Privacy

Privacy notice

This notice explains how personal information provided through borrington.com is handled under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. It is written in plain English rather than legal shorthand.

Who is responsible

Mark Borrington, based in Derbyshire, United Kingdom, is the data controller for this website. For any privacy question, please use the contact form on the home page and select "Other" as the reason for enquiry.

What information is collected

• Enquiries you send. When you use the contact form, the site collects your name, email address, optional organisation, chosen reason, and the content of your message.
• Technical information. The web server produces standard access logs (IP address, timestamp, requested page, browser). These are used to keep the site running and to investigate security incidents.
• Spam protection. The contact form uses Cloudflare Turnstile. When the spam check loads, Cloudflare processes technical browser and connection information to distinguish genuine visitors from automated abuse. The server verifies the check with Cloudflare and includes the visitor's IP address; enquiry text is not sent to Cloudflare by this form.
• Abuse prevention records. The form keeps keyed hashes of IP addresses and email addresses with submission timestamps for rate limiting, and a short-lived keyed fingerprint of submitted messages to prevent duplicates. The form does not store message text in its anti-spam database.
• Analytics. This site does not use analytics or advertising trackers.

Why the information is used, and on what basis

• To reply to your enquiry. Lawful basis: legitimate interests (responding to a message you have chosen to send).
• To keep the site secure and available. Lawful basis: legitimate interests (protecting the site from abuse and misuse).

How long information is kept

Enquiry messages are retained only for as long as needed to respond to you and, where appropriate, to keep a short record of the conversation. Access logs are retained for a limited period for security purposes and then deleted or aggregated. Form rate limits use a rolling window of up to one hour; duplicate checks use ten minutes. Expired anti-spam records are removed on subsequent form requests and by scheduled server maintenance.

Who else sees it

Your message is read personally. Enquiries are sent to a dedicated mailbox through the site's configured email provider. The hosting and email providers process the information needed to handle your enquiry, and Cloudflare processes information needed for spam protection. Information is not sold, rented, or shared for marketing. For details of Cloudflare's handling of personal data, see Cloudflare's privacy policy.

Your rights

Under UK GDPR you have the right to access the personal information held about you, to have it corrected if it is wrong, to have it deleted where appropriate, to restrict or object to how it is used, and to lodge a complaint with the Information Commissioner's Office (ico.org.uk).

Cookies

The contact form uses an essential, secure session cookie to protect submissions against forgery. It is not used for advertising or analytics. A small preference (your chosen light or dark theme) may be stored in your browser's memory during your visit; it is not shared with anyone.

Changes to this notice

This notice may be updated from time to time. Material changes will be reflected here with an updated date at the top of the page.

Last updated: 20 September 2026.