This draft describes the planned public website and current email and file-storage arrangements. Direct enquiry delivery was tested on 28 September 2026. The provider arrangements and remaining handling practices must be confirmed before public launch.
Who is responsible?
Matthew David Lee, trading as LMbee Digital, is responsible for the personal information used to manage enquiries, customer relationships and business records. Contact hello@lmbeedigital.co.uk. Business address: Pine House, Hepscott Park, Morpeth, Northumberland, NE61 6QA.
When a business client supplies records to be processed only on its instructions, that client may be the controller and LMbee Digital its processor. The handling, access and return or deletion of those records must be covered by a separate processing agreement before they are supplied.
What information is used?
- Details you choose to send: your name, email, optional business name and country, project description and correspondence.
- Information needed for an agreed project: relevant contact details, instructions, selected project files, quotes, invoices and payment records.
- Technical information handled by the website host to deliver and protect the site, such as IP addresses, request times, requested pages and browser information.
Most information comes directly from you. A client may also provide the contact details of people involved in its project. Please supply only information you are entitled to share and that is necessary for the work. Keep passwords, private customer records and sensitive information out of an initial enquiry.
What happens in the enquiry builder?
When direct sending is available, choosing “Send enquiry” submits the fields over HTTPS to a Cloudflare Pages Function. It checks the information, the spam-protection result and the sending limits, then submits the enquiry through Proton Mail for delivery to the LMbee Digital inbox. The website does not send an automatic reply to the address entered in the form.
Cloudflare Turnstile is used to help distinguish people from automated abuse. It processes technical browser, device and connection information for this check. It is loaded only when direct sending is configured. You can choose to email directly instead.
The custom website code does not save enquiry fields in cookies, persistent browser storage or a website database, and it does not write enquiry text to application logs. To enforce sending limits, a separate security database at Cloudflare records a random reference, a timestamp and a keyed hash of the connection IP address. These records contain no enquiry text, names, email addresses or raw IP addresses. Records older than 24 hours are removed during the next verified form submission; this is not a guarantee of deletion exactly 24 hours after collection. Hosting and security providers may keep operational and recovery records under their own arrangements. Correspondence and copies of messages sent by the form are managed in Proton Mail.
If direct sending is unavailable, the builder prepares a summary in your browser. Choosing the email option hands that summary to your email app; you review it and press Send there. Long summaries can be copied and pasted. Your browser, clipboard and email app may retain information according to their settings, and your email provider handles messages you send that way.
Why information is used
Responding and doing the work
For an individual requesting a quote or buying a service, the basis is taking requested steps before a contract or performing that contract. For contacts acting for a business, the basis is the legitimate interest in answering enquiries, organising work and managing the customer relationship.
Records and legal obligations
Necessary tax and accounting information is retained to meet legal obligations. Relevant correspondence may also be kept for the legitimate interest in resolving complaints or establishing, exercising or defending legal claims.
Website reliability and security
Technical request information is handled for the legitimate interest in delivering a working website, detecting abuse and protecting the service.
Contact and project information is needed to respond and provide a useful quote. You can leave optional fields blank. If essential information is missing, it may not be possible to quote or complete the work.
Where information is handled
Email is managed using Proton Mail. Working project files are currently held on the computer used for the business, without automatic cloud-folder synchronisation. Access to the business files and Proton inbox is limited to the business operator. The computer requires a sign-in credential. Email attachments can also remain in the email account until they are deleted.
The website uses Cloudflare Pages and Functions for hosting and form processing, Turnstile for spam protection, a Cloudflare database for sending-limit records, and Proton Mail for enquiry delivery. Cloudflare processes website requests under its privacy policy and applicable data-processing terms. Necessary information may also be disclosed to professional advisers or authorities where needed for accounting, a legal obligation or a legal claim.
AI assistance is limited to general technical questions and invented examples. Client files, personal records and confidential client details are kept out of those conversations. Personal information is not sold or used for advertising, and the website has no mailing-list signup or automated decisions about customers.
Processing outside the UK
Proton states that its email servers are in Switzerland, Germany or Norway. Cloudflare operates internationally, including in the United States. Using these services can therefore involve processing outside the UK; keeping local project files does not make email and website processing UK-only.
International transfers need an applicable UK adequacy arrangement or appropriate safeguards. Cloudflare describes its UK Data Privacy Framework extension and contractual safeguards in the linked policies. You can email hello@lmbeedigital.co.uk to ask about the safeguards relevant to your information.
Before launch: confirm the arrangements applicable to the actual Proton and Cloudflare accounts, including processing terms and any required transfer safeguards. This review is still outstanding.
How long information is kept
- Enquiries that do not become projects: kept for up to 12 months after the last meaningful contact, then deleted unless there is an active dispute or another documented need. This period was confirmed on 28 September 2026.
- Client-supplied working files: the period depends on the agreed project, any continuing support and the client's instructions. Agree return or deletion before the files are supplied; do not keep complete client datasets simply because an invoice must be retained.
- Business and tax records: retain necessary records for the applicable statutory period. For a sole trader, tax records normally need to be kept for at least five years after the 31 January submission deadline for the relevant tax year. Relevant records may be kept longer for an unresolved inquiry or legal claim.
Cookies and similar technologies
The website has no visitor analytics or advertising trackers, and fonts are served with the website. The custom code does not set cookies or use persistent browser storage. When direct sending is enabled, the form loads a third-party Cloudflare Turnstile security widget; its technical processing is described above. The intended setup has Turnstile pre-clearance disabled.
Hosting and security services may process technical request information and use strictly necessary technology. The final hosting configuration must be checked before launch. If optional tracking is added later, this notice and any required choices will be updated before it is activated.
Your rights and complaints
Depending on the circumstances, you can ask to access, correct or delete your personal information, restrict its use or receive certain information in a portable format. If consent is ever relied on for a particular use, you can withdraw it without affecting earlier lawful processing.
You can object to processing based on legitimate interests. Email hello@lmbeedigital.co.uk to exercise a right or raise a privacy concern. These rights are subject to legal conditions; for example, necessary tax records cannot always be deleted on request.
Privacy complaints can be sent to the same email address with the subject “Privacy complaint”. You can also complain to the Information Commissioner's Office, the UK data-protection regulator. You do not have to use our complaint route before contacting the ICO.
Changes to this notice
The notice will be reviewed when the website or data-handling arrangements change. This draft was prepared on 28 September 2026.