This policy explains what personal information sudeshnathapa.com and I collect, what I use it for, who else receives it, how long I keep it and how you can use your rights over it. It covers anyone who visits the site, sends me an enquiry, joins my newsletter or hires me. It is written for UK data protection law: the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and, for cookies and marketing emails, the Privacy and Electronic Communications Regulations 2003 (PECR).
I wrote it from what the site actually does, checked against the code that runs it, rather than from a template.
In short
- The site sets no analytics or advertising cookies unless you accept them in the cookie banner, and rejecting them is as easy as accepting.
- When you send an enquiry, I keep what you type plus a few technical details about how it was sent, so I can reply and keep spam out.
- I never sell personal information or hand it to other businesses for their own marketing.
- The companies that host the site and run my email process it on my behalf, as described below.
- You can ask to see, correct or delete what I hold about you at any time by emailing contact@sudeshnathapa.com.
Who is responsible for your information
I am Sudeshna Thapa, an SEO and digital marketing consultant based in London, and I am the controller of the personal information described here. That means I decide why and how it is used, and I am the person you deal with about it.
- Email: contact@sudeshnathapa.com
- Phone: +44 7352129369
What I collect and why
When you browse the site
Like every website, this one sits on servers run by a hosting company. Those servers see your IP address, your browser details and the pages you request, and keep them for a limited time in technical logs so the service can run and be protected from attack. The hosting provider holds those logs on my behalf.
A few necessary cookies keep the site working. One of them remembers the choice you make in the cookie banner, and none of them is used to track you. Analytics and advertising tags stay switched off until you accept their category in the banner. At the time of writing no analytics or advertising tag, such as Google Analytics or the Meta Pixel, is set up on the site at all. If you accept analytics cookies today, the only effect is that the site remembers which campaign or link brought you here. If I add an analytics or advertising tool later, it will still wait for your consent, and I will name it in the cookie policy before it goes live. That policy lists every cookie by name, with its purpose and how long it lasts.
Two kinds of embedded content come from Google. The map on the contact page loads only when you press “Show map”; until then nothing is requested from Google Maps. If a page carries an embedded YouTube video, it uses YouTube’s privacy-enhanced mode: Google receives your IP address when the player loads, and YouTube may store information on your device once you press play.
When you send an enquiry or book a call
Depending on the form, it asks for your name, email address, phone number, company, website, the services you are interested in, a rough monthly advertising budget, a preferred date and time for a call, and your message. Fields marked with an asterisk are required; the rest are up to you.
Alongside what you type, the site records:
- the page you sent the form from, its title, and the website that linked you to that page if your browser passes it on;
- your browser’s identification string and whether you were on a phone, tablet or computer;
- a one-way scrambled (hashed) version of your IP address, used to limit repeat submissions and spot spam. The site does not store the IP address itself;
- the date and time the enquiry arrived.
If you have accepted analytics cookies, the enquiry also records how you first reached the site and which campaign brought you most recently: the landing page, the referring site, the campaign tags in the link you followed and any advertising click identifier, such as Google’s gclid or Meta’s fbclid. These come from a first-party cookie called krj_attr, which holds no name, email address or phone number. If you reject analytics cookies, that cookie is never set, although any campaign tags in the address of the page you send the form from are still saved with the enquiry.
I use all of this to reply to you, to arrange any call you asked for, and to understand which pages and campaigns bring me enquiries, so I spend my own marketing budget sensibly. Once your enquiry is saved, the site emails it to my inbox and sends you an automatic confirmation with a reference number. If an analytics or advertising tool is added in future and you have accepted it, the site tells that tool a form was sent, with details such as the form type and the reference number, never your name, contact details or message.
When you join the newsletter
The sign-up form asks for your email address and, if you want to give it, your name. Your address is stored on this site and used only to send the newsletter, and the emails carry no tracking pixel. You can stop them at any time by replying to any issue, and I then take you off the list.
When you email, phone or message me
If you contact me directly rather than through a form, I keep the email or message, or my notes of the call, so I can reply and follow up. The site records nothing about these conversations. If you message me on WhatsApp, WhatsApp also handles that conversation under its own privacy policy.
When you become a client
If we work together, I hold the contact details of the people I deal with at your business, our contract, invoices and payment records, and our correspondence. The work itself often needs access to accounts such as Google Analytics, Google Search Console, Google Ads or Meta’s business tools, and those can contain personal data about your own customers. For that data you are the controller and I act as your processor: I use it only to do the work you have asked for, on the data protection terms set out in my terms of engagement, and you can remove my access to your accounts whenever you choose.
Information I would rather not receive
Please do not send me health information, details of your ethnicity, religion, sexual orientation or political views, or anything about criminal records, through the forms or by email. UK GDPR gives this information extra protection, and I never need it to answer a marketing enquiry. If it arrives anyway, I delete it and reply without it. The same applies to other people’s personal details that your enquiry does not need.
The lawful basis for each use
UK GDPR allows personal information to be used only when one of six lawful bases applies. These are the ones I rely on:
| What I do | Lawful basis |
|---|---|
| Replying to an enquiry about working with me, and preparing a proposal or a free audit you asked for | Steps taken at your request before a contract (Article 6(1)(b)) |
| Replying to any other message | Legitimate interests: answering people who contact me (Article 6(1)(f)) |
| Recording the page, browser details and hashed IP address with an enquiry, and checking for spam and abuse | Legitimate interests: keeping the forms secure and knowing which pages bring enquiries |
| Analytics cookies, the krj_attr campaign cookie and advertising tags | Consent, given in the cookie banner (Article 6(1)(a) and regulation 6 of PECR) |
| Sending the newsletter | Consent, given when you sign up (Article 6(1)(a) and regulation 22 of PECR) |
| Delivering client work, invoicing and managing our contract | Contract (Article 6(1)(b)) |
| Keeping business and tax records | Legal obligation (Article 6(1)(c)) |
| Dealing with a dispute or legal claim | Legitimate interests: protecting my legal position |
Where I rely on legitimate interests, I have weighed them against yours and kept the information to what the purpose needs. You can object to any of those uses. Where I rely on consent, you can withdraw it whenever you like, and withdrawing does not affect anything done before.
