Privacy Notice

1. Who is responsible for your data

ARTinez is the trading name of Andrei Martinescu, a sole trader. For the purposes of the UK GDPR and the Data Protection Act 2018, Andrei Martinescu is the data controller in respect of personal data collected through this website and through the supply of services to ARTinez clients.

You can contact the controller at:

ARTinez (trading name of Andrei Martinescu, sole trader)
Email: office@artinez.co.uk

Where personal information is processed on behalf of a client of ARTinez, the client is the controller and Andrei Martinescu acts as the processor. That is a different arrangement and is governed by a separate written agreement with the client, not by this notice.

2. What we collect

We collect personal data in the following ways.

2.1 Information you give us directly

Contact form. If you use the contact form, your browser sends the fields you fill in to ARTinez's own web server. The server checks them and then forwards them by email to office@artinez.co.uk. Your details are not handed to your own email client, and they are never put into the web address. The fields are: your name, your email address, your business or brand name, the type of project, your description of the project, and — if you choose to give them — a budget range and a timeline.

ARTinez Vision form. If you use the Vision builder, the fields you fill in are sent from your browser directly to ARTinez's own web server, which then forwards them to office@artinez.co.uk. The fields are: your name, your email address, your business name, your business type, your location, the problem you want to solve, the style you prefer, your main goal, and the features you are interested in.

Technical details added to the enquiry email. Whichever form you use, the message that reaches our mailbox also records the network address your request came from, a short description of your browser, and the address of the page you were on when you submitted. We need them in order to reply to you properly and to spot automated abuse. They are covered by the retention period in section 8. They are not used for marketing, and they are not added to any analytics system — we do not have one.

Email correspondence. If you email us, we receive and keep the content of your message, your email address, and whatever attachments you send.

Client engagements. If you become a client, we keep your name, contact details, the details of the project, the correspondence about it, and the contract and invoice records.

2.2 Information we collect automatically

When you visit any page, the hosting provider (Hostinger) records your IP address, the time of the request, the page you requested, your browser type and operating system, and the address of the page you came from. This is normal web-server logging and is used to operate and protect the website.

2.3 Information we do not collect

• We do not collect or store payment card details. This website does not take payment.
• We do not set cookies, and we do not use local storage, session storage or fingerprinting.
• We do not run analytics services, advertising trackers, social-media widgets, video players or chat widgets.
• We do not use an artificial intelligence service to process anything you send us. The ARTinez Vision preview is produced entirely by a set of templates and rules that run in your own browser; nothing you type into it is sent to an AI provider.
• We do not operate a newsletter or mailing list, and we do not send marketing email.

2.4 Special category data and children

Please do not include sensitive personal information in the free-text fields of the enquiry forms — for example health information, information about your finances, your political opinions, your religion, or any national identity numbers. We do not need it in order to respond to an enquiry, and we would rather you did not send it. If you do send it, we will delete it as soon as we have read it.

This website is not directed at children. We do not knowingly collect personal data from anyone under 13. If you believe a child has sent us personal data, email office@artinez.co.uk and we will delete it.

3. Where the information comes from

Almost all of the personal data we hold comes directly from you: you type it into a form, you send it in an email, or you give it to us in the course of a project.

There is one indirect source. Our hosting provider supplies technical server-log data (your IP address, browser and the page requested) when you visit the site. We do not buy data, and we do not receive contact details from third parties.

4. Why we use it, and the lawful bases

Under the UK GDPR we must have a lawful basis for every use of personal data. The table below sets out ours.

Purpose	What we use	Lawful basis
Replying to your enquiry and discussing your project	Enquiry form fields, and the content of your email	Article 6(1)(b) — taking steps at your request before you enter into a contract, and performing the contract if you go on to commission work
Keeping an accurate business contact record	Name, email address, business name, enquiry details, date	Article 6(1)(f) — our legitimate interests in keeping a record of who has contacted us and answering their enquiry properly. We have considered your interests and concluded this is proportionate
Preparing a proposal and delivering agreed work	Contact details, project information, brand assets, content you supply, access credentials for systems you ask us to work on	Article 6(1)(b) — performance of the contract
Contract, invoice and tax records	Contract, correspondence, invoices, payment records	Article 6(1)(c) — compliance with a legal obligation, including record-keeping required by HMRC
Operating, securing and maintaining the website	Server logs: IP address, browser, requested page, timestamp	Article 6(1)(f) — our legitimate interests in keeping the site available and preventing abuse of the enquiry forms
Any optional marketing email you have asked for	Your email address and subscription preferences	Article 6(1)(a) — your consent, which you can withdraw at any time

5. What happens if you do not give us what we need

To reply to an enquiry we need, at a minimum, a way to contact you. If you do not give us a name and an email address, we will not be able to respond, and the enquiry will not lead to a proposal.

