Privacy Notice — FIRST LIGHT

1. Who is responsible for your data

FIRST LIGHT is the data controller for everything described in this notice. That means we decide what gets collected and what happens to it, and we are the ones answerable for it.

For anything to do with your data — a question, a correction, a deletion, or any of the rights set out in section 7 — write to [email protected]. It reaches us directly.

We have not appointed a Data Protection Officer, and we are not required to: we are not a public authority, we do not monitor anyone on a large scale, and we do not process special-category data.

2. What we collect

Only what you type into a form, plus the page you submitted it from. We do not buy data about you, and we do not build a profile of you from anywhere else.

The contact form

First and last name: Required. So we know who we are answering.
Email address: Required. The channel we use to reply.
Company: Optional. Only if you are writing on behalf of one.
Telephone number: Optional. Used only if you would rather we called.
Message: Required free text. Whatever you choose to tell us.
Submission metadata: The page URL the form was sent from, and the date and time of submission.

The free-text fields are yours to fill as you like. Please do not put anything in them that falls into the special categories under Article 9 of the GDPR — health or injury details, racial or ethnic origin, religious or political beliefs, sexual orientation, biometric data. We do not ask for any of it, we have no use for it, and we will delete it if it arrives.

Our forms carry a hidden field that only automated submissions fill in. It collects nothing about you.

3. Why we hold it, and on what legal basis

Legitimate interests — Article 6(1)(f). You wrote to us about working together; reading that message and replying to it is what both sides expect, and it does not override your rights or freedoms.

That is the whole purpose. We use what you send to understand what you are asking and to answer it. Nothing else.

4. What we do not do with it

We do not sell your data, and we never will.
We do not share it with third parties for their own marketing, or for any other purpose of theirs.
We do not add you to a newsletter or a marketing list on the strength of a message. If we ever run one, you would have to ask for it separately.
We do not use it for automated decision-making or profiling within the meaning of Article 22. A person reads every message.
We do not publish it, and we do not discuss it outside the people who need to read it to answer it.

5. Who processes it on our behalf

A form submission passes through a small number of service providers who act as processors for us, under contract, on our instructions only. They may not use your data for their own purposes.

Google: Receives and stores every form submission (Apps Script and Sheets), and delivers the internal notification telling us a message has arrived (Gmail). This is where your message actually lives.
Cloudflare: Hosts and delivers this website. It sees the technical request data any web server sees — IP address, browser, page requested. It does not receive form contents: submissions go from your browser straight to Google without passing through it.

We use no advertising trackers, no analytics cookies, and no third-party embeds that profile you. The typefaces are served from this site rather than from a font network, so simply reading this page sends your IP address to nobody but our host.

Transfers outside the UK and EEA

Both providers above are US-headquartered and may process data outside the UK and EEA. Where that happens, the transfer is covered by the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, and both providers self-certify under the EU–US and UK–US Data Privacy Framework. You can ask us for details of the safeguards that apply to your data.

We will disclose data to a public authority only where the law requires it of us.

6. How long we keep it

Enquiries that go no further: Kept for 12 months from the last contact, then deleted. Careers in this sport move; a message that was early in March can be right in December, and we would rather recognise you than start from nothing.
Enquiries that become an engagement: Kept for the length of the engagement, and for 6 years after it ends, which is the period we are required to keep contract and accounting records for.

Deletion means deletion from our live systems. Backups roll off on their own schedule and are not searched or used for any other purpose in the meantime.

7. Your rights

Under the GDPR you have the following rights over your data. Exercising any of them costs nothing, and we will answer within one month.

Access — a copy of everything we hold about you, and confirmation of what we do with it (Article 15).
Rectification — correction of anything inaccurate or incomplete (Article 16).
Erasure — deletion of what we hold, where we have no overriding reason to keep it (Article 17).
Restriction — a freeze on our use of it while a dispute about accuracy or grounds is settled (Article 18).
Portability — the data you gave us, in a structured, machine-readable format, sent to you or to someone you name (Article 20).
Objection — you can object to our processing on legitimate interests at any time, and we stop unless we can show compelling grounds that override your interests (Article 21).

Write to [email protected]. We may ask you to confirm who you are before we act, so that nobody else can use these rights against you.

Complaints

If you think we have handled your data badly, tell us first — we would rather fix it. You do not have to, though. You can complain directly to a supervisory authority: in the UK, the Information Commissioner's Office (ico.org.uk); in the EU, the data protection authority of the country you live or work in, or where the issue arose.

8. Changes to this notice

If we change how we handle what you send us, this notice changes with it and the date at the top moves. Material changes affecting data we already hold are sent to the email address you gave us.