Who receives your information
Your information is never sold, and nobody else gets it for their own marketing. Two kinds of supplier process it on my behalf, and they may use it only on my instructions:
- My web host, which stores the website, its database and the enquiries in it.
- My email provider, which holds my mailbox and sends the site’s notification and confirmation emails.
Others receive information only in these circumstances:
- Analytics and advertising platforms, such as Google or Meta, only if I add their tags to the site in future and you accept the matching cookies. None is set up at the time of writing. Such platforms also use what they collect for their own purposes, under their own privacy policies.
- Google, when you choose to load the map on the contact page or play an embedded video.
- Professional advisers, such as an accountant or a solicitor, when I need their advice.
- HMRC, the police, courts or regulators, where the law requires me to share information.
The site can forward new enquiries to another system automatically, but that feature is switched off at the time of writing, so no enquiry leaves the site that way. The optional Cloudflare spam check on the forms is not in use either. If I switch either on, I will update this policy first.
Transfers outside the UK
My hosting and email providers may store or process personal information outside the UK. UK GDPR allows that only where the destination country has been recognised by the UK government as protecting personal information adequately, or where the transfer is covered by an approved safeguard, such as the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses. If you would like to know where your information is held and which safeguard applies, ask me using the details above.
How long I keep it
| Information | How long |
|---|---|
| Enquiries that do not lead to work, messages marked as spam, and the notification emails about them in my inbox | Until the enquiry has been dealt with and I no longer need it to follow up, or sooner if you ask me to delete it. When I remove one, your name, contact details and message are erased and only an anonymous record remains. The site can also do this automatically after a set number of days, but that setting is not switched on at the time of writing. |
| Newsletter subscriptions | Until you unsubscribe |
| Client contracts, invoices and correspondence | As long as HMRC requires business records to be kept: at least five years after the 31 January Self Assessment deadline for a sole trader, or six years from the end of the financial year for a limited company |
| The krj_attr campaign cookie | 90 days in your browser |
| Your cookie choice | 180 days, after which the banner asks you again |
| Counters that limit repeat submissions, keyed to a hashed IP or email address | Up to one hour |
How I protect it
The site runs over HTTPS, so what you type into a form is encrypted on its way to the server. Enquiries are kept in their own database tables, separate from the site’s pages, so they never appear in site search, feeds or sitemaps. Only administrator accounts can read them. The forms also run their own checks against spam and automated abuse, with no third-party service involved.
No system is perfectly secure. If a breach put your information at risk, I would report it to the ICO within 72 hours where the law requires, and tell you directly if it was likely to cause you serious harm.
Your rights
Under UK GDPR you can ask me to:
- give you a copy of the personal information I hold about you, known as a subject access request;
- correct anything that is wrong or incomplete;
- delete your information when I no longer need it, when you withdraw consent, or when you object and I have no overriding reason to keep it;
- restrict how I use it while a question about it is resolved;
- stop using it where I rely on legitimate interests, and stop any direct marketing at once, with no reason needed;
- send information you gave me, in a common machine-readable format, to you or to another organisation, where I use it on the basis of consent or a contract.
You can also withdraw any consent you have given. For cookies, open the cookie settings panel, which is also linked from the footer of every page. For the newsletter, reply to any issue.
How to make a request
Email contact@sudeshnathapa.com or use the contact page, and say which right you want to use. I reply within one month. If a request is complex, or you send several, I can extend that by up to two further months, and I will tell you within the first month if I need to. There is normally no fee. I may ask you to confirm who you are first, usually by writing from the email address the information is held under, so that I never hand your details to someone else.
When I erase an enquiry, the site removes your name, contact details, message, browser details, hashed IP address and advertising click identifiers, and deletes any notes attached to it. What remains is an anonymous record that an enquiry arrived on a given date from a given page or campaign, which keeps my marketing figures accurate without identifying you.
Complaints
If you are unhappy with how I have handled your information, please tell me first so I can put it right. I will acknowledge your complaint within 30 days and let you know what I have done about it.
You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s supervisory authority for data protection:
- Online: ico.org.uk/make-a-complaint
- Helpline: 0303 123 1113
- Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Automated decisions
The site scores each form submission for signs of spam. A message that scores highly is saved as spam instead of being emailed to me, but I can still read it and move it back. Nothing about you is decided by automated means in a way that has a legal or similarly significant effect on you.
Children
This site and my services are for businesses. They are not aimed at children, and I do not knowingly collect information from anyone under 18. If you think a child has sent me their details, tell me and I will delete them.
Links to other websites
Pages here link to other sites, including the share buttons on blog posts. Those buttons are plain links: nothing loads from LinkedIn, X, Facebook or WhatsApp until you click one. Once you are on another site, its own privacy policy applies.
Changes to this policy
I update this policy when the site, my suppliers or the law change. The date below shows the current version. If a change affects how I use information you have already given me, I will tell you directly before it takes effect.
Last updated: 5 October 2026.