Privacy Policy

Last updated: 01/05/2026

Who we are

This website is operated by Douglas Watt, trading as dponesto (“dponesto”, “we”, “us”, “I”). dponesto provides outsourced Data Protection Officer (DPO) and data protection advisory services to small and medium-sized businesses.

I take the privacy of everyone who visits this site, makes an enquiry, or becomes a client seriously — and because data protection is what I do for a living, I’ve tried to write this policy the way I’d want one written for you: in plain English, with no hidden meaning.

For the personal data described in this policy, I am the data controller. That means I decide what data is collected and why.

My details:

Trading name: dponesto
Sole trader: Douglas Watt
Address: 317 Worsley Road, Swinton, Manchester, M27 0AS
Email: dougie@dponesto.co.uk
Phone:07860 269603
ICO registration number: ZC174709

As a sole trader, I act as my own data protection contact. If you have any question about how I handle your data, you can reach me directly using the details above.

What this policy covers (and what it doesn’t)

This policy explains how I handle the personal data of:

visitors to this website,
people who contact me or make an enquiry, and
my clients and their staff, in the course of running my business.

An important distinction. When I deliver DPO or advisory services to a client, I often handle personal data on that client’s behalf — for example when reviewing their records, investigating a data breach, or responding to a subject access request. In those situations the client is the controller and I act as their processor. That processing is governed by the data processing agreement and contract I have with that client, and by their privacy notice — not by this policy. This policy only covers the data I control as a business in my own right.

The personal data I collect

Depending on how you interact with me, I may collect:

When you visit this website

Technical data such as your IP address, browser type, device information, and how you use the site, collected through cookies and analytics (see the Cookies section below).

When you make an enquiry or contact me

Your name, email address, phone number, business name, and the contents of your message or enquiry.

When you become a client

Contact and identity details for you and relevant members of your team.
Information needed to deliver and administer the service, including engagement details, correspondence, and notes.
Billing and payment information, such as invoicing details and bank or payment references.

When you’re a supplier or professional contact

Your name, business contact details, and records of our dealings.

I don’t deliberately collect more than I need, and I don’t ask for special category data (such as health or other sensitive information) about website visitors or enquirers as part of running this business.

How I collect your data

I collect personal data:

Directly from you — when you fill in a form, email me, call me, or engage me as a client.
Automatically — through cookies and analytics when you use this website.
From third parties or public sources — occasionally, for example business contact details from a referrer, a public register, or a professional networking platform.

Why I process your data, and my lawful basis

Under UK GDPR I must have a lawful basis for using your personal data. Here’s what I do and why.

What I do	Why	Lawful basis
Respond to your enquiry or message	To answer your question and discuss whether I can help	Legitimate interests (responding to a request you’ve made)
Provide and administer my services	To deliver the work you’ve engaged me for	Contract
Send invoices and manage payment	To get paid and keep proper financial records	Contract / Legal obligation
Keep business and tax records	To meet my legal and accounting obligations	Legal obligation
Improve and secure this website	To keep the site working, safe and useful	Legitimate interests
Send occasional updates or marketing (where relevant)	To keep you informed about services that may interest you	Consent, or legitimate interests for existing clients

Where I rely on legitimate interests, I’ve considered whether my interest is fair to you and doesn’t override your rights. Where I rely on consent (for example, marketing emails), you can withdraw it at any time — every marketing email includes an unsubscribe option, or you can simply email me.

Who I share your data with

I don’t sell your data, and I never will. I share it only where necessary to run my business, and only with parties who are required to keep it secure. These may include:

IT, website and hosting providers who help me run this site and my systems.
Email and productivity providers I use to communicate and store records.
Payment and accounting providers who handle invoicing and bookkeeping.
Professional advisers such as my accountant or insurer, where reasonably required.
Authorities or regulators, where I’m legally required to disclose information.

The main suppliers I currently use include: 123 reg, WordPress and Microsoft. Where these act as my processors, I have appropriate contracts or licences in place requiring them to protect your data.

Sending data outside the UK

Some of my suppliers may store or process data outside the UK. Where that happens, I make sure the transfer is protected by an appropriate safeguard recognised under UK data protection law — such as an adequacy decision, the International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses. If you’d like details of the safeguards in place for a specific transfer, just ask.

How long I keep your data

I keep personal data only for as long as I need it:

Enquiries that don’t become work: kept for a reasonable period in case you come back to me, then deleted — typically no longer than [e.g. 12 months].
Client records: kept for the duration of our engagement and then for a period afterwards to meet legal, tax and professional obligations — typically [e.g. 6 years] from the end of our relationship.
Financial records: kept for the period required by tax law (generally 6 years).
Website analytics: retained in line with the settings of the tools described in the Cookies section.

When I no longer need your data, I delete or securely destroy it.

How I keep your data secure

I take appropriate technical and organisational measures to protect your data against loss, misuse, and unauthorised access — including access controls, secure systems, and only keeping what I need. No method of transmission over the internet is ever completely secure, but I take security seriously and keep my measures under review. (Given what I do, I’d find it hard to face you otherwise.)

Cookies

This website uses cookies and similar technologies to make the site work and to understand how it’s used.

Essential cookies keep the site functioning and don’t need your consent.
Analytics and other non-essential cookies are only used where you’ve given consent through the cookie banner.

You can change or withdraw your cookie preferences at any time using [the cookie settings link / your browser settings], and you can block cookies in your browser, though some parts of the site may not work as well.

[Note to self: align this section with your actual cookie consent tool and a cookie scan. If you use analytics or any marketing tags, list them here or in a separate Cookie Policy.]

Your rights

Under UK data protection law you have the right to:

Be informed about how your data is used (that’s what this policy is for).
Access the personal data I hold about you.
Rectification — to have inaccurate data corrected.
Erasure — to ask me to delete your data, in certain circumstances.
Restrict processing — to ask me to limit how I use your data, in certain circumstances.
Data portability — to receive certain data in a portable format.
Object to processing based on legitimate interests, and to direct marketing at any time.
Withdraw consent at any time, where I rely on it.

To exercise any of these rights, just email me at dougie@dponesto.co.uk I’ll respond within one month, and I won’t charge you in most cases. I may need to confirm your identity first, to protect your data.

Complaints

If you’re unhappy with how I’ve handled your personal data, please contact me first — I’d genuinely rather put it right. You also have the right to complain to the UK’s data protection regulator:

Information Commissioner’s Office (ICO) Website: ico.org.uk Helpline: 0303 123 1113

Changes to this policy

I may update this policy from time to time to reflect changes in how I work or in the law. When I do, I’ll update the “Last updated” date at the top. If the changes are significant, I’ll take reasonable steps to let affected people know.

This policy is written to be clear and honest. If anything in it is unclear, or you’d like more detail about any part, please get in touch.