Your details, handled properly.

Who is responsible for your information?

Shaun Clayton, trading as BYOP, is the controller of the personal information described in this notice. BYOP is based in Rotherham, South Yorkshire, United Kingdom.

You can contact me at shaun@byop.digital or through the BYOP contact page.

What information I collect

The information I collect depends on how you interact with BYOP. It may include:

• Contact and business details, such as your name, email address, telephone number, organisation and role.
• Enquiry and brief information, including your goals, audience, budget range, timescales, existing website and systems, preferences, answers to form questions, and files you choose to upload.
• Client and project records, such as proposals, agreements, project communications, approvals, feedback, invoices and payment status. I do not receive your full card details when a payment provider handles a transaction.
• Mailing list information, such as your email address, sign-up source, consent status and engagement with emails.
• Website and device information, such as your IP address, browser and device type, pages viewed, referring page, cookie choices, security events and approximate location derived from an IP address.
• Messages you send by email, website form, live chat, video call or another agreed channel.

I usually collect this information directly from you. Some technical information is created when you use the website, and a referrer or colleague may occasionally provide your business contact details when making an introduction.

How and why I use your information

UK data protection law requires me to have a lawful basis for each use of personal information.

Where I rely on legitimate interests, I consider whether the use is necessary and balance it against your rights and reasonable expectations. You can object to this processing. See Your rights below.

How I use AI-assisted tools

BYOP uses practical AI assistance as part of some discovery, planning and delivery work. For example, I may use Claude, provided by Anthropic, to organise answers from a design brief, identify gaps, summarise project needs and help prepare a first draft of proposal content.

I only share information that is reasonably needed for that task, use the privacy controls and business terms available for the service, and review the output myself before it is used. AI can assist my work, but it does not make a solely automated decision about you that has legal or similarly significant effects.

The lawful basis is normally taking steps at your request before a contract and my legitimate interests in preparing clear, relevant work efficiently. If you have a concern about AI-assisted processing of your brief, email me before submitting it or as soon as possible afterwards.

Cookies and tools used on the site

Cookies and similar technologies help the site work, remember choices, protect forms and, where you agree, show me how people use the site.

• Necessary cookies support core site functions, security and your privacy choices. They do not need consent.
• Analytics cookies may be used through Google Analytics and Google Site Kit to understand visits and improve the site. They are optional.
• Form protection uses Google reCAPTCHA to reduce spam and abuse.
• Live chat is provided through Tidio. If you use it, Tidio processes the information needed to deliver the conversation.
• CookieYes records and applies your cookie choices.

You can accept, reject or customise non-essential cookies in the cookie banner, and reopen the controls using Cookie Preferences in the footer. Blocking some optional tools may affect features such as live chat, but the main site will still work.

Who I share information with

I share personal information only when it is needed to run BYOP, provide the service, protect legal rights or meet a legal obligation. Current service categories and examples include:

I may also share limited information with accountants, legal or other professional advisers, insurers, payment providers, regulators, courts or law enforcement where genuinely necessary. I do not sell or rent your personal information.

Adding an enquiry to a contact-management service does not mean you have agreed to marketing. I only send optional marketing when I have an appropriate permission or another lawful route to do so, and every marketing email includes an unsubscribe option.

International transfers

Some service providers may process information outside the United Kingdom. When UK data protection law treats this as a restricted transfer, I rely on an applicable UK adequacy regulation or approved contractual safeguards, such as the UK International Data Transfer Agreement or the UK Addendum, together with any additional measures that are appropriate.

You can contact me if you would like more information about the safeguard relevant to a particular service.

How long I keep information

I keep information only for as long as it is reasonably needed for the purpose described above, including legal, accounting and security needs. My usual approach is:

• Enquiries and briefs that do not become client work: normally up to 24 months after the last meaningful contact, unless a shorter or longer period is justified.
• Client, contract, invoice and core project records: normally six years after the client relationship or relevant transaction ends, reflecting tax, accounting and legal claim requirements.
• Mailing list records: until you unsubscribe or withdraw consent. I may retain a minimal suppression record so I do not accidentally contact you again.
• Technical, security, analytics and chat records: according to the purpose, settings and retention controls of the relevant service, reviewed so they are not kept longer than necessary.

Deleted information may remain in encrypted or access-controlled backups for a limited period until those backups are overwritten in the normal rotation.

Your UK data protection rights

Depending on the circumstances, you can ask me to:

• give you a copy of your personal information;
• correct information that is inaccurate or incomplete;
• delete your information;
• restrict how it is used;
• provide certain information in a portable format;
• stop processing based on legitimate interests, including an objection to direct marketing; or
• recognise your withdrawal of consent, without affecting earlier lawful use.

These rights are not absolute in every situation. I may need to verify your identity, and I will normally respond within one month. There is usually no charge.

Keeping information secure

I use proportionate technical and organisational measures to protect personal information, including access controls, secure connections, system updates, backups and limiting access to the services needed for BYOP work. No online service can guarantee absolute security, so please use an appropriate channel and avoid sending unnecessary sensitive information.

Children

BYOP provides business services and is not directed at children. I do not knowingly collect personal information from children through the website or client brief forms.

Changes to this notice

I review this notice when the law, my services or the tools I use change. The latest version will always be published at this address, with the updated date shown at the top.