Privacy

This is the whole privacy notice. It covers what I collect, where it goes, how long I keep it, and how to make me stop.

If I contacted you and you never gave me your details, the section you want is businesses I approach first. It says where I got your details, what I hold, and how to stop it.

Who I am

I trade as Sparx Innovations: Ben Dunwiley, 7 Church Street, Darfield, Barnsley, S73 9LG. I’m the data controller for everything on this page. That means I’m the one answerable for it. I’m registered with the Information Commissioner’s Office, number ZC233372.

Got a question, a request, or want me to stop? Email [email protected], or write to the address at the bottom of every page. No form to fill in, and no reason needed.

What I collect on this website

The enquiry form asks for your name and how you’d like me to reply. Then an email address or phone number, and whatever you type in the message box.

One thing is saved that you don’t type. If you came here from one of the free tools, or scanned a code at an event I was at, a short label for that gets saved with your enquiry — the name of the tool, or of the event.

It tells me where an enquiry came from, so I know which of the things I do is worth doing again. It says nothing about you, and nothing about what you did on the site. That’s it. No account.

I never add anything you send through this website to a marketing list, and I never sell it. The two free tools don’t ask for an email address at all, so you can use them without telling me who you are.

Where it goes

I store your enquiry in my database, hosted by Supabase. Telegram, a messaging app on my phone, gets an alert that an enquiry has arrived — but not what it says, and not who sent it. I go and read it in the database. I don’t sell your enquiry, and I don’t pass it to anyone else to market to you.

These are the services that hold or handle data for me:

• Supabase — databases and file storage. The prospect records are in its London region.
• Oracle Cloud — the servers this website runs on. Your enquiry passes through here first.
• Telegram — the alert to my phone that something has arrived. Since 9 September 2026 that alert carries no personal data: no name, no contact details, none of your message. Telegram is the one service here I could not find a lawful transfer route for, so I stopped giving it anything to transfer.
• GitHub — the private repository holding my code and paperwork. Prospect records are no longer kept there. See the note below.
• Google — Workspace runs my email. If I write to you, or you reply, Google handles that message.
• Anthropic — artificial intelligence, used to help me draft and analyse.
• Meta Platforms — only where I manage a client’s social accounts.
• A telephone screening service — if I phone a business, I first check its number against the Telephone Preference Service registers. The service gets the number to check. I’ll name it here, with where it keeps data and why that’s lawful, before I first use it.

Plus my professional advisers, and the authorities where the law requires it.

Sending data outside the UK

Several of those services sit outside the UK, mostly in the United States. The law says I have to tell you what makes that lawful, so here it is, service by service.

Supabase, Anthropic, Google, Oracle Cloud, GitHub and Meta all sign the same standard contract terms. They are called the Standard Contractual Clauses, with a UK Addendum written by the Information Commissioner’s Office. It is the off-the-shelf contract the regulator recognises for sending data abroad, and it is the route I rely on for every one of them.

Some of them also hold a certificate called the UK Extension to the EU–US Data Privacy Framework. I am not relying on it — a certificate can lapse on a date I don’t control, and a contract doesn’t. Google’s, for instance, runs out in September 2026.

Where the data physically sits:

• Your enquiry, and any prospect record, is in London — that is what Supabase’s London region means. But Supabase is a Singapore company and its own suppliers are American, so the contract still does real work. Being in London is not on its own the answer.
• Anthropic stores in the United States. There is no UK or European option.
• Oracle Cloud runs this website from its London region.

Telegram is the exception, and it is why the alert changed. I could not find any terms covering data sent from someone like me in the UK to Telegram. The standard clauses it publishes are between Telegram and its own group companies, not between Telegram and me. Rather than claim a route I could not confirm, I stopped sending it anything worth protecting: since 9 September 2026 the alert says an enquiry has arrived and nothing more.

If you want the underlying paperwork for any of these, email me and I’ll send you what I hold.

