this policy

When the site starts collecting something new, I update this page and the date at the top.