Last updated:
The short version
- I'm Luke Duff. I use your details to reply to you and to do the work you ask me to do.
- The contact form never adds you to a mailing list, and I don't run one.
- Google Analytics only runs if you tap Accept on the cookie banner.
- I never sell your details.
- To see, fix or delete what I hold about you, email hello@lukeduff.co.uk.
- Did I contact your business first? See Businesses I contact.
Who I am
The law says I must tell you who I am, what I collect, why, who gets it, how long I keep it and what your rights are. This page does that.
I'm Luke Duff, a web designer. I work as a sole trader. My trading address is Luke Duff, 135 Atkinson Road, Sunderland SR6 9AX.
In data protection law I'm the “controller”. That means I decide how your details are used, and I'm responsible for looking after them.
- Email: hello@lukeduff.co.uk
- Phone or WhatsApp: +44 7935 996850
What I collect, and why
The law says I need a reason, called a “lawful basis”, for each thing I do with your details. Here they are.
| How you reach me | What I get | What I use it for | Lawful basis |
|---|---|---|---|
| Contact form | Your name, your email or mobile number (one is enough, both if you like), your message, and how you found me (only if you say) | To reply, and to quote if you ask me to | Steps you've asked for before a contract. Or, if it isn't about work, my legitimate interest in replying to messages people send me |
| Free website check form | Your web address and email, plus your name, mobile and what's bugging you about the site (only if you add them) | To check your site, send you the written report, and follow up once | Same as the contact form |
| WhatsApp message or call | Your number, your WhatsApp name and what you send me | To reply and help with what you've asked | Same as the contact form |
| Phone call, text or voicemail | Your number, and what you tell me or leave in a message | To reply and help with what you've asked | Same as the contact form |
| Your email address, your name and what you write | To reply and help with what you've asked | Same as the contact form | |
| The AI chat on this site (only if you open it) | What you type in the chat. After your first question, the chat asks for your name and email to keep going: I get an email with them, your first question, the chat's answer and the page you were on. If you ask it to pass your details to me, I get another email with the chat's short summary of what you need and the questions you typed. Each question is also kept for 30 days, with the page you were on and whether the chat could answer it, and with email addresses and phone numbers taken out (anything else you type, like a name, stays in it), and I get a weekly list of them | To answer your questions, so I know who asked and can reply, and to send me your enquiry when you ask it to. The weekly list shows me what people ask, so I can improve the answers and the site | Same as the contact form. For the weekly list: my legitimate interest in seeing what people ask, so I can improve the site |
| The Speed lab's "Test your own site" (only if you use it) | The web address you type. It goes to Google's PageSpeed Insights, which loads that page to test it. The address and the result are kept for 24 hours, so a repeat test can reuse them, and each fresh test adds one to a count of tests per month. Nothing else about you | To run the test you asked for and show you the result, and to keep the free tests within a monthly limit | Steps you've asked for (you asked for the test). For the monthly count: my legitimate interest in keeping the free tests within a limit |
| Booking a call (Calendly), embedded on my Book a call page and loaded only after you click | Your name, email, the time you pick and your answers to the booking questions (business name, website, what you want to sort out) | To hold the call and come prepared | Steps you've asked for before a contract |
| Video calls (Google Meet) | Your name and email on the invite | To hold the call | Steps you've asked for before a contract. I sometimes record a call, but only with your permission. If you say no, I don't record it. A recording is deleted once I've written my notes, within 30 days |
| Working together | Contact details, quotes, invoices, payment records, and the words and photos you send for your site. I don't keep your passwords: I ask you to add me as a user with my own login instead | To do the work, bill for it and look after your site | The agreement between you and me. Keeping tax records is a legal duty |
| Asking for a review | Your name and contact details | After a project, I ask every client for a review the same way. I offer nothing for it | My legitimate interest in getting honest feedback |
| Visiting this website (only if you tap Accept) | Pages you view, device and browser type, rough location, which buttons you tap (WhatsApp, phone, email, booking, form sent), and whether you open the AI chat, give it your details or ask it to pass on an enquiry | To count visits and see which pages work, so I can improve the site | Your consent. Take it back any time with the "Cookie settings" link in the footer |
| Keeping the site working | Technical details like your IP address, which my host Vercel keeps in its server logs and uses to limit how many form messages one connection can send in a few minutes. This site also counts, in memory only, how many speed tests one connection runs in a day. The forms also have a hidden spam check and note how long they took to fill in | To stop spam and attacks | My legitimate interest in keeping the site working and safe |
If you work for a business that hires me, I use your work contact details because I have a legitimate interest in running that project with you.
