Who we are

This website is run by Carl Sant, trading as Diverse Tracks, Dundee. Carl Sant, trading as Diverse Tracks, is the data controller for personal data collected through this website, through the enquiry form and through emails sent to us.

To contact us about this notice, or about your personal data, email [email protected]. This is a temporary address until Diverse Tracks has its own mailbox.

ICO registration number: [ICO registration number]. This is a placeholder. The ICO data protection fee self-assessment has not been completed yet, and a number will be added here if registration is required.

Cookies

This website sets one cookie, called __cf_bm. It is set by Cloudflare, which Carrd uses to help protect the site from automated traffic (bots). The cookie is HttpOnly and Secure. It expires after 30 minutes.

This cookie is strictly necessary for the security of the site. UK law does not require a consent banner for a strictly necessary cookie, and we do not show one. We do not set any other cookies. We do not use analytics cookies, advertising cookies or tracking cookies. The enquiry form does not set cookies of its own.

This site does not use analytics or advertising. Its fonts (Plus Jakarta Sans and Inter) are included in the page itself and are not fetched from a third party. [To confirm at build: this is only true if the embedded fonts show on the published site. If Carrd’s own font settings are used instead, say here that fonts may be served by Google Fonts, which would send your IP address to Google.]

[Gap: to confirm when the form is built in Carrd. If a spam check such as a captcha is switched on for the form, it may load a third-party service and this section must be updated.]

What this notice covers

This notice explains how we use personal data when you visit this website, send us an enquiry through the form, or email us. It does not cover work we do inside a client’s own accounts under a paid engagement. That work is covered by the agreement we sign with the client, including a data processing agreement where we act as a processor of the client’s data.

What we collect

When you visit the site, Carrd and its providers, including Cloudflare, may log technical information. Carrd’s privacy policy says its systems log IP address, browser type and settings, the date and time of the request, and device information. This is used to run and secure the site, not for marketing. You can read Carrd’s privacy policy at https://carrd.com/docs/general/privacy.

If you send an enquiry through the form on this site, we collect what you type into it:

• your name
• your email address
• your organisation
• the size of your organisation (a range, such as 10-49)
• the service you are interested in
• a record that you ticked the box to say you have read this privacy notice

All of these fields are required. We do not ask for health information or any other sensitive details, and we ask you not to include them. There is no account sign-in, no newsletter signup, no analytics and no advertising on this site.

If you email [email protected], we will receive whatever you include in that message. That usually means your email address, your name if you give it, and the content of your message. If you later become a client, we may also hold the contact and billing details needed to do the work and keep our accounts.

Why we use this data, and our lawful basis

Enquiry form: we use your details to read the enquiry you sent and reply to you. The lawful basis is legitimate interests, UK GDPR Article 6(1)(f). We have a legitimate interest in replying to people who contact us about our services, and using your details for that is what you would expect when you send an enquiry. Read the ICO’s guidance on legitimate interests. You have the right to object to this use of your details. To do so, email [email protected] and we will stop and delete your enquiry unless we have a compelling reason to keep it. The tickbox on the form only records that you have read this notice. It is not a consent, and there is no marketing sign-up.

Enquiry emails: we use your message to respond. The lawful basis is UK GDPR Article 6(1)(f): our legitimate interest in answering correspondence sent to us. You can object to this. See “Your rights” below.

If your enquiry goes on to a proposal or an agreement, we use your details to take steps at your request before a contract, and then to carry out the contract. The lawful basis for that is UK GDPR Article 6(1)(b).

We keep invoices and accounting records because UK tax law requires it. The lawful basis is UK GDPR Article 6(1)(c): a legal obligation.

When you visit the site, technical logs and the __cf_bm cookie are used to operate the site and protect it from automated abuse. The lawful basis is UK GDPR Article 6(1)(f): our legitimate interest in running a secure website. You can object to this.

We do not use your data for marketing lists, profiling or automated decisions. We will only use your details to reply to your enquiry, not to send you marketing.

