Privacy notice
Last updated: 9 August 2026
Who is responsible for your data
Blueprint Yorkshire is a trading name of Jason Millward, a sole trader.
Crag View, 11 Lytham Gardens, Skipton, North Yorkshire, BD23 2TR, United Kingdom.
Email: hello@blueprintyorkshire.co.uk
I am the data controller for personal data collected through this website. There is no one else: no team, no agency, no shared CRM.
ICO registration. I am registered with the Information Commissioner’s Office under registration reference ZC215184.
What I collect, and why
What
Why
Lawful basis
Your name, website address, email address, and anything you write in the message field
To prepare and send the Website Gap Review you asked for, and to reply to you
Legitimate interests: responding to a business enquiry you initiated. A Legitimate Interests Assessment covering this is signed, dated 8 August 2026, and kept on file.
If you book a call: your name, email address and the time you chose, plus anything you write in the optional note and the email address of anyone you add as a guest — all collected by Calendly on its own booking page
To hold the call you booked, and to send you the confirmation and the joining details
Legitimate interests: arranging a meeting you asked for.
Analytics data (Google Analytics 4)
To understand which pages and actions matter
Consent. Analytics does not load unless you accept it.
If I have contacted you about your business: your business name and town, your website address, and the business email address and telephone number published on your own website
To offer you a free Website Gap Review, and to make sure I only approach businesses it would actually be useful to
Legitimate interests: direct marketing to businesses. A Legitimate Interests Assessment covering this was signed on 8 August 2026, before any outreach was sent, and is reviewed at least annually.
I do not ask for a telephone number. I do not collect special category data. I do not buy personal data and I do not sell yours.
If I have contacted you about your business, your details did not come from you. I found your business in Google’s public business listings, took the contact details published on your own website, and checked your company registration on the public Companies House register. I may also look at your business’s public LinkedIn page to confirm who to contact and what the business does, and I may contact you there. I also measure things about your website that any visitor can see, such as how quickly the homepage loads on a phone. I do not buy lists.
Cookies and analytics
Google Analytics is not loaded at all until you accept it. Not configured to anonymise, not set to a restricted mode: genuinely not loaded. You can accept, reject, or change your mind later using “Cookie preferences” in the footer of any page. Rejecting analytics does not affect anything else on this site. Full detail is on the cookies page.
Who else processes it
Only the suppliers needed to run the website and my email:
Website hosting: Framer, which hosts the website and receives enquiry form submissions. The data sits on Amazon Web Services in the United States. Framer’s data processing addendum forms part of its terms of service, and transfers rely on the EU–US Data Privacy Framework where that applies, or otherwise on the Standard Contractual Clauses with the UK International Data Transfer Addendum.
Email: IONOS, which carries the email I send and receive. The data sits in the United Kingdom, so no international transfer is involved. The data processing agreement forms part of the IONOS terms and conditions.
Google, for Analytics, and only where you have consented. Google’s data processing terms were accepted for this account on 5 August 2026.
Calendly LLC, for the booking page, and only if you choose to book a call. Calendly is a United States company. Booking is on Calendly’s own site, not embedded in this one, so nothing reaches Calendly unless you click through and book. Calendly’s standard Data Processing Addendum applies to the account and covers security, staff confidentiality and its sub-processors. confirm the data processing agreement and the transfer safeguard on the plan actually in use.
Transfers to the United States. Calendly relies on the EU–US Data Privacy Framework, the Standard Contractual Clauses and the UK International Data Transfer Addendum. Google Analytics is covered by the data processing terms accepted for this account, which set out the equivalent safeguards. Framer and IONOS are covered above.
How long I keep it
Enquiries: 24 months from our last contact, then deleted. If you become a client, project records are kept for 6 years after the final invoice, because HMRC requires it.
Outreach records: 12 months from when I collected them if I never contacted you, 12 months from that contact if I did, or 24 months if you replied.
Do-not-contact list: kept indefinitely. If you ask me not to contact you again I keep your email address, and nothing else, permanently. It is the only way to be certain the request is honoured if your business turns up in a later search.
Business listing data: 30 days.
Analytics: 14 months, as set in the GA4 property.
Your rights
Under UK GDPR you can ask me to give you a copy of your data, correct it, delete it, restrict what I do with it, or object to it being processed. You can also ask for it in a portable format. Where I rely on consent, you can withdraw it at any time.
If I have contacted you about your business, you can object to direct marketing at any time and I must stop. There is nothing for me to weigh up and you do not have to give a reason: reply to the email, or email me, and I will stop and add you to the do-not-contact list.
Email hello@blueprintyorkshire.co.uk and I will respond within one month. There is no charge.
If you are unhappy with how I have handled your data, you can complain to the Information Commissioner’s Office at ico.org.uk, or by post to Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
Changes
If this notice changes, the date at the top changes with it.