Who is responsible for your information?
Daniel Palfi is responsible for personal information I use to manage website enquiries, client projects, invoices and payments.
If you have a privacy question or want to exercise your data protection rights, email hello@danielpalfi.com.
Daniel Palfi is registered with the Information Commissioner’s Office (ICO) as a data controller. Registration reference: ZC249392.
What information do I collect?
If you contact me through Daniel Palfi Forms, email or a previous Typeform, I may collect:
- your name;
- your email address;
- your business or organisation name, if provided;
- what you are looking for help with;
- details you provide about your project, problem or requirements;
- your budget range and preferred timeframe, if you choose to provide them.
I may also receive limited technical information needed to deliver and secure the website, such as IP address, browser or device information and request logs.
Why do I use your information?
I use the information you provide to:
- respond to your enquiry;
- understand what you are trying to achieve;
- discuss potential work and provide a quote where relevant;
- manage follow-up conversations;
- protect the website and services from misuse or security threats.
I do not sell your personal information, and I do not use enquiry information for unrelated marketing unless you have separately agreed to that.
My lawful basis for using your information
Where you contact me about potential work, I generally process your information because it is necessary to take steps at your request before entering into a contract, for example to discuss a project or provide a quote.
I may also rely on legitimate interests where necessary to manage genuine business enquiries, keep appropriate records, maintain website security and operate my services efficiently, provided those interests do not override your rights and freedoms.
For optional website analytics and advertising measurement, I rely on your consent. You can choose website analytics, Google advertising measurement and Meta advertising measurement separately, reject all, or change your choices at any time using Cookie settings in the footer.
Who processes your information?
I use trusted service providers to operate this website and contact process. These include:
- Typeform — for responses collected through my previous Typeform enquiry form;
- Cloudflare — to host, deliver and protect the website and Daniel Palfi Forms, verify submissions with Turnstile and store enquiry submissions in a D1 database restricted to the European Union. New submissions are stored here before being mirrored to Google Sheets, so a temporary connection failure does not lose the enquiry;
- Google — to store and organise enquiries in Google Sheets, run the enquiry workflow through Google Apps Script, and manage internal notifications, correspondence and unsent response drafts through Gmail. Google also provides optional website analytics and Google Ads measurement through Google Analytics 4 and Google Tag Manager, according to your separate consent choices;
- Meta — provides optional Facebook and Instagram advertising measurement through the Meta Pixel, only with your separate Meta consent. See Meta’s Privacy Policy;
- OpenAI — to process selected enquiry information through its API for the AI-assisted assessment and draft preparation described below.
These providers may use their own subprocessors. Some processing may take place outside the UK. Where international transfers occur, the relevant provider is responsible for using appropriate safeguards under applicable data protection law.
Invoices and payments
I use Stripe to process payments through hosted invoices and payment pages. Relevant information may include your name, email, billing details, the service purchased and payment status. Card details are entered directly into Stripe’s payment interface; I do not receive your full card number or security code.
I use billing and transaction records to fulfil our contract, reconcile payments, handle refunds or disputes, and meet accounting and legal obligations. Records are retained for the applicable legal period and longer only where necessary, for example for an unresolved dispute.
Stripe processes information to provide payment services and also for its own purposes, including fraud prevention and legal compliance. Its role depends on the processing involved. Stripe may process information outside the UK using applicable transfer safeguards. See Stripe’s Privacy Policy for details.
Automatic saving of payment methods for my one-off invoices is disabled. Any future recurring-payment arrangement will explain the charges and payment authorisation separately.
Cookies, analytics and similar technologies
You can choose Website analytics, Google advertising measurement and Meta advertising measurement separately, accept all, or reject all. Optional choices are off for new visitors. Previous Google consent does not enable Meta tracking; Meta requires a new, separate choice.
Your preferences are stored locally on your device to remember your choices. You can change them using Cookie settings in the footer. You can use the website and submit an enquiry without accepting optional measurement.