I never send Google Analytics your name, number, email or the words of your message. Google says Google Analytics does not log or store IP addresses.
Taps on the WhatsApp, phone and email buttons, opening the AI chat, giving it your name and email, and asking it to pass on your details are also counted without cookies: which one, the page it's on, where it sits on the page and the hour. The count keeps no IP address and nothing about your device, so it can't tell who tapped. My cookie policy explains it, and you can turn it off in Cookie settings.
Businesses I contact
I'm Luke Duff, a web designer in Sunderland, trading as lukeduff.co.uk. I email, message or call North East businesses to ask if they'd like a quick call about their website. This is what I do with your details when that happens.
Where I got your details
From places a business puts itself in public: its Google listing, its own website and Companies House. My own software looks these up; I don't buy contact lists.
What I keep and why
Your business name, where you trade, how to reach you, and a few things I noticed about your website. I use it to decide who might want a call and to write to you. I keep the notes in my own system. Software that helps me draft messages gets a stripped copy of the notes and never gets your contact details.
My legal reason
Legitimate interests: I want to find new clients for my business, and a short message to a business is a reasonable way to do it. I've written down why I think that's fair to you, and that it doesn't override your rights.
Not interested? Just say
Reply “no thanks” and I won't contact you again. So I remember, I keep your business name and the email address or phone number you asked me to stop using on a do-not-contact list.
You can also ask what I hold on you, ask me to correct or delete it, or object to me using it. Email hello@lukeduff.co.uk. I'll answer within one month.
How long I keep it
If you never become a client, I delete your details 12 months after I last contacted you. If you do become a client, the privacy policy covers how long I keep your records.
Complaints
If you're unhappy with how I've handled your details, tell me first and I'll try to put it right. You can also complain to the Information Commissioner's Office (ICO): ico.org.uk or 0303 123 1113.
No mailing list
The contact form never signs you up to anything. I only use what you send to reply and to do the work.
Who else handles your details
I use a few services to run my business. Some act on my instructions (they're called “processors”). Others, like WhatsApp, are services you choose to use yourself, under their own privacy policies.
| Service | What it does for me | Notes |
|---|---|---|
| Google Analytics (Google) | Counts visits, only after you tap Accept | Google says it acts as a processor for Google Analytics |
| DreamHost email hosting for hello@lukeduff.co.uk | Receives and stores emails you send me | |
| Google (Gmail, calendar and Meet) | The emails the AI chat sends me (your name and email, your questions and what you need), my calendar and video calls | |
| Google PageSpeed Insights (Google) | Tests the web address you type in my Speed lab's "Test your own site": Google loads that page and measures how fast it is | Only the address goes to Google, from my website, not from your browser. Nothing else about you is sent |
| Google Maps Platform (Places API) | Shows my live Google rating and review count on my pages | My website asks Google for the rating and review count, so nothing about you goes to Google. Google's Privacy Policy applies to its service: https://policies.google.com/privacy |
| Calendly | Booking calls. It's embedded on my Book a call page and only loads after you click to open it | Calendly's own privacy notice applies on its pages |
| WhatsApp (WhatsApp LLC, part of Meta) | Messages and calls | WhatsApp says that for people in the UK, WhatsApp LLC provides the service. It also says messages and calls are end-to-end encrypted, so even WhatsApp can't read or hear them |
| Vercel | Hosts this website, and keeps the questions typed into the AI chat for 30 days, for my weekly list | My website is hosted by Vercel Inc. in the United States, which may process data in other countries too. Vercel is certified under the UK Extension to the EU-U.S. Data Privacy Framework, which covers personal data sent from the UK. My agreement with Vercel also includes standard contractual clauses and the UK international data transfer addendum as a back-up safeguard. |
| Resend (Plus Five Five, Inc., United States) | Sends me the messages from my contact form and free website check form, and the names, emails and enquiries the AI chat passes on, and sends you the automatic reply from the forms | Resend is certified under the UK Extension to the EU-U.S. Data Privacy Framework (on the official list when I checked on 8 October 2026). Its data processing agreement also includes standard contractual clauses. |
| Anthropic (Anthropic Ireland, Limited), and its AI model Claude Haiku 5.5 | Writes the AI chat's answers. What you type in the chat, and the first name you give in its form, go to Anthropic's AI, which writes the reply | Anthropic deletes what you type within 30 days, unless it has to keep it longer, for example if it's flagged for breaking Anthropic's usage rules. By default, Anthropic doesn't use it to train its AI. Its data processing addendum includes the UK's international data transfer addendum for anything sent outside the UK. This site doesn't store the conversation: it lasts only while it's open in your browser. Only the questions are kept, for my weekly list (see How long I keep things) |
| My bank | Receives your payments by bank transfer. I do my own books, with no accountant or accounting software |
I never sell your details or pass them on for anyone's marketing.
