Privacy Notice

Who I am

This website is run by Gilmour Stellini, a digital services business providing websites, digital marketing, SEO, branding and related services to clients in Europe and worldwide. For this notice, Gilmour Stellini is the data controller.

For any privacy question or request, contact: gilmourstellini@icloud.com · +356 9947 0206

What I collect

Contact form: your name and email, and if you choose to add them, your business name, phone number, the service you are interested in, your budget range, your preferred contact method and your message.
Review card and table stand orders: the product, design and quantity, your business name, the wording for the card or stand, your Google review link, your name and email, and if you add them, your phone number and notes (for example a delivery address). The request also says whether you added a logo, including the file name, and confirms that the QR code was checked against your review link.
Logo uploads: a logo you add in the product customiser is only used inside your browser to show the preview. The logo file is not sent with the order request. If you would like it printed, I will ask you to send it by email.
Google review links and QR codes: the QR code is created inside your browser. Your review link is only sent to me when you send an order request.
Email, phone and WhatsApp: whatever you choose to include when you contact me directly.
Client project information: contact details, billing details and the content, logins and materials you share so I can deliver your project.
Technical data: when you visit, the hosting provider processes technical information such as your IP address, browser type and the pages requested, so the website can be delivered and protected. This website does not use analytics or advertising trackers.

Why I use it

To reply to your enquiry, prepare a proposal or quote, and handle your order request (steps taken at your request before a contract).
To deliver the services and products you have ordered (performance of a contract).
To send invoices and keep financial records (legal obligation).
To keep the website secure and protect the forms from spam and abuse (legitimate interests).

I do not sell your personal data, and I do not use it for automated decision-making.

Who I share it with

Your information is handled by the following service providers, who process it on my behalf:

Web3Forms (Web3Creative, based in India): receives contact form and order request submissions and emails them to me. Web3Forms states that it hosts its service on Amazon Web Services and uses Cloudflare and Hetzner for some functions. To filter spam, it may pass the IP address and email address of the person submitting a form to the spam-protection services CleanTalk and Akismet.
Cloudflare (Cloudflare, Inc., United States): hosts and delivers this website.
Apple iCloud Mail: my email inbox, where form submissions and emails arrive.
WhatsApp (Meta): only if you choose to contact me on WhatsApp, under WhatsApp's own terms.
For clients: the accounting and invoicing tools I use to run the business.

The fonts used on this website are stored on this website, so loading a page does not send your data to a font provider. Google review pages that customers open from a review card or QR code are run by Google under Google's own privacy policy.

International transfers

Some providers process data outside the European Economic Area, for example Web3Forms in India and Cloudflare in the United States. In those cases the provider relies on safeguards recognised under EU law, such as the European Commission's standard contractual clauses or the EU–US Data Privacy Framework, as described in the provider's own terms.

How long I keep it

Form submissions held by Web3Forms are kept for a maximum of three years and then deleted automatically. I can delete them sooner from my Web3Forms account.
Emails in my inbox are kept for as long as needed to deal with your enquiry or order. Enquiries that do not lead to work are deleted once they are no longer needed.
Client and financial records are kept for as long as needed to provide the service, and for the period required by law.
Technical data processed by Cloudflare is kept under Cloudflare's own policies.

Cookies and browser storage

This website does not set cookies of its own. It stores one small setting in your browser's session storage so that the opening animation only plays once per visit. It contains no personal information and is cleared when you close the tab. Cloudflare may set a strictly necessary security cookie if it needs to check for automated traffic.

The details you type into the contact form, the product customiser and the order form are not saved in your browser. They only exist while the page is open, and the order form's contact details are cleared once your request is sent. Any order details saved by an earlier version of this website are removed automatically when you visit the product page.

If analytics or marketing cookies are ever added, you will be asked for consent first.

Your rights

You have the right to access your personal data, ask for it to be corrected or deleted, restrict or object to its use, and receive a copy in a portable format. Where processing is based on consent, you can withdraw it at any time.

To use any of these rights, email gilmourstellini@icloud.com. You also have the right to complain to your local data protection authority. In Malta this is the Information and Data Protection Commissioner (IDPC), idpc.org.mt.

Security

Every page and form on this website uses an encrypted connection (HTTPS).
Form submissions are sent directly from your browser to Web3Forms over an encrypted connection. This website has no database, so it does not store your submissions.
The forms include spam protection and checks that stop empty or obviously invalid submissions.
I use reputable providers, strong passwords and two-factor authentication, and I only keep the information I need.

Changes to this notice

If this notice changes, the new version will be published on this page with an updated date.