Privacy policy
Last updated
This site sets no cookies, and the only personal data it collects is what you choose to type into one form. It is never sold, and never shared for advertising.
Who I am
I'm Robbie Maltby. I run this site and the practice behind it through my company, Northbound Digital Ltd, registered in Scotland (company number SC581326). Northbound Digital Ltd is the data controller for anything collected here, and I'm the person to ask about it: hello@northbound.digital.
Northbound works with clients in the EU, the UK and the US, so I hold this site to EU and UK GDPR standards, and apply them to everyone, wherever you're reading from.
What I collect
Personal data enters this site in exactly one place: the enquiry form on the homepage, which you fill in yourself.
The enquiry form
If you send an enquiry, I collect your name, work email, company website if you give one, and your message. It's written to a private Google Sheet and a copy is emailed to my inbox, both through Google Apps Script running in my Google Workspace account. I read and answer that email in HEY. The lawful basis is taking steps prior to a contract, and my legitimate interest in replying to you.
The form stores no IP address or browser data, and nothing you submit is written to server logs. There are no accounts, no payments, no tracking pixels, no profiling or automated decision-making, and no cookies (the cookie policy is short).
Hosting and security
The site is served through Cloudflare's network, which processes visitor IP addresses and request metadata in transit to deliver pages and block abuse: the ordinary working of any modern host, resting on legitimate interest. I never see or store that data myself.
Where it goes
Three services process data on my behalf, each doing one job:
- Cloudflare (opens in new tab) (US): hosting and CDN, and edge analytics.
- Google (opens in new tab) (US): the Google Sheet that stores enquiries, the Apps Script that emails me a copy, and the Workspace mailbox it lands in.
- HEY by 37signals (opens in new tab) (US): the mailbox where I read and reply to that email.
That's the full list. Nothing is sold, and nothing is shared for advertising.
International transfers
Cloudflare and Google are certified under the EU–US Data Privacy Framework, including its UK extension. 37signals handles EU and UK data under the standard contractual clauses in its data processing agreement.
How long I keep it
Enquiries are deleted 24 months after submission, on a quarterly purge, along with the notification copies in my mailboxes.
Analytics
I use Cloudflare Web Analytics to see aggregate page loads and performance. It's cookieless, does no cross-site tracking, and builds no advertising profiles; for visitors in the EU it doesn't run at all. Like the hosting above, it rests on legitimate interest.
Your rights
You can ask for a copy of your data, have it corrected or deleted, restrict or object to how it's used, or take it elsewhere in a portable format. Email hello@northbound.digital and I'll respond within a month.
Complaints
If you think I've handled your data badly, email me first and I'll put it right. You can also complain to your local supervisory authority: in the UK, the ICO (opens in new tab); in the EU, your national data protection authority (opens in new tab).
Changes
If anything about how I handle data changes, this page changes with it, and the date at the top moves.