Details that go outside the UK
Some of these services are run by US companies. UK law lets details go to US companies that are certified under the “UK Extension to the EU-US Data Privacy Framework”. This is often called the UK-US data bridge, and it came into effect on 12 October 2023.
- Google says it's certified under the UK Extension.
- Calendly says it's certified under the UK Extension, and also uses standard contract clauses and the UK Addendum.
- Vercel's, Resend's and Anthropic's safeguards are in the table above.
When I'm working away from the UK
I sometimes work from outside the UK. When I do, I open your details on my own devices, through the same accounts. Only I see client details.
The ICO says a “restricted transfer” is when details go to a separate organisation outside the UK. I'm the same person wherever I am, so this isn't one. UK data protection law still covers everything I do with your details.
How long I keep things
| What | How long |
|---|---|
| Enquiries from people who don't become clients (form, email, WhatsApp, calls) | 12 months |
| Calendly bookings from people who don't become clients | 12 months |
| AI chat conversations | This site keeps the questions you type for 30 days, with email addresses and phone numbers taken out and nothing from the chat's form, for my weekly list of what people ask, then deletes them. The rest of the conversation isn't kept by this site: your own browser keeps it until you close the tab, so a reload doesn't lose it. Anthropic, which writes the answers, deletes them within 30 days, unless it has to keep them longer (for example if they're flagged for breaking its usage rules). The emails the chat sends me (your name, email and questions) are kept like any enquiry: 12 months if you don't become a client |
| Speed lab tests (the address you typed and its result) | 24 hours, then deleted within the hour (a clean-up runs every hour). The count of tests per month has nothing about you in it |
| Call recordings (only with your permission) | Until I've written my notes, within 30 days |
| Records of people who become clients: project records, quotes and invoices | 6 years. HMRC says sole traders must keep business records for at least 5 years after the 31 January tax return deadline for that year |
| Google Analytics data (only if you tapped Accept) | 14 months, the setting I chose in Google Analytics |
My Google Analytics isn't linked to Google Ads.
How I keep your details safe
- 2-step login on my email, WhatsApp, Calendly and Google accounts.
- My phone and laptop are locked with a passcode and encrypted.
- I only keep what I need, and delete it when the time above runs out.
Your rights
You have rights over your details. You can ask me to:
- give you a copy of what I hold about you
- fix anything that's wrong
- delete your details
- stop or limit how I use them
- give your details to you, or to someone else, in a form a computer can read
- stop using them where I rely on legitimate interests (you can object)
If you said yes to analytics, you can take that back any time. Some rights only apply in some cases.
To ask, email hello@lukeduff.co.uk. It's normally free. I'll reply within one month. If a request is complex, the law allows up to two more months, and I'll tell you within the first month if I need them.
Making a complaint
If you're unhappy with how I've handled your details, tell me first:
- Email hello@lukeduff.co.uk.
- I'll confirm I've got it within 30 days.
- I'll look into it, keep you posted and tell you what I find.
Since 19 June 2026 the law has asked every organisation to do this.
You can also complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, at ico.org.uk/make-a-complaint. The ICO will usually ask you to raise it with me first.
Cookies
This site only uses Google Analytics if you tap Accept. My cookie policy lists every cookie and how long it lasts.
Changes to this policy
If anything changes, I'll update this page and the date at the top.