This notice explains what personal information Bloxie collects, why, and what you can do about it. It's written in plain English. If anything isn't clear, ring or email me and I'll explain.
Who we are.
Bloxie is the trading name of SJ Bloxham Ltd, a company registered in England and Wales (company number 13031231). Our registered office is 1 Mead Villa, Hare Street, Buntingford, Hertfordshire SG9 0EA.
For the information in this notice, we're the “controller”: we decide how it's used and we're responsible for looking after it. Bloxie is run by Stuart Bloxham, who handles all privacy questions himself.
- Email: stuart@bloxie.co.uk
- Phone: 07806 615231
- Post: the registered office address above
What we collect and why.
What we hold depends on how you've come across us. We only collect what we need, and we never sell personal information.
| If you… | What we collect | Where it comes from | Why we use it |
|---|---|---|---|
| Send an enquiry or book a call | Name, business name, email, phone, website address, and what you tell us about your business | You, through the form, email, phone or booking link | To reply, give you a quote and arrange calls |
| Ask for a free site check | Your website address, plus your email if you want the report sent | You | To check your site and send you the report |
| Run a business we've contacted | Business name, address, phone, website, public email, Google rating and review count, and company type; sometimes the name of the owner or a director | Public sources: Google Maps, your website, Companies House | To check your website, write you a report, and contact you about our services |
| Open a report we sent you | That the report was opened, and whether book, call or email was clicked, with the date and time | Your report page | To know when to follow up, and to stop if you're not interested |
| Become a client | Contact and billing details, contract details, payments, logins you share with us, and the content for your site | You | To do the work, invoice you, and keep the records the law requires |
| Visit bloxie.co.uk | How many times pages are viewed and which buttons are tapped, counted without cookies and without identifying you | Your browser | To see which pages work and fix the ones that don't |
Use of AI. To write site check reports, we send the publicly visible parts of a business's website (and its public Google rating) to an AI service, which suggests improvements and a score. Stuart reads every report before it's sent. It's only used to decide whether to get in touch; no decision with legal or similar effects is made about you automatically.
Our legal reasons.
Data protection law says we need a lawful reason for each use. These are ours.
| Use | Lawful reason |
|---|---|
| Replying to enquiries and giving quotes | Taking steps you've asked for before a contract |
| Doing the work for clients and invoicing | Performing our contract with you |
| Keeping accounts and tax records | Legal obligation |
| Checking business websites, writing reports and contacting businesses | Legitimate interests (see below) |
| Noting when a report is opened or a button is clicked | Legitimate interests |
| Counting page views without cookies | Legitimate interests |
Our legitimate interests. We're a small local business looking for trades businesses whose websites we could help. We only use business information that's already public, we contact businesses about their business (not their private life), and every message tells you who we are and how to opt out. We think that's a fair balance, but you can object at any time and we'll stop.
How we contact businesses. We only send marketing emails to limited companies and LLPs. Sole traders and partnerships are only contacted by phone or post, and we don't phone numbers registered with the Telephone Preference Service (TPS) or Corporate TPS unless you've told us you're happy to hear from us.
Who we share it with.
We use a small number of trusted services to run the business. They only use your information to provide their service to us, under contracts that require them to keep it safe.
| Service | What it does for us |
|---|---|
| Vercel | Hosts our website and report pages |
| Resend | Sends the emails from our enquiry form |
| Cal.com | Lets you book a call with us. Your booking details are held in the USA |
| Namecheap (Private Email) | Our business email |
| Anthropic | The AI service that helps write site check reports |
| Business listings and page speed checks used in reports | |
| Notion | Where we keep track of who we've contacted, and our opt-out list |
| ntfy | Sends Stuart a phone alert when a report is opened (business name only) |
| Cloudinary | Stores and serves images on our website |
| Our accountant | Keeps our accounts |
We may also share information if the law requires it, or with professional advisers such as a solicitor or accountant, who must keep it confidential.
Direct Debits. Clients' monthly payments are collected by GoCardless. GoCardless is responsible for the payment details it holds as a separate controller, because it has its own legal duties, such as fraud and money-laundering checks. Its privacy notice explains how it uses them: gocardless.com/privacy/payers.
Outside the UK. Some of these services are based in, or store data in, the USA or the EU. Where that happens, we rely on the UK's adequacy rules (including the UK–US data bridge) or the contract terms approved by the Information Commissioner's Office (ICO), so your information stays protected to UK standards.
How long we keep it.
We keep information only as long as we need it, then delete it.
| Information | How long |
|---|---|
| Enquiries that don't go further | 2 years from your last contact with us |
| Site check reports | 2 years if you asked for the check. 12 months from our last contact if we wrote it without being asked. Sooner in either case if you ask |
| Businesses we've contacted who don't reply or aren't interested | 12 months from our last contact |
| Report opens and clicks | 12 months |
| Our opt-out list | For as long as we do outreach. We keep just enough (business name, email or phone) to make sure we never contact you again |
| Client contracts, invoices and payment records | 6 years after the end of the financial year they relate to, as the law requires |
| Client site content and logins | Until our work ends; then we hand everything over and delete our copies, as the contract says |
Page view counts are kept as totals and never identify anyone.
Your rights, and how to stop hearing from us.
To stop marketing, reply “stop” to any email, tell us on the phone, or email stuart@bloxie.co.uk. We'll add you to our opt-out list straight away and won't contact you again. This is free and you don't need to give a reason.
You also have the right to:
- get a copy of the information we hold about you
- have anything wrong corrected
- have your information deleted
- ask us to limit how we use it
- object to us using it, where we rely on legitimate interests
- get information you gave us in a format you can take elsewhere
- withdraw your consent, where we asked for it.
To use any of these, email or ring Stuart. We'll reply within one month, and there's no charge.
Complaints. If you're unhappy with how we've handled your information, please tell us first so we can put it right. You can also complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint or 0303 123 1113.
Our clients' customers.
If you've filled in an enquiry form on a website we look after for one of our clients, that client is in charge of your information, and their privacy notice explains how they use it. We only handle it on their behalf (as their “processor”), to keep the site and form working. Please contact the business directly about it; if you contact us, we'll pass your request on.
To run those sites and forms we use Vercel (hosting), Resend (sending the form emails) and Neon (a backup copy of each enquiry, stored in the UK or EU). For clients who use our AI tools, we also use Anthropic (to draft replies for the business to check), Twilio (text messages) and Meta (WhatsApp messages).
Keeping it safe.
We use secure, reputable services, two-step sign-in on our accounts, and limit access to Stuart only. Report links are private, can't be guessed, and are hidden from search engines.
Changes to this notice.
We'll update this notice when how we use information changes, and change the date at the top. If a change affects you directly, we'll tell you.