Privacy Policy
Last updated: 14 September 2026
[DRAFT — NOT YET IN FORCE]
Every item marked in this style must be completed before publication, and the finished notice should be reviewed by a solicitor or data protection adviser. A privacy notice must describe what actually happens to personal data; if any detail below does not match your real processing, correct the notice rather than the other way round.
1. Who we are
Meddalwedd Ltd (“Meddalwedd”, “we”, “us”, “our”) is the data controller for personal data collected through this website, meddalwedd.co.uk.
- Registered in England and Wales, company number [COMPANY NUMBER]
- Registered office: [REGISTERED OFFICE ADDRESS]
- Information Commissioner’s Office registration number: [ICO REGISTRATION NUMBER]
- Email: info@meddalwedd.co.uk
We have not appointed a Data Protection Officer, as we are not required to do so under Article 37 of the UK GDPR. Enquiries about this notice should be sent to the address above.
2. What this notice covers
This notice applies to meddalwedd.co.uk and to business correspondence with us. It does not cover the products we operate, which are separate services with their own privacy notices:
- UK Crime Statistics — see the privacy notice on that site
- VehicleStats — see the privacy notice on that site
- Almanac — product data is held on your device and is not transmitted to us
If you hold an account with, or subscribe to, one of those services, the notice published on that service governs how your data is handled there.
3. What we collect
3.1 Information you send us
This website has no forms. The only way to contact us through it is the email address published on the site. If you email us, we receive whatever you choose to send — typically your name, your email address, your organisation, and the content of your message. Please do not send us special category data (such as health, ethnicity or political opinions) or anything confidential in a first, unsolicited email.
3.2 Technical information from your visit
Our hosting provider automatically records standard server log information when a page is requested. This typically includes your IP address, the browser and operating system you are using, the pages requested, the date and time of the request, and the page that referred you. We use this only to keep the site available and secure. We do not use it to identify individuals, and we do not combine it with any other information.
4. Cookies and tracking
This website sets no cookies. It uses no analytics, no tracking pixels, no advertising technology, no social media embeds and no third-party scripts of any kind. Nothing is stored on your device. There is no cookie banner because there is nothing to consent to.
If we ever introduce analytics or any other non-essential cookie, we will ask for your consent before it is set, as required by the Privacy and Electronic Communications Regulations 2003, and we will update this notice first.
5. Why we process your data, and our lawful basis
Under Article 6 of the UK GDPR we must have a lawful basis for processing personal data. Ours are set out below.
| Purpose | Data used | Lawful basis |
|---|---|---|
| Replying to your enquiry and discussing possible work | Name, email address, organisation, message content | Legitimate interests — Article 6(1)(f). Responding to someone who has chosen to contact us. Where the discussion leads towards a contract, Article 6(1)(b) (steps prior to entering a contract) |
| Keeping the website available, and investigating errors or abuse | Server log data, including IP address | Legitimate interests — Article 6(1)(f). Operating a secure and reliable website |
| Keeping records of business correspondence and transactions | Correspondence, contract and billing records | Legitimate interests — Article 6(1)(f), and legal obligation — Article 6(1)(c), where records must be retained for tax or accounting purposes |
Where we rely on legitimate interests, we have considered whether our interest is overridden by your rights and freedoms. You have the right to object to this processing — see section 9.
6. Who we share your data with
We do not sell personal data. We do not share it with third parties for their own marketing. We do not carry out automated decision-making or profiling on this website.
We use the following categories of service provider, who act as our processors:
- Website hosting — [HOSTING PROVIDER], which stores server log data
- Email — [EMAIL PROVIDER], which handles correspondence sent to us
Each is bound by a contract requiring them to process personal data only on our instructions and to keep it secure. We may also disclose personal data where we are legally required to do so, or to establish, exercise or defend legal claims.
7. International transfers
We aim to keep personal data within the United Kingdom or the European Economic Area. Where a provider processes data outside those areas, we rely on a transfer mechanism recognised under UK law — either UK adequacy regulations, or the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with any additional safeguards required.
8. How long we keep it
| Record | Retention period |
|---|---|
| Enquiries that do not lead to a working relationship | [24 months] from our last contact with you, then deleted |
| Correspondence with clients and prospective clients | For the duration of the relationship, then [6 years] |
| Contract, invoicing and accounting records | 6 years from the end of the financial year concerned, as required for tax purposes |
| Server log data | [90 days], as configured by our hosting provider |
9. Your rights
Under the UK GDPR you have the right to:
- be informed about how we use your personal data — which is the purpose of this notice;
- request a copy of the personal data we hold about you (a subject access request);
- have inaccurate personal data corrected;
- request erasure of your personal data, where we have no continuing lawful reason to keep it;
- request that we restrict how we use your personal data;
- object to processing carried out on the basis of legitimate interests;
- object to direct marketing at any time, without needing to give a reason;
- data portability, where processing is based on consent or contract and carried out by automated means;
- withdraw consent at any time, where we rely on consent.
To exercise any of these rights, email info@meddalwedd.co.uk. We will respond within one month. There is no charge, unless a request is manifestly unfounded or excessive. We may ask you to confirm your identity before we act on a request.
10. Complaints
If you are unhappy with how we have handled your personal data, please tell us first and we will try to put it right. You also have the right to complain to the Information Commissioner’s Office at any time:
- ico.org.uk/make-a-complaint
- Helpline: 0303 123 1113
- Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
11. Changes to this notice
We may update this notice from time to time. The date at the top shows when it was last changed. Where a change materially affects how we use personal data, we will take reasonable steps to bring it to the attention of those affected.
12. Contact us
Questions about this notice, or about how we handle personal data, should go to info@meddalwedd.co.uk, or in writing to the registered office address in section 1.