Privacy Policy

Last updated: [Date of publication]

This policy explains how Tarquin & Gunn collects, uses and protects personal information when you visit our website, contact us, work with us, or receive business emails from us. We have written it in plain English. If anything is unclear, please email us at hello@tarquinandgunn.co.uk.

1. Who we are

Tarquin & Gunn is run by Rebecca Hooijer, trading as Tarquin & Gunn, a sole trader (autónomo) registered in Spain, NIF: Z4312667B, business address Carrer del Talp 9, 08818 Olivella, Barcelona, Spain. We design and build websites for small businesses across the UK.

For the purposes of UK data protection law, Rebecca Hooijer is the controller of the personal information described in this policy.

• Email: hello@tarquinandgunn.co.uk
• Phone: +44 20 4577 1469
• Post: Carrer del Talp 9, 08818 Olivella, Barcelona, Spain
• Data protection fee registration number: [ICO number]
• NIF: Z4312667B

We are a small business and have not appointed a Data Protection Officer. Rebecca Hooijer is responsible for data protection and is your point of contact for any privacy question or request.

2. The laws that apply

We handle personal information in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR), each as amended, including by the Data (Use and Access) Act 2025.

3. The information we collect

When you use our contact form. Our enquiry form asks for your name, business name, email address and phone number and, if you choose to give them, your current website address, the package, logo design or maintenance plan you are interested in, your preferred day and time for a call, and your message. When you submit the form, your details are sent to us by email (to hello@tarquinandgunn.co.uk) through our email delivery provider, Resend. The form is protected by Cloudflare Turnstile, a spam check that helps us tell humans from bots.

When you email or call us. Your name, contact details, the content of your messages and any attachments you send, and notes of our conversations.

When you become a client. Your name, job title, business details, contact details, billing details (such as your invoicing address and payment records), project correspondence, and the content you give us for your website. While we build your website we may also have access to information held in your accounts (for example, your website platform or domain account). We handle that information only on your instructions, as explained in our Client Terms of Business.

Business contact information for outreach. We may contact businesses that we think could benefit from a new or improved website. For this we collect business contact information, such as the business name, the name and role of the owner or manager, a business email address, business phone number, business address, website address, and publicly available information about the business’s online presence (for example, how its current website looks or performs).

When you visit our website. Our website is hosted on Cloudflare Pages. When you visit, technical information such as your IP address, browser type, device information, the pages requested and the date and time of your visit is processed by Cloudflare to deliver the website securely and to protect it from abuse. We do not use this information to identify you personally.

We do not ask for, and ask you not to send us, special category information (such as health information) unless it is genuinely needed for your project.

4. Where we get your information

• From you, through our contact form, by email, by phone, or in meetings.
• From public sources, for business outreach: business websites, online business listings and maps (such as Google Business Profiles), trade and business directories, business social media pages, and the Companies House register.
• From people you work with, for example a colleague who introduces you to us as the contact for a project.

If we collect your business contact details from a public source, we will tell you where we got them in our first message to you, and include a link to this policy.

5. How we use your information and our lawful bases

UK data protection law requires us to have a lawful basis for each way we use personal information. The table below sets out what we do and why.

Where we rely on legitimate interests, we have balanced our interests against your rights and freedoms. Outreach is limited to business contact details, is relevant to your business, and you can opt out at any time. You have the right to object to processing based on legitimate interests (see section 10).

We do not sell your personal information. We do not make decisions about you using solely automated processing, and we do not use your information for profiling.

6. Business outreach and marketing

We follow PECR when we contact businesses by email or phone.

• Limited companies, LLPs and other corporate bodies. We may send emails about our services to business email addresses without prior consent. Every email will say who we are and include a simple way to opt out.
• Sole traders and partnerships. PECR treats sole traders and most partnerships in the same way as individuals. We will only send them marketing emails if they have agreed to receive them, or if they are an existing client or have asked us about our services and we are writing about similar services. They can opt out at any time.
• Phone calls. We do not make marketing calls to numbers registered with the Telephone Preference Service (TPS) or the Corporate Telephone Preference Service (CTPS), unless you have told us you are happy to receive our calls.

