Privacy Policy
Last updated: 11 October 2026
This policy explains what personal data this website collects, why, how long it is kept, and your rights. It is written to meet the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the EU GDPR for visitors in the European Economic Area.
1. Who is responsible for your data
The data controller is Lakshitha Kumaranayake, a sole trader based in Manchester, United Kingdom, registered with the Information Commissioner's Office (ICO).
Contact for anything about your data: hello@lakshitha.co.uk.
2. What data is collected, and why
| When | Data | Purpose | Lawful basis |
|---|---|---|---|
| You send the contact form | Name, email address, and your message. Company, budget, and timeline if you choose to give them. | To read and reply to your enquiry and, if we agree to work together, to prepare that work. | Legitimate interests (Art. 6(1)(f)): answering a message you sent. Where you ask for a quote, steps before a contract (Art. 6(1)(b)). |
| You email me directly | Your email address and what you write. | To reply to you. | Legitimate interests (Art. 6(1)(f)). |
| You choose to load a post from X | X receives your IP address and may set cookies in your browser. | To show the post as X renders it. | Your consent (Art. 6(1)(a)), given when you click "Load the post from X". You can withdraw it by clearing this site's data in your browser. |
This website does not use analytics, advertising, or tracking. It does not collect special category data. Do not send it in the contact form.
3. Who processes your data
Contact form messages are stored in Google Firebase (Cloud Firestore), provided by Google Cloud EMEA Limited and Google LLC. Google acts as a processor under the Google Cloud Data Processing Addendum. Only the controller can read, change, or delete stored messages.
No other person or organisation receives your data, unless the law requires it, or you agree to it.
4. International transfers
The Firebase project that stores contact messages is located in the United States. This is a transfer of personal data outside the UK and the EEA. The safeguards are the UK International Data Transfer Addendum and the EU Standard Contractual Clauses, both included in the Google Cloud Data Processing Addendum, and Google's certification under the UK Extension to the EU–US Data Privacy Framework.
5. How long your data is kept
- Contact form messages: 12 months after the last contact, then deleted.
- If we work together: for the length of the work, and then as long as UK tax and contract law require (normally 6 years).
- Emails: in line with the same periods.
6. Your rights
Under UK GDPR and EU GDPR you have the right to:
- Access the personal data held about you.
- Have incorrect data corrected.
- Have your data deleted.
- Restrict or object to processing.
- Receive your data in a portable format.
- Withdraw consent at any time, where consent is the lawful basis.
To use any of these rights, email hello@lakshitha.co.uk. You will get a reply within 1 month. There is no charge.
7. How to complain
If you are not happy with how your data is handled, please tell me first so I can put it right. You also have the right to complain to the UK supervisory authority:
Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. Helpline 0303 123 1113. ico.org.uk/make-a-complaint.
If you are in the EEA, you can also complain to the data protection authority in your country.
8. Security
Data is sent over HTTPS and stored in Google Cloud with access limited to one authenticated account. Database rules allow the public to send a message but never to read, change, or delete one.
9. Children
This website is not aimed at children under 13, and it does not knowingly collect their data.
10. Changes
When this policy changes, the date at the top changes with it. Significant changes are noted in the Journal.