Privacy notice
I am a one-person web development business. I hold very little personal data, I have never sold or shared any of it, and if you would like me to delete what I hold about you, email me and I will — no reason needed, no reply required from you afterwards.
If you are here because I emailed you, the section If I have emailed you is the one that answers your question: where I got your details.
Last updated 18 August 2026
Who I am
Max Palmer, a sole trader trading as Sites by Max. I am the data controller for everything described here.
Max Palmer
68 Dragon Avenue, Harrogate, HG1 5DT
[email protected]
This website
This site sets no cookies and runs no analytics, no advertising tags and no session recording. There is no tracking script of any kind on the page you are reading. That is not a policy statement, it is checkable: open your browser's developer tools, look at Application → Cookies and at the Network tab, and you will find nothing going anywhere.
Visitor numbers come from my hosting provider's server-side logs (Cloudflare), which count requests without placing anything on your device or identifying you.
If I have emailed you
I write to UK businesses — private clinics, law firms, flight schools — about problems I have found on their public websites, usually advertising trackers that run before a visitor has answered the cookie banner.
Your details did not come from you. UK GDPR says I have to tell you where they did come from, so here is the whole list.
| What I hold | Where it came from |
|---|---|
| Business name, website address, business phone and postal address | A public statutory register — the Care Quality Commission register of registered providers, the Solicitors Regulation Authority register of regulated firms, or the Civil Aviation Authority's published lists |
| A business email address | The contact page of your own website, or the same public register |
| The name of a director or named principal, so I can address you as a person | Companies House, or the "our team" page of your own website |
| Company number and registered status | Companies House |
| Technical findings about your website | My own scan of your public pages — see below |
| Our correspondence, if you reply | You |
That is the complete list. I do not buy lists, I do not use a data broker, and I do not guess email addresses.
Why I am allowed to do this
My lawful basis is legitimate interests under Article 6(1)(f) UK GDPR: contacting a business about a defect on its own public website is something a reasonable business owner would expect to be told about, and it uses the minimum data needed to do it. Under PECR I only send unsolicited email to corporate subscribers — limited companies and LLPs.
Sole practitioners and ordinary partnerships count as individual subscribers, so they never go on an email list. If I make first contact with one at all it is through the enquiry form the business publishes on its own website, which is what that form is for, and nothing else follows unless you reply to me.
I do not process any special category data about you, and my scan does not collect anything about the people who visit your site.
How long I keep it
Business contact details and scan results are deleted within twelve months if we never speak. If we do business, records are kept for six years, which is what HMRC requires.
If you ask me not to contact you again I keep one line — your domain and email address — on a suppression list indefinitely. That sounds contradictory and it is not: it is the only way to guarantee I never write to you again by accident. You can ask me to delete that too, and I will.
Who else sees it
Nobody. It is not sold, rented, shared or published. Two suppliers process it in the ordinary course of my running a business: Google Workspace hosts my email, and Cloudflare hosts this website. Neither gets a list from me and neither uses your data for its own purposes.
How the website scan works
This is the question I would want answered first, so here it is plainly. To find out what a site sends to advertising networks, I load its public pages in an ordinary browser and record which third parties it contacts and which files it stores on the device.
- Only pages any visitor can reach. Nothing behind a login.
- Nothing is submitted — no forms, no bookings, no enquiries.
- No account is used and no password is ever involved.
- Nothing is altered on your site, and nothing could be.
- It is a browser visiting a website. It has the same access you gave the last person who read your homepage.
What I record is a list of tracker names, cookie names and page addresses on your own site. I never see, collect or store anything about your patients, clients or visitors, and the browser I use is empty every time.
Preview sites
For flight schools I sometimes build an unpaid preview of a redesigned website. Previews are private and unlisted, marked as unofficial mock-ups, not affiliated with the business shown, and deleted on request. Any images or text of yours used in one are removed with it.
Your rights
You can ask me for a copy of what I hold, ask me to correct it, ask me to delete it, or object to my using it at all. There is no form and no process. Email me and say so.
To stop hearing from me: reply "no" to any email, or write to [email protected]. You do not need to give a reason and you will not get a follow-up asking why.
I aim to answer within a few days and I have to answer within one month.
If you are not happy with how I have handled it you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. You are entitled to go straight to them, though I would rather have the chance to put it right first.