Last updated: 19 September 2026
Who is responsible for your information?
I am Calum Medlock, the person responsible for how personal information is used on calummedlock.com (the data controller). This notice covers visits to this website, comments, service enquiries and privacy requests. You can contact me using the privacy request form below or through an existing email conversation with me.
Information I collect and why
- Service enquiries: your name, email address, selected services, project details, any deadline or budget you provide, how you found me, your preferred meeting language and anything else you choose to send. I use this to reply, discuss your requirements, prepare a quote and manage any work we agree. Required fields are marked on the form.
- Comments: the name, email address, optional website and comment you submit, together with technical information such as your IP address and browser details for moderation and spam prevention. Approved comments, your display name, optional website and profile image may be public. Your email address is not displayed publicly.
- Privacy requests: your name, email address, request type and any details you submit. I use this to handle the request and record my response.
- Website operation and security: the website’s security logs record IP addresses, event times and activity details to help protect and troubleshoot the site.
Please include only what is needed for your enquiry. Do not send passwords, payment-card details, identity documents or medical information through the enquiry form. You can describe practical communication preferences without providing medical details.
My reasons for using personal information
- Steps towards a contract or carrying out a contract: responding to a quote or service request you make as an individual, and delivering work we agree.
- Legitimate interests: responding to general or business enquiries, administering my freelance work, publishing and moderating discussion, keeping relevant records, and protecting the website against misuse.
- Legal obligations: responding to applicable data-protection requests and keeping records required for tax or accounting.
- Consent: saving your comment details in cookies when you select the optional checkbox. You can clear these cookies through your browser settings.
Sending a service enquiry does not subscribe you to marketing emails.
Where information is stored and who helps process it
Both the service enquiry form and privacy request form use Formidable Forms. Submissions are saved in this website’s WordPress database and sent to me by email. The forms also record your IP address and submission time, along with browser and referring-page information where supplied.
- Hostinger hosts the website, its database and hosting backups. See Hostinger’s privacy information.
- Google provides the Gmail service used for form email delivery. See Google’s privacy policy.
- Automattic’s Akismet is enabled for comment spam checks. Comments checked by this service include the submitted comment details, IP address and browser information. See Automattic’s visitor privacy notice.
- Automattic’s Gravatar uses a hashed version of a commenter’s email address to look up a profile image. Loading an image also sends connection information to the provider. See Automattic’s privacy policy.
Processing outside the UK
These providers’ published privacy terms describe processing outside the UK. Their stated safeguards include the UK extension to the EU–US Data Privacy Framework for Google and contractual safeguards for relevant transfers. See Google’s transfer information, Hostinger’s data processing terms and Automattic’s privacy policy for details and how to request copies.
How long I keep information
- Enquiries that do not lead to work: my normal retention period is 12 months after our last meaningful contact. An automated monthly check flags older website form submissions for review. Before deleting records, I check for later email correspondence and any continuing reason to keep them, and include the relevant website and email copies in the cleanup. Records may remain until the next monthly review or while a specific outstanding issue is resolved.
- Enquiries that become client work: relevant information is kept while the project or agreed support continues. Afterwards, I retain only what is needed for outstanding obligations, accounting or a specific dispute or legal claim.
- Tax and accounting records: kept for at least five years after the relevant 31 January tax-return deadline, or longer if required by law.
- Privacy requests: information needed to handle a request is kept until it is resolved. A limited record of the request and response is normally reviewed for deletion 12 months after closure, unless needed for an unresolved complaint or legal obligation.
- Published comments: kept while the associated discussion remains published and useful. You can ask for a comment or your personal information to be removed. Spam, rejected comments and security information are kept only as needed for moderation, protection or investigation.
- Backups: Hostinger’s published backup schedule retains daily backups for seven days and weekly backups for six weeks. Information removed from the live website can remain in existing backups until they expire.
I may delete information earlier when it is no longer needed. Any longer retention must have a specific continuing reason, rather than simply keeping everything indefinitely.
Cookies and external content
WordPress uses cookies for functions such as administrator sign-in and security. If you choose “Save my name, email, and website” when commenting, WordPress saves those details in cookies for up to one year. The choice is optional; you can clear these cookies through your browser settings.
Some articles include an embedded YouTube video. Loading or using the player can send technical information to Google/YouTube and allow the provider to use cookies or similar technologies. Your use of the player is also covered by Google’s privacy policy.
External links take you to websites with their own privacy and cookie policies.
Your rights and how to contact me
Depending on the circumstances, you can ask to access your personal information, correct it, delete it, restrict its use or receive a portable copy. Where processing relies on consent, you can withdraw that consent. These rights have conditions and exceptions, including where records must be kept by law.
You can object to processing based on legitimate interests. Explain what you object to and I will consider your circumstances and the applicable requirements.
Use the form below to raise a privacy question, make a request or complain about how your information has been handled. You can also contact me through an existing email conversation; you do not have to use this form or particular legal wording. I may ask for proportionate information to verify your identity. The normal legal response deadline is one month. Any lawful extension will be explained to you.
The form saves your request in WordPress and emails it to me. I use it to handle your request and meet my data-protection obligations, not to subscribe you to marketing.
You can also complain to the UK Information Commissioner’s Office (ICO). You do not have to contact me first.
Changes to this notice
The date at the top shows when this notice was last updated.