When I hold data for a client

A lot of the personal data on my systems belongs to my clients’ customers — website enquiries, campaign entrants, prize-draw winners. For that data the client is the controller and I’m their processor, under a written agreement.

Their privacy notice governs what happens to it, not this one. I forward any request about it to them. This page covers the data where I decide what happens — my own client, prospect and business records.

If you answer a research question I ask in public

Sometimes I ask sole traders and small businesses, in local groups or on my own profile, how they run things — what they use for bookings or missed calls. I keep notes on what people say, without names, to decide what is worth building. I do not keep a list of who answered, and I will not send you marketing because you answered.

If we message privately, I delete the thread once I have taken the note. If you ask me for help, I keep your message and its date as an enquiry, and the rules above for enquiries apply. If you tell me to stop, I keep that instruction permanently so that I do.

My basis for this is legitimate interests, and the assessment is available on request. I draft with an AI tool (Anthropic’s Claude, in the United States), so the text of a reply may pass through it — the position on that transfer is the one set out under “Where it goes” above. If you would rather your answer was not used, tell me and it won’t be.

Businesses I approach first

Sometimes I approach a business that hasn’t contacted me first, to introduce what I do. That might be an email, a message through your enquiry form, or, in future, a phone call. If that’s how you found this page, this section is for you. The law makes me tell you the following, because you never gave me your details — I found them.

• Where I got it. Your organisation’s own website or its public listings. I also use the Companies House register, the Internet Archive, Google and Brave search results, and Adzuna job ads. All are publicly available. I never guess an address, work one out from a pattern, or buy a list.
• If I phone, which number. Only the one the business publishes for customers to ring, on its own website, listing or signage. That can be a mobile. Never a number from anywhere else.
• What I hold. Your organisation’s name and published contact details. Notes on the public state of its website and listings, including older versions of the site. From the Companies House register: filing history, company status and the number of employees. Job ads it has run. And my own written assessment of the business — whether it looks like one I could help, a note on its size, and a judgement about budget. Nothing about your private life, and nothing sensitive.
• If I phone, what I add. The number, when I checked it against the Telephone Preference Service registers, and what that showed. For each call, I note when, whether we spoke or I left a voicemail, and what was said. I note your name only if you give it, and I never record or transcribe a call.
• What I never use. Anything from this website — not the enquiry form, not the free tools.
• Who I email. Only organisations — companies, limited liability partnerships (LLPs) and public bodies. Never sole traders unless they’ve asked me to, and never a private individual.
• If I phone, who. Organisations, and sole traders too. Emailing a sole trader needs their permission first. Phoning needs the number to be off the preference registers.
• Who I’d never phone. A number listed on either Telephone Preference Service register when I check it, in the 28 days before a call. Anyone who has told me to stop, by any route. Anyone who has sent me an enquiry through this website or answered one of my research questions.
• Which address. If I email, only one the business published itself as a way to contact it. That may be a general address like info@. Or a named person’s work address, if that’s what the business puts up. If I use the business’s own enquiry form, I use no address at all.
• When it’s about you personally. If an address or a number reaches you personally, it’s your personal data. That includes a general address at a one-person business, and your name if you give it on a call. Everything on this page then applies to you.
• Why this is allowed. My legitimate interest in telling other businesses what I do. I wrote that assessment down and dated it before sending anything, and before any call. You can ask me for a copy.
• What every email or form message does. Says who it’s from, says plainly that it’s an approach you didn’t ask for, and carries a way to stop.
• If I phone, what the call does. It shows my number. I start with my full name and my business’s name. I’ll give you my address if you ask.
• If I phone, what I tell you. Where this page is. That you can tell me to stop, at any point.
• If I phone, how often. At most twice, on different days, on weekdays between 9am and 5:30pm. I may leave a voicemail each time. Then I leave you alone, unless you ring me back.
• How long I keep your details. Deleted 12 months after our last contact, or after I found your details if I never reached you. A call with no answer and no voicemail isn’t contact. The do-not-contact list is the one exception.