Everything else — your business type, your location, your budget range, your timeline, the features you are interested in — is optional. Not providing it does not prevent us from replying; it simply means we have less to work with when we prepare a response.

For the Vision form, your name, email address, business name and description of the problem are required, because without them we could not send or make sense of the enquiry. The remaining fields are optional.

Once a contract is in place, the information needed to deliver the work becomes necessary. If you do not provide it — for example, if you do not supply the content or access needed for a milestone — we may be unable to complete that part of the work on the agreed timetable, and we will tell you if that happens.

6. Who else receives your information

We do not sell your personal data and we do not share it for marketing. It is disclosed only as follows:

• Hostinger International Ltd — our hosting provider. It processes the data on our behalf to operate the website, the web server and the business email account. It is bound by contract to process data only on our instructions.
• HM Revenue & Customs — where the law requires us to provide accounting or tax records.
• A court, a regulator or the police — where we receive a valid legal obligation to disclose.
• Professional advisers — where we engage an accountant or solicitor and they need the information to do their work, under a duty of confidentiality.

No other third party receives personal data submitted through this website.

7. International transfers

This website serves every file from ARTinez's own server. Your browser makes no request to any third-party provider, so no third party sees your IP address in connection with viewing a page.

Personal information you send us is hosted and routed through our hosting and email providers — Hostinger International Ltd — on our instructions. Hostinger is a global company and may process or store information outside the United Kingdom. We have asked for the specific locations involved and we will tell you what has been confirmed if you ask. We do not claim that all data associated with your use of this website stays in the United Kingdom, because we cannot yet evidence that it does.

Where a provider processes personal information outside the UK, a lawful transfer safeguard is required — for example the UK Extension to the EU–US Data Privacy Framework, where the provider has signed it and extended it to the UK, or the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses, where it has not. The Information Commission recognises these as valid transfer mechanisms. We are confirming which safeguard applies to each provider and will tell you when you ask.

Further information about the safeguards we use can be obtained by emailing office@artinez.co.uk with the subject line "Privacy — transfer safeguards".

8. How long we keep it

We keep personal data for as long as we need it for the purpose it was collected, and no longer. Where the same enquiry exists in more than one place — a copy in your email conversation with us and a record in our working files, for example — we apply the same period to every copy. An enquiry cannot outlive its purpose in one system but not in another.

What	How long	Why
Enquiries that do not lead to a project	3 months from the date of our last exchange with you	Long enough to follow up and for you to ask us to delete it sooner. After that there is no ongoing purpose. This period applies to every copy of an unsuccessful enquiry, including the copy in our mailbox
Enquiry handler server log	Entries are removed automatically once they are more than 30 days old	Used only to diagnose delivery failures and to spot abuse. It is not an accounting or contract record. The log holds a reference number, the time, whether the email was accepted for delivery, a shortened network address and a shortened browser identifier — never your name, your email address, your business name or the contents of your enquiry
Rate-limiting state	Deleted from the server once it can no longer have any effect, within 60 seconds of the request	Purely technical, so that a single sender cannot flood the form. It holds no message content and does not store your network address; it is removed almost immediately
Active client information (project files, correspondence, credentials)	For as long as you are a client, then handed over or deleted. Passwords and access credentials are passed to you or deleted when the work ends; they are not kept for the life of the contract record	We need it to do the work and support it
Contracts, invoices and accounting records	At least 5 years after the 31 January tax-return submission deadline for the tax year the records relate to. For example, records for the 2023–24 tax year, returned by 31 January 2025, are kept until 31 January 2030	This is the usual minimum period a sole trader must keep accounting records for HMRC. You may need to keep records for longer if you are involved in a tax audit, a dispute or a legal claim, and we will tell you if that applies
Records needed for a live or recent dispute or claim	Kept only for as long as the dispute or claim needs them, plus a reasonable period afterwards	A separate and specific reason for keeping this material. It is not an extension of the tax retention period, and it does not apply to records generally
Web server access logs (kept by our hosting provider)	For the period set by the hosting provider's own log configuration. We check this setting and reduce it if it is longer than we need	Proportionate for security and abuse investigation. We do not set this period ourselves — it is the hosting provider's setting
Backups taken by our hosting provider	Hostinger's hosting agreement states that its automatic backup runs weekly, overwrites the previous backup, and that two weeks of backups are kept on its remote server; where daily backups are enabled on the plan, they are kept for seven days	To recover from a mistake or a hosting failure, without keeping redundant copies of live data indefinitely. We also keep our own copy of the site files outside the hosting account
Marketing preferences and suppression records	We do not currently operate a mailing list or send marketing email. If that changes, a record of your objection or unsubscribe is kept for as long as marketing could resume to you, and is not deleted on a fixed timer	So that we do not contact you again after you have asked us to stop, including after a period of inactivity

