Privacy policy

Who I am

refitmy.com is a subscription website service for small local businesses, run by Franco Siorpaes from the United Kingdom. I build for clients anywhere in the world, and UK data protection law travels with me, so everyone described here gets the same protection regardless of where they live. I am the data controller for the personal data described in this notice.

• Email: franco@refitmy.co.uk
• Phone: +44 7507 639 757

This notice covers refitmy.com, its UK page at refitmy.com/uk, the service agreement page, and the websites I build and host for clients. My UK-facing site at refitmy.co.uk has its own notice, which says materially the same thing.

Cookies: one, if you ask for it

This site sets no tracking cookies and neither do the client websites I build. Nothing follows you around the internet, which is why you are not being interrupted by a consent banner.

There is exactly one cookie, and it only appears if you go looking for it. If you click "Not in the UK? View the global site" on the UK page, I store a small preference called rm_geo so the site stops sending you back. It holds one word, it is never sent anywhere, and it does nothing else. Clear your browser data and it is gone.

The site also reads your device's timezone when the page loads, to decide whether to show you the UK version or the international one. That reading happens entirely inside your browser, is not sent to me or to anyone else, and is not stored unless you set the preference above.

I do measure how many people visit, using Google Analytics configured in cookieless mode. It records the page you landed on, roughly which city or region you are in, and what kind of device you used. It cannot identify you, cannot recognize you on a return visit, and is never used for advertising.

If you would rather I did not count your visit at all, email me and I will exclude you, free of charge. You can also block analytics at browser level, which most privacy-focused browsers do by default.

When you visit this site

What is collected

• Pages viewed and how long you spent on them
• Approximate location, at city or region level, from a shortened IP address
• Device type, browser and screen size
• Which site or search sent you here

Why

To see which pages work and which do not, so I can improve them. The lawful basis is legitimate interests: running a small business website effectively, with a genuinely minimal impact on your privacy.

Fonts

This site loads its typefaces from Google Fonts, which means your IP address is briefly visible to Google when the page loads. No cookies are set by this. If you would prefer it did not happen, block third-party requests to fonts.googleapis.com in your browser.

When you sign up

If you complete the service agreement, I collect your email address and a record that you ticked the agreement box, along with the date and time. That record is my proof that the terms were accepted, and yours too.

• Your email address is delivered to my inbox through FormSubmit, a form-forwarding service
• Payment is set up through a payment provider, using a secure link I send you. Your card or bank details go directly to that provider and I never see or store them
• Lawful basis: performance of a contract, and legal obligation for the payment and accounting records

Once you are a client, I also hold the ordinary things needed to run the job: your business name, contact details, the content and photos you send me for your site, and billing records.

If I contacted you out of the blue

If you received an email or a call from me about building you a website, you did not give me your details. Here is exactly where they came from and what to do about it.

What I hold

• Business name, what you do, and the town or city you work in
• A business phone number and, where one was published, a business email address
• The owner's first name, where it was publicly listed
• Business address, opening hours, and public review counts and ratings
• Whether you currently have a website, and notes on its condition

Where it came from

• Google Maps and the Google Places API
• Your own business website, where you have one
• Public trade directories and business listings
• Public business pages on social media

All of it was already published, by you or on your behalf. I do not buy lists and I do not use data brokers.

Why I am allowed to

Legitimate interests: contacting a business, at its published business contact details, about a service directly relevant to what it does. I have weighed this against your interests, and I keep the intrusion low by contacting you once or twice and then stopping.

Client websites I build

Every site I build carries a simple click counter that tallies how many people tapped Call, Email or WhatsApp. It runs in cookieless mode, stores nothing on the visitor's device, and produces a running total only. It cannot tell my client, or me, who made any individual tap.

Client sites are hosted on GitHub Pages, which keeps standard server logs for security and abuse prevention. If a client site collects anything beyond this, that client's own privacy notice will say so.

Who else sees your data

I do not sell data and I do not share it for anyone else's marketing. I use these service providers to run the business:

Most of these process data outside the UK. Where they do, the transfer is covered by UK adequacy regulations or by the UK International Data Transfer Addendum. If you are outside the UK, your data will be handled in the UK and in whichever countries these providers operate from. I will also disclose data where the law requires it, for example to HMRC or in response to a court order.

How long I keep things

• Prospect records: deleted 24 months after the last contact, or within 30 days of you asking, whichever comes first
• Suppression list: kept indefinitely, because that is the only way to guarantee you are never contacted again
• Client records and agreements: kept for the life of the contract, then 6 years, for tax and legal reasons
• Analytics: retained by Google for 14 months, then deleted automatically

Your rights

Under UK GDPR you can ask me to do any of the following, free of charge. I will respond within one month. If you live somewhere with weaker data protection law, or none at all, you get these rights anyway: it is simpler for me to run one standard than several, and you should not get less protection for living somewhere else.

• See it: get a copy of everything I hold about you
• Fix it: correct anything wrong or out of date
• Delete it: have it erased
• Stop it: object to my use of legitimate interests, including all marketing. If you object to marketing, I must stop. No balancing test, no argument
• Pause it: restrict what I do with it while a dispute is sorted out
• Move it: receive it in a portable format

Email franco@refitmy.co.uk and say which one you want. You do not need to use any particular wording.

Complaints

If you are unhappy with how I have handled your data, tell me first and I will try to put it right. You also have the right to complain to the UK regulator at any time, because that is where I am based:

• Information Commissioner's Office, ico.org.uk/make-a-complaint
• Helpline: 0303 123 1113
• Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

Complaining to the ICO does not cost anything and does not affect your rights. If you are in the EU or the EEA you can complain to your own national data protection authority instead, and if you are elsewhere you can use whichever regulator covers you locally.

Changes to this notice

If I change how I handle data, I will update this page and change the date at the top. If the change is significant and affects existing clients, I will email you about it rather than quietly editing the page.