Website analytics: Google Analytics 4 (GA4), managed through Google Tag Manager (GTM), helps me understand page visits, traffic sources and customer journeys. With this consent, I measure service and enquiry link clicks, form opens and starts, and successful enquiry submissions.
Google advertising measurement: with your separate permission, Google can use advertising cookies, ad-click identifiers and website interaction and successful enquiry information to connect Google Ads clicks to enquiries and measure campaign performance. GA4 and GTM are used to support this measurement. When advertising measurement is accepted but website analytics is rejected, analytics cookies remain disabled; Google measurement may still process limited page and interaction information without analytics cookies for advertising measurement.
Google may process page URLs, referring pages, browser and device information, interaction data and approximate location. Form answers, names, email addresses and submission identifiers are not included in the measurement events. I do not use this setup for personalised advertising, remarketing or enhanced conversions using customer contact details. Personalised advertising consent remains denied.
Google measurement tags stay blocked when both Google options are rejected, including when only Meta measurement is accepted. Withdrawing a choice updates Google consent settings and removes the relevant first-party measurement cookies where accessible.
Daniel Palfi Forms uses Cloudflare Turnstile to protect against spam. Turnstile processes security and browser information to verify a genuine submission. Optional analytics and advertising measurement continue to follow your separate website consent choices; form answers and contact details are not included in measurement events. You can submit an enquiry without accepting optional measurement. See Cloudflare’s Privacy Policy for information about its processing.
Meta advertising measurement: with your permission, the Meta Pixel sends page visits, key service views, email/phone/WhatsApp link clicks and successful enquiry submissions to Meta to measure results and optimise Facebook and Instagram campaigns. A contact click does not prove a message was sent. Meta can receive the page URL, referrer, browser/device and network information and use cookies such as _fbp (normally up to three months) and _fbc where applicable. Meta may associate this activity with your Meta account. No enquiry answers, names, email addresses, telephone numbers or submission identifiers are included in the configured event parameters. Automatic advanced matching and automatic event detection are not used. This setup does not currently use Conversions API or send payment events.
The Meta script and events remain blocked until Meta consent is granted. Withdrawing Meta consent stops future events, removes accessible Meta first-party cookies and reloads the page. Previously sent events cannot be recalled by withdrawing consent. Consent choices are stored in dp_measurement_consent_v3 on your device until changed or cleared. Meta may process data outside the UK using the safeguards described in its privacy policy.
If I materially change the analytics, advertising or tracking technologies used on this site, I will update this notice and the consent controls as appropriate.
How long do I keep your information?
If an enquiry does not lead to paid work, I normally keep the enquiry and related correspondence for up to 12 months so I can manage follow-up and understand previous conversations.
If you become a client, relevant project, contractual and financial records may be kept for longer where reasonably necessary to deliver the work, resolve queries or meet legal and accounting obligations.
I may delete information earlier where it is no longer needed.
AI-assisted processing and automated decision-making
I use the OpenAI API to help process enquiries. Selected information about your business, requirements, budget and timeframe may be sent to OpenAI to prepare an enquiry summary, provisional service recommendation, potential concerns and a suggested response.
Contact details and private CRM notes are excluded from the AI assessment inputs. However, information you include in free-text answers may still identify you or another person. Please avoid including sensitive personal information or confidential details that are not needed to explain your enquiry.
I do not make decisions about you with legal or similarly significant effects solely through automated processing. You can contact hello@danielpalfi.com to ask about the use of AI in your enquiry, correct information or request human review.
Your data protection rights
Depending on the circumstances, you may have rights to:
- ask for a copy of the personal information I hold about you;
- ask for inaccurate information to be corrected;
- ask for information to be deleted;
- ask for processing to be restricted;
- object to certain processing;
- receive certain information in a portable format.
To make a request, email hello@danielpalfi.com.
Complaints
If you have a concern about how I use your information, please contact me first so I can try to resolve it.
You also have the right to complain to the UK Information Commissioner's Office (ICO). You can find information about raising a concern at ico.org.uk.
Changes to this notice
I may update this notice as the website, services or tools I use change. The latest version will always be available on this page.