Privacy notice
Pending legal review. This notice describes exactly what the site does today, but it has not yet been checked by a lawyer. Remove this box once it has.
The short version: this website collects nothing about you. There is no contact form, no cookies, no analytics, no advertising and no tracking of any kind. If you want to reach me you send an email, and then I hold your email the way anyone holds an email.
Who is responsible
Derick TW, Kampala, Uganda. is the data controller for this site.
For anything on this page, write to privacy@dericktw.online.
What is collected, and why
By the website: nothing
There is no form on this site to fill in, so there is nothing for the site to collect. Opening a page, reading it and leaving it creates no record here, sets nothing on your device, and tells no third party you visited.
If you email me
The contact links open your own email program. When you send a message, I receive what any email contains: your address, your name if your mail client sends one, and whatever you wrote. I use it to answer you and to carry out any work we agree on — nothing else. Your address is never added to a mailing list, because there is no mailing list.
Lawful basis: legitimate interest in replying to correspondence you chose to start (UK/EU GDPR Art. 6(1)(f)), and performance of a contract once there is one.
Server logs
The hosting provider keeps standard web-server logs, which include IP addresses, for security and troubleshooting. These are the hosting provider's logs, not mine, and are governed by their retention policy. [TBD: retention period — confirm with Hostinger]
What is not collected
- No cookies. This site sets none at all. See the cookie notice for the detail.
- No analytics. There is no Google Analytics, no Plausible, no Matomo, no pixel, no heatmap.
- No forms and no accounts. There is nothing to submit and nothing to sign up for, so there is no profile, no password and no login history.
- No newsletter or mailing list. Emailing me does not subscribe you to anything. You will only ever get a direct reply.
- No advertising, no profiling, no automated decision-making, and nothing is sold or shared for anyone else's marketing. Under the CCPA/CPRA: personal information is not sold or shared.
Who else sees your data
- Hostinger hosts the website and runs the mailbox my address points at, so they handle any email you send me. They act as a processor on my instructions.
-
Google / YouTube — only in connection with videos.
Video thumbnails are stored on this server, so simply opening a page sends
nothing to Google. If you click play, the player is loaded from
youtube-nocookie.comand at that point Google receives your IP address and device details, under Google's privacy policy (opens in a new tab). That is your choice to make, one video at a time.
Nobody else. No advertising networks, no data brokers, no CRM, no chat widget.
Where your data goes
The server is operated by Hostinger and any email you send me is stored in a mailbox there. This may involve a transfer outside Uganda, the UK and the EEA. [TBD: hosting region and transfer safeguard — confirm with Hostinger]
How long it is kept
| What | Kept for |
|---|---|
| Email you send me, and my reply | Up to 24 months after our last exchange, then deleted |
| Records of paid work (invoices, contracts) | As long as tax and accounting law requires — [TBD: confirm the Ugandan retention period] |
| Anything collected by the website itself | Not applicable — it collects nothing |
| Hosting provider's server logs | Set by Hostinger — [TBD] |
How it is protected
- The whole site is served over HTTPS and HTTP requests are redirected to it.
- A Content-Security-Policy blocks third-party scripts from running at all.
- Configuration, caches and source files are not reachable from the web.
No website can promise perfect security. If a breach ever affects your data, I will tell you and the relevant regulator without undue delay — within 72 hours of becoming aware of it, where the law requires it.
Your rights
If we have corresponded, you can ask me to show you what I hold about you, correct it, delete it, give you a copy, restrict what I do with it, or object to it being processed at all. Because there are no accounts and no database, there is no self-service page: email privacy@dericktw.online and I will act on it.
These are the deadlines I work to:
- UK/EU GDPR: within one month, extendable by two further months for complex requests, and I will tell you if that happens.
- California (CCPA/CPRA): within 45 days, extendable once by a further 45 days. You will not be treated differently for asking.
- Uganda (Data Protection and Privacy Act 2019): without undue delay, and in practice within the one-month GDPR deadline above.
You also have the right to complain to a regulator: Uganda's Personal Data Protection Office, the UK's ICO, or your national data protection authority in the EEA.
Children
This site is aimed at working professionals and is not directed at children. I do not knowingly collect data from anyone under 16. If you believe a child has emailed me, say so and I will delete the message.
Changes
If this notice changes in a way that affects you, the date below changes and the new version replaces this one on this page. There is no mailing list to notify, because there is no mailing list.