Privacy policy

1. Who is responsible for your data

Data Controller: Wayne Tomlinson, trading as SourceCode (NIE Y6523555X)
Address: Partida Benicolada 1-N, 03710, Calpe, Spain
Email: [email protected]
Telephone: +34 633 198 142

2. What this website collects

The website loads Google Analytics 4 so I can see which pages get read and which do not. It runs in Google's Consent Mode with every storage permission denied by default. Until you agree on the banner, no cookie is written and no identifier is stored: Google receives an anonymous count of the page view and nothing that can be linked back to you or to your next visit.

If you do agree, Google Analytics sets its own cookies (_ga and _ga_…) which last up to two years and let it recognise your browser across pages and visits. I use this to see aggregate traffic and nothing else. Google Signals, advertising features and data sharing for advertising are all switched off, and I do not use any of it to build a profile of you or to advertise to you. You can change your mind at any time — see section 11.

Fonts are served from this site's own server rather than a third party, so no request about you is made to an external font provider.

The web server keeps standard access logs containing your IP address, the pages requested, timestamps and your browser's user-agent string. These are used only to keep the site running securely and to diagnose faults, and are deleted on a rolling basis.

3. Data you choose to give me

• The contact form. What you type into the form on the Contact page — your name, email address, and optionally a phone number, business name and budget bracket, along with your message — is stored in a database I control on Cloudflare's European infrastructure, and emailed to me. Along with it I record the time, your IP address, your country and your browser's user-agent string, which are used to stop automated spam and for nothing else. If you arrive from a report on youhadonejob.dev, the address of that report and its score travel with your message so I can see what you are asking about; both are already public at that address and neither identifies you. If you used the price estimator on the home page first, what you picked in it and the figure it showed travel with your message too, so that I can answer without asking you to type it all out again — see section 11 for where that is kept.
• The website health check. When you check a website on the health check page, the address you enter, the results, your IP address and your country are stored for 30 days, so that the same site is not checked again within six hours and so that one address cannot run unlimited checks. The checker only reads what that website shows the public. If you then ask for the full report, your name, email address and optional phone number are stored with the results as an enquiry, exactly like the contact form above, and I use them to send you the report and follow up about it. You get one confirmation email, which carries an unsubscribe link.
• The anti-spam check. The contact form and the health check use Cloudflare Turnstile to tell people from bots. It sets no advertising cookie and does not track you across sites. Cloudflare receives your IP address and some technical signals about the browser session in order to score it.
• Email. If you email me, I hold your message and address in order to reply.
• WhatsApp. If you message me on WhatsApp, that conversation is governed by WhatsApp's own privacy terms as well as this one.
• Booking a call. The booking calendar on the Book a call page is provided by Microsoft Outlook Bookings and is embedded from outlook.office.com. When it loads, Microsoft may set its own cookies and receive your IP address. Anything you enter to book (your name, email and any notes) is processed by Microsoft on my behalf and reaches me as a calendar booking.
• Live demos. The demo previews on the Live demos page load pages from watches.sourcecode.es and lux.sourcecode.es, both of which are mine.

4. Why I use it and on what legal basis

• To answer you and quote for work. Steps taken at your request prior to a contract (GDPR Art. 6(1)(b)).
• To deliver services and manage the client relationship. Performance of a contract (Art. 6(1)(b)).
• To keep the site secure and working. Legitimate interests (Art. 6(1)(f)).
• To measure how the site is used. Your consent, given on the banner (Art. 6(1)(a), and Art. 22.2 of the Spanish LSSI for storing the cookie itself). Refusing costs you nothing and withdrawing is one click.
• To meet accounting and tax obligations. Legal obligation (Art. 6(1)(c)).

I do not send marketing email, and there is no newsletter sign-up on this site. The contact form sends one automatic acknowledgement so that you know your message arrived; every one of those carries an unsubscribe link, and using it stops them for good without affecting the reply you are actually waiting for.

5. Who else sees it

Only the providers needed to run the business: my email provider, the booking provider named above, my hosting provider, Cloudflare (which serves and protects the site, stores contact form enquiries, and therefore sees the requests that reach it), Mailgun, which delivers the email the contact form sends, and my accountant for invoicing records. Google Ireland Limited processes the analytics described in section 2, and only if you have agreed to it. I do not sell personal data and I do not share it for advertising.

6. International transfers

The website is hosted within the EU. Some providers, including Microsoft, Cloudflare and Google, may process data outside the European Economic Area under the safeguards permitted by Chapter V of the GDPR, such as Standard Contractual Clauses and the EU-US Data Privacy Framework.

7. How long it is kept

Health check results that are not followed by a request for the full report are deleted after 30 days. Enquiries that do not become projects are kept for up to two years. Client records and anything with an invoice attached are kept for as long as Spanish accounting and tax law requires. Server logs are kept for a short rolling period. Analytics data is retained by Google for 14 months and is aggregated, not tied to a name.

8. Your rights

You can ask for a copy of your data, ask for it to be corrected or deleted, object to or restrict how it is used, or ask for it in a portable format. Email [email protected] and I will deal with it. If you are not satisfied you can complain to the Spanish supervisory authority, the Agencia Española de Protección de Datos (aepd.es).

9. Security

The site is served over HTTPS and kept patched. Every page is a static file, which removes most of the attack surface a conventional content management system carries. The one exception is the contact form: what it collects is held in a database that only I can reach, behind a password, and the credentials it needs to send email are encrypted where they are stored rather than sitting in plain text.

10. Children

This site is aimed at businesses and is not directed at children.

11. Cookies and browser storage

The price estimator on the home page keeps what you picked in your browser's session storage, so that the figure can follow you to the contact form instead of you having to describe it. It never leaves your browser unless you send the form, it holds nothing that identifies you — a package name, any extras ticked, and a total — and it is discarded the moment you close the tab.

Google Analytics' _ga and _ga_… are the only cookies set because I asked for them, and only after you have agreed on the banner. Your answer itself is remembered in your browser's local storage rather than in a cookie, which is why you are not asked again on every page.

Two others can appear without being asked for, because they are strictly necessary and the law does not require consent for that kind: Cloudflare sits in front of this site to keep it up and to filter malicious traffic, and sets cf_clearance to record that your browser passed its security check; and Microsoft sets its own when the booking calendar loads on the Book a call page. Neither is used to track you around the web, and if you never open the Book a call page the Microsoft one never happens.

Withdrawing has to be as easy as agreeing, so it is this button. It turns analytics off immediately and forgets your answer, and the banner will ask you again next time you load a page.

Forget my answer and turn analytics off

12. Changes

If this policy changes, the date at the top changes with it. Material changes will be obvious rather than buried.