Privacy Notice [REVIEW]
Last updated: [REVIEW — date]
1. Who we are [REVIEW]
Dyfyn is a trading name of [REVIEW — registered legal entity, e.g. Dyfyn Cyf], a company registered in [REVIEW — jurisdiction] with company number [REVIEW — Companies House number] and registered office at [REVIEW — address]. Where this notice refers to "we", "us" or "our" it means that company.
For data-protection purposes we are the data controller. You can contact us about this notice at hello@dyfyn.co.uk or on 029 2293 3344.
2. What we collect [REVIEW]
[REVIEW] — placeholder list of data categories collected via the contact form, audit tool, and calculator. To be confirmed against actual implementation:
- Contact form submissions (name, email, interest, message)
- Lead capture from /audit and /calculator (email, URL audited / calculator inputs)
- Server access logs (IP address, user agent, timestamps)
- Analytics data via Vercel Analytics + Speed Insights
3. Lawful basis [REVIEW]
[REVIEW] — placeholder. Likely Article 6(1)(b) (contract / pre-contract) for enquiries; 6(1)(f) (legitimate interest) for analytics and lead-magnet captures; 6(1)(a) (consent) for any marketing communications. To be confirmed.
4. How long we keep data [REVIEW]
[REVIEW] — placeholder retention periods. Typical defaults: enquiries kept for the duration of the engagement plus 7 years for accounting purposes; lead captures kept for 24 months from last contact; server logs 30 days.
5. Who we share with [REVIEW]
[REVIEW] — placeholder list of processors: Vercel (hosting + analytics), Supabase (database), Resend (transactional email), Cloudflare (CDN). Each to be reviewed against their current Data Processing Addendum.
6. Your rights [REVIEW]
[REVIEW] — standard UK GDPR rights summary (access, rectification, erasure, portability, objection, restriction, automated decision-making). Plus complaint route to the ICO. To be reviewed for accuracy and ICO link.
7. Changes to this notice [REVIEW]
[REVIEW] — placeholder amendment clause.