WHO IS RESPONSIBLE
The data controller for this portfolio is Matt O’Driscoll, operator of mattodriscoll.uk. Privacy enquiries can be sent to [email protected].
WHAT MAY BE PROCESSED
Depending on how you use the site, information may include technical request and security data such as IP address, browser or user-agent, requested URL, date/time and security events; contact-form information such as your name, email address, subject and message; consent and interface-preference records stored in your browser; and, only if you consent, Google Analytics usage information such as page visits, device/browser information, approximate location and interaction data.
MESSAGES & ANTI-ABUSE
Contact messages are sent to a self-hosted contact endpoint and forwarded by email so they can be read and answered. Cloudflare Turnstile is used to reduce automated abuse and may process browser, device and network information needed to assess and verify a submission. Contact-form enquiries are normally retained for up to 12 months after the last correspondence unless there is a legitimate reason to keep them longer.
GOOGLE ANALYTICS — CONSENT ONLY
Google Analytics 4 is optional. Its tag is not loaded and analytics cookies are not set unless you actively grant Analytics consent through Cookie Settings. If enabled, Google Analytics may use first-party cookies such as _ga and related GA4 cookies to distinguish users and maintain session state. You can withdraw Analytics consent at any time from Cookie Settings.
WHY DATA IS USED
Contact information is used to respond to enquiries and take requested pre-contractual steps where relevant. Technical and security data is processed for the legitimate interests of operating, protecting, diagnosing and securing the site. Optional interface preferences and Google Analytics are used on the basis of consent where consent is required. Consent can be withdrawn at any time without affecting processing already carried out lawfully.
SERVICE PROVIDERS
Information may be processed by providers used to operate and protect the site, including Hetzner for hosting infrastructure, Cloudflare for DNS, reverse-proxy/security services and Turnstile, the email service used to deliver contact messages, Google Fonts for site typography, and Google Analytics only after Analytics consent. External social, project and travel links lead to separate services with their own privacy practices.
INTERNATIONAL PROCESSING
Some service providers may process information outside the United Kingdom. Where this occurs, the relevant provider is responsible for applying the transfer mechanisms and safeguards required by applicable data-protection law for its processing.
HOW LONG DATA IS KEPT
Contact-form enquiries are normally kept for up to 12 months after the last correspondence. Server and security logs are normally kept for no longer than 30 days, except where longer retention is reasonably required to investigate abuse, a security incident or a legal issue. Google Analytics data retention is controlled by the settings of the GA4 property. Consent records are retained so the site can remember and manage your choice.
UK GDPR RIGHTS
Subject to the circumstances and legal exemptions, you may have rights to request access to personal data, correction, erasure, restriction, objection, and data portability, and to withdraw consent where processing relies on consent. To exercise a right, contact [email protected]. You also have the right to complain to the Information Commissioner’s Office (ICO).
STORAGE & CONSENT
Essential storage is limited to what is needed to remember and administer your consent choice. Interface-preference storage and Analytics are optional and disabled for persistent storage/collection until you choose them. See the Cookies page for more detail and use Cookie Settings at any time to change your choice.
SECURITY & LIMITATIONS
Reasonable technical measures are used to protect the site and contact endpoint, including HTTPS, reverse-proxy security controls, rate limiting, Turnstile and input validation. No internet service can guarantee absolute security.
CHANGES TO THIS NOTICE
This notice may be updated when the site, providers or legal requirements change. The current version published on this page applies to the live site. Last updated: 13 September 2026.