Opting out. You can ask us to stop contacting you at any time by replying to any of our emails, or by emailing hello@tarquinandgunn.co.uk. We will stop promptly. We keep a minimal record (your name, business name and email address or phone number) on a do-not-contact list, so that we do not contact you again by mistake.

7. Who we share your information with

We share personal information only where we need to, with:

• Cloudflare (Cloudflare, Inc.), which hosts our website and provides security and content delivery, including Turnstile spam protection on our contact form.
• Resend (Resend, Inc.), which delivers emails from our contact form to hello@tarquinandgunn.co.uk.
• Google (Google Workspace), which provides our business email, calendar and document storage.
• Our accountant, bookkeeping and banking providers, for invoicing, payments and keeping accounts.
• Professional advisers, such as lawyers and insurers, where needed.
• Authorities, such as tax authorities (for example the Spanish Agencia Tributaria or HMRC), law enforcement or regulators, where the law requires it.
• A buyer or successor business, if all or part of our business is sold or reorganised, under equivalent protections.

Our service providers act on our instructions, under written terms that require them to keep your information secure and use it only to provide their services to us.

8. International transfers

Some of our providers (including Cloudflare, Resend and Google) are based in, or use servers in, the USA or other countries outside the UK. Where personal information is transferred outside the UK, we make sure it is protected by one of the safeguards allowed under UK data protection law, such as:

• UK adequacy regulations, including the UK Extension to the EU-US Data Privacy Framework where the recipient is certified under it; or
• the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses issued under UK law.

You can contact us for more information about the safeguards we use.

9. How long we keep your information

We keep personal information only for as long as we need it.

When information is no longer needed, we delete it securely or anonymise it.

10. Your rights

Under UK data protection law you have the right to:

• Access the personal information we hold about you and receive a copy.
• Rectification: ask us to correct information that is inaccurate or incomplete.
• Erasure: ask us to delete your information in certain circumstances.
• Restriction: ask us to limit how we use your information in certain circumstances.
• Object to our use of your information where we rely on legitimate interests. You have an absolute right to object to direct marketing; if you do, we will stop.
• Data portability: ask us to transfer information you gave us to you or to another organisation, where processing is based on consent or contract and carried out by automated means.
• Withdraw consent at any time, where we rely on consent. This does not affect anything we did before you withdrew it.

To use any of these rights, email hello@tarquinandgunn.co.uk. There is normally no charge. We may need to confirm your identity first. We will reply within one month, which can be extended by up to two further months for complex requests; if so, we will tell you why.

11. Complaints

If you are unhappy with how we have handled your personal information, please tell us first by emailing hello@tarquinandgunn.co.uk with the subject line “Data protection complaint”, or by writing to us at Carrer del Talp 9, 08818 Olivella, Barcelona, Spain. We will acknowledge your complaint within 30 days, look into it properly, keep you updated, and tell you the outcome without undue delay.

If you are not satisfied with our response, you can complain to the UK data protection regulator, the Information Commission (formerly the Information Commissioner’s Office):

• Website: ico.org.uk
• Helpline: 0303 123 1113

12. Cookies

Our website does not use advertising or tracking cookies. Our hosting and security provider, Cloudflare, may set or read cookies or similar technologies that are strictly necessary to deliver the website securely and to protect it from abuse. Strictly necessary cookies do not need your consent.

If we introduce any other cookies or similar technologies, such as website analytics, we will update this policy and, where the law requires it, ask for your consent first or give you a clear way to opt out.

13. How we keep your information secure

We use appropriate technical and organisational measures to protect your information, including encrypted connections (HTTPS) on our website, two-step verification on our business accounts, access limited to the people who need it, and reputable service providers. Where we need access to your accounts during a project, we ask for our own user access rather than your password wherever the platform allows, and we remove or hand back that access when the project ends.

14. Children

Our website and services are intended for businesses and are not directed at children. We do not knowingly collect personal information from anyone under 18.

15. Links to other websites

Our website may link to other websites, including websites we have built for clients. We are not responsible for how those websites handle personal information. Please read their own privacy policies.

16. Changes to this policy

We may update this policy from time to time. The latest version will always be on this page, with the date it was last updated at the top. If we make significant changes, we will take reasonable steps to let our clients know.