Legal
Privacy
This site collects about as little as a website can while still being a website. No analytics. No tracking pixels. No advertising. No mailing list. Here is all of it, in full.
Last updated 1 September 2026 UK GDPR & Data Protection Act 2018
Contents
01Who is responsible
This website is kevindurham.com. The data controller — the one answerable for the information described here — is Kevin Durham.
To ask anything about this notice, or to exercise any of the rights in section 12, use the contact form. Requests are answered by a person, not a ticketing system, and normally within a few days — never more than one month.
02The short version
You can read this entire site without giving anything away deliberately. It has no analytics, no advertising, no tracking pixels, no social-media trackers and no mailing list. It sets no cookies of its own.
Information reaches us in exactly two ways: you fill in the contact form, or you send a file through the password-protected upload page. Both are described below. Nothing collected here is ever sold, rented, or handed to anyone for marketing — not by us, and not by anyone we use.
03The contact form
If you use the form on the home page, you send us your name, your email address, the subject you picked from the list, and your message.
That is turned straight into an email and delivered to a mailbox we read. The email also records two technical details, both used to judge whether a submission is genuine: the IP address the form was sent from, and how many seconds passed between the page loading and the form being sent.
Nothing you type into the form is written to this website's database. There is no dashboard of past enquiries on the server, no export, and no backup of submissions here — the message exists as an email in a mailbox, and nowhere else.
Your message is used to reply to you and, if it turns into work, to arrange that work. It is never added to a marketing list, because there isn't one.
04Keeping the form free of spam
The form is defended against bots without asking you to prove anything — there is no CAPTCHA, no puzzle and no third-party anti-bot service watching you. Some of that defence touches your data, so it belongs here:
- The page gives your browser a signed timestamp when it loads, so the server can tell how long the form took to fill in. It identifies the page, not you.
- Your browser is asked to run a small piece of JavaScript and return the answer. It reads nothing about you or your device.
- Two hidden decoy fields sit off-screen. A person never sees them; a bot fills them in and is discarded.
- Your IP address is scrambled into a one-way hash and stored on the server for one hour, purely to count submissions and cap them at six per hour. The original address is not stored, and the hash is deleted automatically when the hour is up.
Messages that look like spam are discarded rather than delivered. Because a discarded message is never read, it is never stored anywhere either.
05The upload page
There is a password-protected page for sending large files. It is not linked from anywhere on the site and asks search engines not to index it, so this section only concerns you if you have been given the address and the password.
- Your file goes directly from your browser to Google Drive and lands in a folder belonging to Kevin. It does not sit on this web host. (If your network blocks the direct route, the file is relayed through the site in 8 MB pieces and still ends up in the same place, without being kept here.)
- You may add your name, email address and a short message. All three are optional.
- When an upload finishes, an email is sent to us with the file name, its size, whatever you chose to put in those optional fields, a link to the file, and the IP address it came from.
- Entering the correct password gives your browser a signed pass, valid for six hours, so you are not asked again mid-upload. It is held only in the page's memory — close the tab and it is gone. It is tied to your IP address and contains nothing else about you.
- Password attempts are limited to twelve per hour per IP address, counted the same scrambled way as in section 4.
Files you send live in Google Drive under Kevin's own Google account. Google acts as our processor for that storage; its handling of the data is covered by Google's privacy policy. The connection uses a permission that only lets this site see files it created itself — it cannot read the rest of the Drive.
06Server logs
Like every website, this one runs on a web server, and that server keeps automatic access logs: the IP address of each request, the page asked for, the time, and the browser and operating system your browser announces. These logs are created and held by our hosting provider, are used only to keep the site running and secure, and are rotated and deleted by the host on its own cycle — typically within a few weeks. Nobody reads them unless something has gone wrong.
Pages are also served through a cache, which stores copies of the pages themselves. It stores no information about the people requesting them.
07Things loaded from other companies
A handful of pieces of this site are fetched from other companies' servers. Whenever that happens, your browser has to tell them your IP address and roughly which browser you are using, simply to receive the file. They are:
- Google Fonts
- The typefaces on every page are served by Google. fonts.googleapis.com · fonts.gstatic.com
- jsDelivr
- A public code network that delivers the animation library the home page uses. cdn.jsdelivr.net
- YouTube
- Trailers and clips are embedded from YouTube, and their thumbnails come from Google's image servers. YouTube is a Google service and may set its own cookies and record that you watched, particularly if you are signed in to Google. Nothing plays until you press play. youtube.com · i.ytimg.com
Podcast audio is served from this site's own domain, so listening to an episode here involves nobody else. Links to Apple Podcasts, YouTube, Instagram, TikTok, X, Facebook, LinkedIn and Snapchat are ordinary links: nothing is shared until you click one, and once you do you are on their website under their privacy policy.
09What is kept, and for how long
- Your contact-form message
- Held as an email in a mailbox we read. Kept while a reply or a conversation is still live, and cleared out once it plainly isn't — in practice within about two years. Deleted on request
- Enquiries that turn into work
- Kept for the length of the job, then for as long as tax and accounting law requires records to be kept — six years after the end of the relevant financial year. Legal obligation
- The scrambled IP hash used for rate limiting
- One hour, then deleted automatically. Automatic
- Files sent through the upload page
- Kept in Google Drive for as long as the project they relate to needs them. Deleted on request
- Server access logs
- Held by the hosting provider on its own rotation, typically a few weeks. Host controlled
10Why we are allowed to hold it
UK data protection law requires a lawful basis for each use. Ours are:
- Legitimate interests — replying to people who get in touch, keeping the site working, and stopping the contact form being drowned in spam. The interest is being reachable and being able to answer; the effect on you is minimal, and you can object at any time.
- Steps taken before entering a contract — where your enquiry is about booking, commissioning or hiring, and we correspond about doing that.
- Legal obligation — keeping records of actual work for the periods tax law demands.
None of this relies on consent, because nothing here is optional tracking. There is accordingly no consent to withdraw.
11Information leaving the UK
Some of the services above are run by companies based outside the UK, chiefly Google (for fonts, embedded video and, if you use it, Drive storage) and jsDelivr's global network. Where information is transferred outside the UK, it is protected by the safeguards UK law recognises: an adequacy decision covering the receiving country or scheme, or the UK's International Data Transfer Addendum to the standard contractual clauses. You can ask us which applies to a particular service.
12Your rights
Over any information we hold about you, you have the right to:
- See it — ask for a copy of what we hold and what we do with it.
- Correct it — have anything wrong put right.
- Have it deleted — unless we are required to keep it, in which case we will tell you which requirement.
- Restrict what we do with it while a question about it is being sorted out.
- Object to our relying on legitimate interests.
- Take it with you in a portable, machine-readable form.
Use the contact form to exercise any of these. There is no charge, and we will not ask you to justify the request. If you would like the message you sent us deleted, saying so is enough — you need not explain why.
13Children
This site is aimed at adults — some of the comedy on it emphatically so — and is not directed at children. We do not knowingly collect information about anyone under 13. If you believe a child has sent us something through the form, tell us and it will be deleted.
14Changes to this notice
If what the site does changes, this page changes with it, and the date at the top changes too. There is no archive of previous versions; the page you are reading is the one that applies.
15Complaints
If something here troubles you, please raise it with us first — it is quicker, and usually the problem is that something is unclear rather than wrong.
You also have the right to complain directly to the UK's data protection regulator, the Information Commissioner's Office, at ico.org.uk/make-a-complaint or on 0303 123 1113. You do not have to come to us first.
Related: the terms of use cover what you may do with what is on this site.