Who we share it with

We do not sell your personal data. We only share it where we need to run the service or the law requires it.

• Website hosting and the enquiry form: this site is hosted by Carrd Inc. (Carrd), a company in the United States. Carrd processes what you type into the form and forwards it to us by email. The site is served through Cloudflare, Inc. (Cloudflare), which operates a global network and is also based in the United States. Carrd acts as our processor for data about visitors to this site and for form submissions, under Carrd’s Data Processing Addendum. That addendum lists Cloudflare, Inc. and Amazon Web Services, Inc. as Carrd’s subprocessors. Both are in the United States. You can read the addendum at https://carrd.com/docs/general/terms-dpa. [Gap: Carrd has not published whether it keeps a copy of form submissions after emailing them, or for how long. To confirm with Carrd.]
• Email: form submissions and emails to [email protected] arrive in our business mailbox, which is provided by Google Workspace (Google). Google processes that mail in order to provide the mailbox. [Gap: temporary mailbox. This will change when a Diverse Tracks mailbox is set up.]
• Professional advisers, such as an accountant, where they need information to help us meet our legal duties.
• A court, regulator or other authority if the law requires us to share information.

Transfers outside the UK

Google may process Workspace mailbox data outside the UK. Google says it uses approved safeguards for those transfers, such as standard contractual clauses.

Carrd and Cloudflare process website data, including form submissions, in the United States. Carrd’s Data Processing Addendum states that, where a customer is subject to European data protection law (which the addendum defines as including the law of the United Kingdom) and a transfer of personal data to Carrd would be restricted without standard contractual clauses, the parties agree that those clauses are incorporated. Carrd is the data importer and the customer is the data exporter. The addendum defines those clauses as Module 2 of the EU Standard Contractual Clauses (European Commission Implementing Decision (EU) 2021/914). Where the UK GDPR applies, it defines them as those EU clauses supplemented by the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, issued by the Information Commissioner under section 119A(1) of the Data Protection Act 2018. You can read the addendum at https://carrd.com/docs/general/terms-dpa.

How long we keep it

• Enquiry form submissions and enquiry emails: up to two years after our last contact, unless we still need them for a live discussion, a contract, a dispute, or a legal duty. If you ask us to delete your enquiry sooner, we will, unless the law requires us to keep it.
• Client and billing records: for as long as the work continues, and then for at least 5 years after the 31 January submission deadline of the relevant tax year, which is the rule on GOV.UK: how long to keep your records. [Gap: this rule is for sole traders and partnerships. To check against the structure Diverse Tracks takes once registered.]
• Website server logs and related technical data held by Carrd or Cloudflare: Carrd has not published a specific retention period for logs on customer sites. The period is set by the provider. See Carrd’s privacy policy.

We may keep information for longer if the law requires it, or if we need it to deal with a claim or dispute.

Your rights

Under UK GDPR you have the right to:

• ask for a copy of the personal data we hold about you
• ask us to correct inaccurate or incomplete data
• ask us to delete your data, in certain cases
• ask us to restrict how we use your data, in certain cases
• object to processing based on legitimate interests
• ask for the data you gave us to be provided to you, or to another organisation, in a structured, commonly used format, where the lawful basis is contract and the processing is automated

These rights are not absolute. The law sets out when they apply. To use any of them, email [email protected]. We may need to confirm your identity before we can act on a request. We will respond within one month, or tell you if we need more time, as the law allows.

How to complain

If you are unhappy with how we have used your personal data, please email us first at [email protected] and we will try to put it right.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK regulator for data protection:

• Website: https://www.ico.org.uk/make-a-complaint
• Telephone: 0303 123 1113

Children

This website is aimed at organisations, not at children. We do not knowingly collect personal data from children.

Changes to this notice

We will update this notice if our practices change, including when an ICO registration number or a registered organisation name is available. The “Last updated” date at the top will change when we do.

Back to top