We review these records on a cycle that matches them. Entries in the enquiry log are removed automatically as they age past 30 days, and we check that process monthly. The longer-term records — contracts, invoices and accounting evidence — are reviewed at least annually. If you want something deleted sooner, ask us and we will do it — see section 10.

9. How we protect it

The UK GDPR requires us to have appropriate technical and organisational measures in place to protect personal data. Some of what follows is a legal requirement. The rest is what we do as a matter of practice, or what we would recommend. We have tried to be clear about which is which.

What the law requires. We must use measures appropriate to the risk, we must not keep personal data for longer than we need it, and we must notify the Information Commission within 72 hours where a personal data breach is likely to result in a risk to your rights and freedoms.

What we do in practice.

• the website is served over HTTPS, so data is encrypted in transit between your browser and our server;
• the enquiry handler validates every field on the server and sanitises free-text input before it is stored or emailed;
• the enquiry handler is rate-limited per IP address and protected with a honeypot field, so it cannot be used to send bulk unwanted email;
• the directory that stores enquiry records is not reachable from the public web;
• no passwords, keys or other credentials are stored in the website's HTML, CSS or JavaScript.

What we recommend, but are not required to do. Multi-factor authentication on every account, regularly restore-testing backups, and professional indemnity insurance are all sensible precautions. None of them is something the law requires of us, and we do not describe them as though it were. Professional indemnity cover in particular depends on the work you ask us to do and is a commercial decision for us to take — ask us about it before you rely on it, and we will confirm what our arrangements cover for the project in hand.

No system is perfectly secure. If a breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Information Commission within 72 hours, and will contact you directly where the breach is likely to cause you a high risk.

10. Your rights

Under the UK GDPR you have the right to:

• be told what we hold (access) — ask for a copy of the personal data we hold about you;
• have it corrected (rectification) — ask us to fix anything inaccurate;
• have it deleted (erasure) — ask us to delete it, where the law allows;
• have us pause processing (restriction) — for example while a question about accuracy is resolved;
• receive it in a portable format (portability) — get it in a structured, commonly used, machine-readable format;
• object to processing based on legitimate interests — for example our legitimate interest in keeping a business contact record, if you would prefer we did not;
• object to direct marketing at any time, and withdraw consent for any processing that relied on it, without giving a reason.

Some rights are limited. For example, we may need to keep records where the law requires it, and we cannot erase an invoice just because you ask. If a right you exercise is qualified in this way, we will tell you why.

To exercise any of these rights, email office@artinez.co.uk. We will acknowledge within 5 working days and respond substantively within one calendar month. There is no charge.

If you are unhappy with our response, you have the right to make a complaint to the Information Commission — the UK's independent data protection regulator, which continues to publish its services as the Information Commissioner's Office (ICO) — at ico.org.uk/make-a-complaint, or by telephone on 0303 123 1113. The regulator is the authority you should approach if you believe your data has been used unlawfully. Data protection law is the same across the whole of the United Kingdom; the part of the UK a business is established in does not change who regulates it or what the rules are.

11. Automated decision-making

We do not use automated decision-making that produces legal effects or similarly significant effects on you. The ARTinez Vision preview is produced by a fixed set of templates and rules in your browser; it does not profile you, score you, or make a decision about you, and no data about you is used to generate it.

12. Changes to this notice

We update this notice when our processing changes. The version number and effective date at the top of the page show the current version, and the version history on the legal index records what changed and when. If you want a copy of an earlier version, email office@artinez.co.uk with the date you are interested in.

13. Contact

Any question about this notice, about the data we hold about you, or to exercise a right, email office@artinez.co.uk.