Privacy.

EliotWebb.co.uk is a trading name of Nordic Creative Limited, registered in England and Wales. Company no. 07580121. Registered office & business address: 124 City Road, London, England, EC1V 2NX. Nordic Creative Limited is the controller for personal data handled through this website. Eliot Webb is the contact for privacy questions; use the protected email link below.

The hosting environment records technical access and security information such as IP address, time, requested page, response status, transferred bytes, referring page and browser user-agent. This is used to operate and protect the website, investigate errors and respond to availability or security incidents. The lawful basis is the legitimate interest in running a secure, reliable website.

Raw website logs are retained for up to seven days. Access is restricted to authorised administrators. The public website does not use browser analytics, advertising pixels, cookies, local storage, session storage, fingerprinting or session replay.

If you use the contact form, your name, work email address, optional organisation, selected project type, self-reported discovery source and message pass through a first-party handler on the current web host and are delivered to Eliot through authenticated Zoho Mail. The project and source fields support enquiry routing and privacy-light campaign attribution. The web server does not retain a copy of the message. The form uses no third-party form service, tracking script or CAPTCHA. If you email Eliot directly, the address, message, headers and anything you choose to include are processed through the same Zoho mailbox. Do not send sensitive or confidential material until suitable terms and safeguards are in place.

To limit automated abuse, the form checks its origin, a hidden field, field contents and submission frequency. It also keeps a one-way, keyed identifier derived from the connecting IP address with submission timestamps for a 24-hour abuse-prevention window. An hourly maintenance task removes expired records even when nobody submits the form, normally within one further hour. The raw address is not stored in that rate-limit record, although it may separately appear in the ordinary seven-day website security logs described above.

For delivery troubleshooting, the handler logs only a random request ID, time and delivery outcome, not the form contents. Honeypot rejections add only an anonymous counter event with no request ID or submitted value. These application events are rotated automatically, expire after 30 days and are deleted at the next hourly cleanup.

The lawful basis is taking steps at your request before a contract and, where relevant, the legitimate interest in keeping an accurate business conversation. An enquiry that does not become an engagement is retained for 12 months after the last meaningful contact, then deleted or anonymised unless a legal reason requires longer retention.

If you follow a booking link, Calendly receives the details you submit, such as your name, email address, timezone, chosen time, the system or process that prompted the enquiry and how you found Eliot. Calendly uses that information to show the published availability, arrange the call, send confirmations, support privacy-light campaign attribution and manage changes. No external calendar is connected at launch. The lawful basis is taking steps at your request before a possible contract and the legitimate interests in administering appointments and understanding which enquiry routes are useful.

Calendly is a separate link-out service. It is not embedded in this website, and no Calendly script, iframe or cookie is loaded here before you choose the link.

Where feedback, a person's name, an organisation name, logo or project evidence appears on the website, it is published only within the recorded permission and attribution scope. It is used to describe relevant past work and working relationships, not to claim an unverified result.

Permission evidence is retained while the material is published and for as long as reasonably needed to demonstrate the authority relied on. If you are identified or quoted and want the material corrected or removed, email Eliot using the protected contact link below.

The website is hosted on Nordic Creative's Hetzner server in Helsinki, Finland, using CloudPanel and Nginx. Zoho provides email, Calendly provides external appointment booking, and Better Stack provides server-side HTTPS availability monitoring from a European region with SSL verification. Better Stack does not add a client-side monitoring script to the public pages.

These providers act under their own terms and, where applicable, data-processing arrangements. Some processing or support access may take place outside the United Kingdom. Where UK data-protection law requires a safeguard, the relevant provider arrangement must use an adequacy regulation, approved contractual clauses or another lawful transfer mechanism.

Raw website logs are kept for up to seven days, and limited contact-form application events expire after 30 days and are removed by the next hourly cleanup. Contact-form rate-limit records expire after 24 hours and are removed by the next hourly cleanup. Unsuccessful enquiries and bookings are kept for 12 months after the last meaningful contact. Engagement, accounting and company records follow the documented statutory and contractual schedule, normally six years where applicable. Permission evidence is kept while the material is published and as required to demonstrate authority.

Zoho Mail and Calendly are reviewed quarterly so expired enquiry and booking information can be deleted or anonymised consistently.

Depending on the circumstances, you may have rights to request access, correction, erasure, restriction or portability of personal data, or to object to processing. Use the protected email link below to make a request. You may also complain to the UK Information Commissioner's Office at ico.org.uk.

This notice is updated when material data flows, providers, retention decisions or legal requirements change. The date shown on this page identifies the current version.