One thing I should be straight about. Prospect records now live in the database, where I can actually delete them. Until recently they were files in my private code repository, where deleting something leaves it in the history. I removed them from that history on 8 September 2026, including the copy held at GitHub. GitHub may keep unreferenced copies in its own storage for a while after that, and I’ve asked them to clear those. If any of this affects you, email me and I’ll tell you exactly where you stand.

To stop it, or to be sure I never add you, email [email protected], or tell me if I phone. One line is enough. No reason needed, nothing to pay, and no reply required from you. It stops every route — email, phone, and turning up — not just the one that reached you.

If you reviewed a business and I quoted you

When I research a business I record what its public reviews say — the reviewer’s display name, the rating and the date. A dated complaint about a business being hard to reach is evidence about how it runs.

If that’s you, you are not a prospect. I’m not contacting you, and I hold nothing about you beyond what you published on that listing. I use your review only to assess the business you reviewed.

Why the name. It’s what lets me check a quote back against the listing it came from. That way I’m not relying on evidence I can’t show. Display name only — no link to your profile, no other reviews of yours, no history.

How long. Not as long as I keep the file on the business. Your name comes out as soon as I’m finished with that business — whether I approached them, ruled them out, or took them on. By then the date and the words carry the evidence without you.

If none of those happens, it goes with the whole record 12 months after my last contact, and never later. If you’d rather I didn’t hold it at all, say so. It goes the same day, whatever stage I’m at.

Why I’m allowed to use your data

For enquiries, the basis is that you asked me to get in touch, and my legitimate interest in answering you.

For the label that says where an enquiry came from, the basis is my legitimate interest in knowing which of the things I do actually brings people in. Set against that is your interest in not being followed around. That is why the label is one word about a page or an event, and never anything about you.

For businesses I approach first, the basis is my legitimate interest in telling other businesses what I do. That is set against your interest in not being bothered. The rest of this page is what holds it in check.

For client records I also have a legal obligation to keep billing paperwork for tax. And I don’t sell data, or use it for anyone else’s advertising. I don’t make automated decisions about you that have a legal effect.

Cookies

This site doesn’t use advertising or tracking cookies.

How long I keep data

I keep enquiries while we’re talking, and delete them when I no longer need them. At most 12 months after our last contact. I hold business addresses I’ve emailed, and will hold any number I phone, on the same 12-month rule.

Campaign data I process for a client runs to that client’s terms. Typically 12 months after the campaign closes.

Two exceptions, both deliberate. If you become a client, I keep invoices and billing records for six years, because tax law says so. And I keep the do-not-contact list for good, because deleting it is how I’d contact you again by mistake.

Your rights

Stopping marketing is absolute. It is not the same as an unsubscribe line at the bottom of an email. Tell me to stop using your details for marketing and I stop, permanently. Any route, any words, no reason needed.

That covers every way I could contact you, not just the one that reached you. Your address or number goes on a do-not-contact list and stays there. If you tell me to stop on behalf of the business, I take that as the organisation speaking and it covers every address and number the business uses.

Your other rights:

• Get a copy of what I hold about you.
• Correct anything that’s wrong.
• Have it deleted.
• Limit what I do with it, instead of deleting it.
• Object to what I’m doing on other grounds.
• Get a portable copy, to take elsewhere.

Email [email protected] and I’ll answer within one month, free of charge.

There are limits on what I can delete, and I should be straight about them. Sometimes the law makes me keep something — billing records for tax, or your entry on the do-not-contact list. I’ll keep that, tell you why, and delete the rest. The note above about older prospect records is the other limit.

If you think I’ve got this wrong, complain to me first and I’ll answer. That’s a right of its own, under section 164A of the Data Protection Act 2018.

You can also complain to the Information Commissioner’s Office at any time — ico.org.uk or 0303 123 1113. You don’t have to come to me first.

Changes

If anything on this page changes in a way that matters, I’ll post it here with a new date. Last updated: 1 October 2026.