Cotswold Creative
Privacy & cookies
How I use and look after your information when you visit this website or get in touch.
Last updated: 14 October 2026
I use the information you provide to reply to your enquiry and discuss any work you’d like me to do. Your details are processed by the hosting and email providers I use to receive and manage enquiries. I don’t sell your personal information or share it with other businesses for their marketing. Sending a message won’t add you to a mailing list.
You can change your website privacy choices at any time using the link in the footer.
Who looks after your information
I’m Mark Purches, trading as Cotswold Creative, an independent design studio in Worcester, UK. I’m responsible for how your personal information is used (the “data controller”). This notice covers website visits and enquiries. If I handle personal information as part of your project, we may also need a separate agreement.
Use the contact form or email me about privacy. You can use email if you would prefer not to complete the form’s security check.
When you get in touch
When you contact me, I receive your name, email address and the information you choose to share. This might include your business name, website, project requirements, budget or availability. Please share only what is relevant, avoid passwords and sensitive personal information, and make sure you are entitled to share anyone else’s details.
I use these details to understand your request, reply, arrange a conversation or prepare a proposal. If you ask me about a project, this may involve taking steps towards a contract or fulfilling one. For other enquiries, I rely on my legitimate interest in responding to people and running the studio. I may also need to keep relevant records to meet legal obligations.
Contacting me is optional. Required fields are marked; I need those details to receive your message and reply. Messages pass through the website’s email delivery service to my business inbox. These providers deliver and store the correspondence; the website does not keep a separate copy of new enquiries.
I do not use your enquiry for advertising. Website statistics may record that a form was submitted, but the site’s analytics code does not send your name, email address, message or other form answers to analytics services.
Keeping the site working
The website host keeps access and security logs containing technical details such as IP addresses, request times, browser information and pages requested. These help deliver the website, diagnose problems and prevent abuse. My lawful basis is my legitimate interest in keeping the website secure and reliable.
Cloudflare Turnstile checks the form and WhatsApp link for spam. It uses signals such as your IP address and browser and device information to assess whether a request is automated. The verification widget does not receive your enquiry text. Cloudflare also uses these signals to improve its bot detection; see its Turnstile privacy notice. You can email me if you prefer not to use this check.
Cookies and your choices
Cookies are small files stored by your browser. The controls below let you choose whether to allow anonymous website counts, Google Analytics and custom fonts. Essential features stay on. You can browse the work and make an enquiry without agreeing to analytics.
Essential features
The cch_privacy_v1 cookie remembers your choices for 180 days. It stores your settings, not a visitor identifier. Security checks and temporary request limits help prevent spam and abuse. These essential features support the services you ask to use and are not used for advertising.
Anonymous website totals
This website keeps aggregate totals for up to one year: page views, portfolio pieces opened, contact actions, saved privacy choices, section and scroll milestones, active-time milestones and broad error categories. Each action or portfolio piece is counted at most once per page view. Page views are also counted separately by referral category, device, browser and operating-system family, grouped screen and viewport sizes, UK time-of-day band and weekday. These separate totals are not linked into visitor profiles or journeys. They do not tell me how many different people visited.
The browser reduces referral and device information to broad categories before sending it. The counters immediately add to combined totals; they do not retain full referring URLs, search terms, exact screen dimensions, full browser identifiers, form answers, individual event records or IP addresses in reports. These counts help me understand which parts of the website are useful and are used only to improve it. They are on by default under the UK statistical-purpose exception; my lawful basis is legitimate interests. Switch “Anonymous counts” off at any time to stop collection for your browser, including privacy-choice counts. Existing combined totals cannot be traced back to you. To prevent abuse, the counter temporarily uses a protected version of your network address. This expires after one minute and is not included in the reports.
Optional Google Analytics 4 (GA4)
Google Analytics loads only if you allow it. It uses cookie identifiers and browser, device and referral information to measure visits, how people find the site and actions such as viewing work or starting an enquiry. Google receives this usage information, but the site’s analytics code does not send your form answers or contact details. Advertising features and Google Signals are disabled. My lawful basis is your consent; agreeing is optional.
The _ga and _ga_… cookies distinguish browsers and keep track of visits. This website limits them to 180 days without automatic renewal. Switching Google Analytics off stops further measurement and removes its cookies from this site. It does not delete records already collected by Google; contact me about those. Google’s information for visitors to partner sites explains its processing. I use Google’s shortest retention setting of two months for detailed user and event data, with deletion processed monthly. Aggregated reports may be retained for longer.
Custom fonts
Adobe Fonts supplies the typefaces. Adobe receives your IP address to deliver the font files and says it does not store that address or set cookies for font delivery. It also receives technical information about font use and this website. See Adobe’s font privacy information. This supports my legitimate interest in presenting the studio’s work consistently. Custom fonts are on by default under the appearance exception; you can switch them off in “Privacy choices” to use your device’s fonts instead.
Your choices apply to this browser. You may see the notice again after clearing cookies, changing browsers or when your choice expires. If JavaScript is disabled, the site uses your device’s fonts and does not run website analytics. The enquiry form and protected WhatsApp link may need JavaScript to work.
Google Search reporting
Google Search Console shows how this website appears in Google Search, including impressions, clicks and the search terms Google makes available. These are combined reports, not a list of identifiable visitors. Some search terms are withheld to protect people’s privacy.
Search Console measures activity on Google Search and does not place a tracking cookie or script on this website. Declining Google Analytics here does not remove a search click from Search Console. See Google’s explanation of Search Console data.
Who helps process your information
I use providers for website hosting and backups, business email, email delivery, security, fonts and optional analytics. They process information needed to provide those services. I may also share relevant information with professional advisers or authorities where necessary to meet a legal obligation or deal with a claim.
Some providers process information outside the UK, including in the United States. The safeguards for a transfer depend on the provider and destination. These may include a UK adequacy decision, which recognises a suitable level of protection, or approved contractual safeguards such as standard clauses with the UK Addendum. Contact me for details and a copy of the safeguards that apply to your information.
If you follow a WhatsApp or social profile link, the destination service’s privacy notice applies to what you do there. This website uses ordinary social links, not embedded social feeds.
How long information is kept
I keep enquiry correspondence for as long as it is needed to respond, follow up or manage an ongoing client relationship. How long depends on whether the enquiry is still active, whether I need a record of agreed work, legal record-keeping requirements and any unresolved dispute. Backup copies follow the provider’s backup retention cycle.
Hosting, email and security providers also keep operational records under their own retention arrangements. The cookie and website-statistics periods are explained above. You can contact me to ask how long a particular record is kept or request its deletion.
Your rights
Depending on the circumstances, you can ask to access, correct or delete your personal information, limit its use, or receive information you supplied in a portable format. You can withdraw consent for Google Analytics through “Privacy choices” at any time. This does not affect processing that was lawful before you withdrew consent. Contact me if you want to request deletion of earlier analytics records.
Your right to object: you can object to processing based on legitimate interests, including anonymous website statistics. Switch “Anonymous counts” off in the privacy controls to stop those counts for your browser, or contact me about other processing.
I respond to rights requests as soon as possible, normally within one month. I may need information to confirm your identity or clarify your request. If an extension is allowed, I’ll explain why and when you can expect a response. Requests are normally free. I do not use your enquiry to make automated decisions with legal or similarly significant effects.
If you are concerned about how I handle your information, please get in touch. You can also complain to the Information Commissioner’s Office, the UK’s data protection regulator, or call 0303 123 1113.
Updates to this notice
I’ll update this page when the site or the way I handle information changes. The date at the top shows when it was last revised.