Privacy notice
Last updated 5 November 2026
This notice explains what personal information Surface & Core collects, why, who helps us handle it, how long we keep it and the rights you have. We keep it short and only collect what we need to reply to you and do the work you ask for.
Who we are
Surface & Core is the trading name of Jack Gilbert-Johns, a sole trader based in Southampton, UK. Jack is the data controller: the person responsible for your information.
Contact: [email protected]
Post: 43 Thorold Road, Southampton SO18 1HZ, United Kingdom
What we collect
When you send an enquiry through the website
- Your name and email address
- Your company name, if you give one
- What you're interested in, your budget, your timeline and your message
When you email us
Your email address, your message and anything you choose to send with it.
To protect the form from spam and abuse
- Your IP address is used for a moment to limit how many enquiries can be sent from one place. We store only a scrambled, one-way version of it (a "hash"), which can't be turned back into your IP address, and delete it after 7 days.
- Cloudflare Turnstile checks that a person, not a bot, is sending the form. To do this, Cloudflare processes technical information about your browser and device. It doesn't show you puzzles and isn't used for advertising.
We don't use analytics, advertising or tracking tools, and we don't buy or sell personal information.
Why we use it, and our lawful basis
| What we do | Lawful basis (UK GDPR) |
|---|---|
| Reply to your enquiry and prepare a quote | Taking steps you've asked for before a possible contract, and our legitimate interest in answering enquiries |
| Do the work if you become a client, and invoice you | Performing our contract with you |
| Keep accounting records | Legal obligation (UK tax rules) |
| Protect the website and form from spam and abuse | Our legitimate interest in keeping the site secure |
We won't add you to a mailing list or send you marketing because you made an enquiry.
Who helps us handle it
These companies process information for us under contract. They may only use it to provide their service to us.
| Company | What they do for us |
|---|---|
| Cloudflare | Hosts the website, protects it from attacks, runs Turnstile, and stores enquiries in a database located in the European Union |
| Resend | Sends us an email notification of each enquiry, through its sending region in Ireland. Resend is a US company, so some information, such as delivery records, is handled in the United States |
| Google (Google Workspace) | Provides our business email, where enquiry notifications and your emails arrive |
Resend, Cloudflare and Google are US companies, and some of your information may be handled in the United States. Resend and Cloudflare protect transfers from the UK under the UK–US data bridge (the UK Extension to the EU–US Data Privacy Framework) and, where that doesn't apply, the UK's International Data Transfer Addendum to the standard contractual clauses, as set out in their data processing terms. Google protects them under its Cloud Data Processing Addendum. Ask us if you'd like more detail.
How long we keep it
- Enquiries: 12 months from when you send them, then deleted automatically from our database. The email copy in our inbox is deleted on the same schedule. If you become a client, we keep what's needed for the work and our records instead. We may keep an enquiry longer only if we need it to deal with a complaint or legal claim, or because we're still in conversation with you.
- Client and accounting records: as long as UK tax law requires.
- Scrambled IP addresses used to limit spam: 7 days.
- Email delivery logs at Resend: up to 30 days.
- Website error logs at Cloudflare: up to 3 days. They contain a reference number and an error code, not your name, email or message.
Cookies and similar technologies
Our own pages don't set cookies and don't store anything in your browser. There's no cookie banner because there's nothing optional to agree to.
- Cloudflare may set a small security cookie to tell people and bots apart and protect the site. It's strictly necessary for security, so it doesn't need consent.
- Cloudflare Turnstile loads only when you start filling in the enquiry form, to check you're not a bot.
- Concept example pages (the full-screen concept designs linked from our Work page) load fonts from Google Fonts, which means your IP address is sent to Google. One of them, the dog groomer concept, remembers a dog name you type, in your own browser only; it never reaches us.
Your rights
You can ask us to:
- give you a copy of the information we hold about you
- correct it if it's wrong
- delete it
- stop or limit using it, or object to how we use it
- send it to you or another organisation in a common format
Email [email protected]. We'll reply within one month. It's free.
If you're unhappy with how we've handled your information, please tell us first so we can put it right. You can also complain to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint or 0303 123 1113.
Changes to this notice
If we change how we handle personal information, we'll update this page and the date at the top.