Privacy notice
Last updated: 15 September 2026
1. Who we are
Meddalwedd (“we”, “us”, “our”) is the data controller for personal data collected through this website, meddalwedd.co.uk. Meddalwedd is a software business based in the United Kingdom.
Questions about this notice, or about how we handle personal data, should be sent to info@meddalwedd.co.uk. We have not appointed a Data Protection Officer, as we are not required to under Article 37 of the UK GDPR.
2. What this notice covers
This notice applies to meddalwedd.co.uk and to business correspondence with us. It does not cover the platforms we operate, which are separate services with their own privacy notices:
- UK Crime Statistics — see the privacy notice on that site
- Vehicle Stats — see the privacy notice on that site
- Almanac — data stays on your device and is not sent to us
If you hold an account with, or subscribe to, one of those services, the notice published there governs how your data is handled.
3. What we collect
3.1 Information you send us
This website has no forms. The only way to contact us through it is the email address published on the site. If you email us, we receive whatever you choose to send — typically your name, email address, organisation and the content of your message. Please do not include special category data (such as health, ethnicity or political opinions) or anything confidential in a first, unsolicited email.
3.2 Technical information from your visit
Our hosting provider records standard server log information when a page is requested: your IP address, browser and operating system, the pages requested, the date and time, and the referring page. We use this only to keep the site available and secure. We do not use it to identify individuals, and we do not combine it with any other information.
4. Cookies and analytics
This website sets cookies only if you accept them. The only cookies it can set belong to Google Analytics, which we use to understand how the site is used: which pages are visited, how people arrive, and roughly where they are. Nothing is loaded from Google and no cookie is set until you choose Accept on the bar shown on your first visit. If you decline, nothing is sent to Google.
Your choice is kept in your browser’s local storage for twelve months so we do not ask again. Storing that choice is strictly necessary and does not itself need consent. You can change your mind at any time using Cookie settings in the footer of every page; declining removes the analytics cookies from your browser.
| Cookie | Set by | Purpose | Lasts |
|---|---|---|---|
_ga | Google Analytics | Distinguishes one visitor from another using a random identifier | 2 years |
_ga_H1Y0HS7QVS | Google Analytics | Keeps track of a visit’s state for this site | 2 years |
We do not use Google Signals, advertising features or audience sharing, and we do not link analytics data to any other information we hold. Google Analytics does not store your full IP address; it uses it to derive an approximate location and then discards it. The site uses no other tracking pixels, advertising technology, social media embeds or third-party scripts.
5. Why we process your data, and our lawful basis
Under Article 6 of the UK GDPR we must have a lawful basis for each use of personal data.
| Purpose | Data used | Lawful basis |
|---|---|---|
| Replying to your enquiry and discussing possible work | Name, email address, organisation, message content | Legitimate interests, Article 6(1)(f): responding to someone who has chosen to contact us. Where the discussion leads towards a contract, Article 6(1)(b) |
| Keeping the website available, and investigating errors or abuse | Server log data, including IP address | Legitimate interests, Article 6(1)(f): operating a secure and reliable website |
| Understanding how the website is used | Pages visited, referring site, browser and device type, approximate location, a random identifier held in a cookie | Consent, Article 6(1)(a): given through the cookie bar, and withdrawable at any time |
| Keeping records of business correspondence and transactions | Correspondence, contract and billing records | Legitimate interests, Article 6(1)(f); and legal obligation, Article 6(1)(c), where records must be kept for tax or accounting purposes |
Where we rely on legitimate interests, we have considered whether our interest is overridden by your rights and freedoms. You have the right to object to this processing — see section 9.
6. Who we share your data with
We do not sell personal data, share it with third parties for their own marketing, or carry out automated decision-making or profiling on this website.
Three categories of service provider act as our processors:
- Website hosting — a UK-based hosting provider, which stores server log data
- Email — our email provider, which handles messages sent to us
- Analytics — Google Ireland Limited, which processes usage data for us through Google Analytics under Google’s data processing terms, and only if you have accepted analytics cookies
Each is bound by a contract requiring it to process personal data only on our instructions and to keep it secure. We may also disclose personal data where the law requires it, or to establish, exercise or defend legal claims.
7. International transfers
We keep personal data within the United Kingdom or the European Economic Area wherever we can. Where a provider processes data outside those areas, we rely on a transfer mechanism recognised under UK law: UK adequacy regulations, the International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, with any additional safeguards required.
Google may transfer analytics data to Google LLC in the United States. Google LLC is certified under the UK Extension to the EU-US Data Privacy Framework, which UK adequacy regulations recognise as a lawful basis for that transfer.
8. How long we keep it
| Record | Retention period |
|---|---|
| Enquiries that do not lead to a working relationship | 24 months from our last contact with you, then deleted |
| Correspondence with clients and prospective clients | For the duration of the relationship, then 6 years |
| Contract, invoicing and accounting records | 6 years from the end of the financial year concerned, as required for tax purposes |
| Server log data | Up to 90 days |
| Analytics data in Google Analytics | Up to 14 months for data tied to an individual identifier; aggregated reports beyond that do not identify anyone |
9. Your rights
Under the UK GDPR you have the right to:
- be informed about how we use your personal data, which is the purpose of this notice;
- request a copy of the personal data we hold about you (a subject access request);
- have inaccurate personal data corrected;
- request erasure of your personal data, where we have no continuing lawful reason to keep it;
- request that we restrict how we use your personal data;
- object to processing carried out on the basis of legitimate interests;
- object to direct marketing at any time, without giving a reason;
- data portability, where processing is based on consent or contract and carried out by automated means;
- withdraw consent at any time, where we rely on consent — for analytics cookies, use Cookie settings and choose Decline.
To exercise any of these rights, email info@meddalwedd.co.uk. We will respond within one month. There is no charge unless a request is manifestly unfounded or excessive. We may ask you to confirm your identity before acting on a request.
10. Complaints
If you are unhappy with how we have handled your personal data, please tell us first and we will try to put it right. You also have the right to complain to the Information Commissioner’s Office at any time:
- ico.org.uk/make-a-complaint
- Helpline: 0303 123 1113
- Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
11. Changes to this notice
We may update this notice from time to time; the date at the top shows when it last changed. Where a change materially affects how we use personal data, we will take reasonable steps to bring it to the attention of those affected.