Privacy policy

Who we are

This site is operated by BRAW LEITH LTD, a company registered in Scotland under company number SC874039. We trade as Braw, and our address for correspondence is Braw HQ, Edinburgh, EH6 4SB.

For the purposes of UK data protection law we are the data controller for the personal data described below. Our registration with the Information Commissioner's Office is ZC168541.

If you want to ask anything about this policy, or exercise any of the rights set out in it, email [email protected].

What we collect and why

We collect as little as we can get away with. In practice that means four things.

When you use the contact form

Our contact form collects your name, email address and whatever you write in the message. We use it to answer your enquiry and, if you go on to become a client, to deliver the work. The lawful basis is legitimate interests before a contract exists, and performance of a contract once one does.

When you subscribe to the newsletter

We collect your email address only. We use it to send the monthly email and nothing else. The lawful basis is your consent, which you can withdraw at any time using the unsubscribe link in any email, or by emailing us.

When you browse the site

If you accept analytics cookies we collect anonymised usage data through Google Analytics — pages viewed, rough location at city level, device and browser type, and how you arrived. We use it to understand which pages are worth keeping. The lawful basis is your consent, and nothing is collected until you give it. Our cookie policy lists exactly what gets set.

Automatically, for security

Our host and Cloudflare keep server logs containing IP addresses and request details. These exist to keep the site online and block attacks. The lawful basis is legitimate interests in securing the service.

Who we share it with

We do not sell your data and we do not share it for anyone else's marketing. We do use a small number of suppliers who process data on our behalf, each under contract:

• Our hosting provider — stores the website and its database, including contact form submissions.
• Cloudflare — content delivery, bot protection and performance monitoring.
• Google (Analytics) — website analytics, only where you have consented.
• Our email provider — delivers the messages we send you.

Some of these suppliers process data outside the UK, including in the United States. Where that happens, transfers are covered by the UK International Data Transfer Addendum, the UK Extension to the EU-US Data Privacy Framework, or equivalent safeguards.

We may also disclose data where we are legally required to.

How long we keep it

• Enquiries that go nowhere — deleted within 24 months.
• Client records — kept for the life of the engagement and then 6 years, which is what tax and contract law requires.
• Newsletter subscriptions — until you unsubscribe.
• Analytics — retained by Google for 14 months.
• Server and security logs — typically 30 days.

Your rights

Under UK GDPR you can ask us to: give you a copy of the data we hold about you; correct it if it is wrong; delete it; restrict how we use it; hand it over in a portable format; or stop using it for a particular purpose. Where we rely on consent, you can withdraw that consent at any time without affecting anything done beforehand.

Email [email protected] and we will respond within one month. There is no charge.

If you are not happy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk, by phone on 0303 123 1113, or by post to Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. We would rather you came to us first so we can put it right.

Security

The site runs over HTTPS, sits behind Cloudflare, and is backed up regularly. Access to the systems holding your data is limited to people who need it. No system is perfectly secure, but we take this seriously and will tell you and the ICO promptly if a breach affects you.

Changes

If we change this policy we will update the date at the top of the page. Material changes affecting existing clients will be emailed.