How professional enquiry information is handled

Who is responsible?

Daniel Stewart, sole trader trading as Daniel Stewart Professional Services and UK GDPR data controller. UK-based independent practice. No walk-in office. For privacy questions or rights requests: Daniel@danielstewartprofessionalservices.uk.

What information and why?

When you contact me I may receive your name, organisation, professional contact details, the non-confidential subject of the enquiry and correspondence history. The purposes are to respond to your request, consider a potential professional assignment and maintain proportionate records of professional communication. I use legitimate interests for ordinary business contact and, where appropriate, steps requested prior to a contract. Do not send privileged, sensitive or confidential transaction records through an introductory enquiry.

Practice records and secure document environments

Initial enquiry information may be recorded in a restricted practice operations database on Cloudflare D1 for qualifying, proposing and administering a requested service. If an engagement proceeds, the agreed matter-specific privacy and data-processing arrangements will identify the authorised systems and retention rules. The practice uses a private Cloudflare R2 bucket for synthetic tests and plans controlled document handling subject to separate service acceptance. Its location is currently reported as Western Europe with Cloudflare jurisdiction setting “default”; do not interpret that location hint as a guarantee of UK-only or EU-only storage or processing. Access, subcontractors, international transfers and retention are considered for the particular engagement. No sensitive client documents should be submitted via the initial enquiry form or email.

Roles, lawful bases and supplier responsibilities

For my own business contacts, quotes, invoices and professional records, I act as controller. Depending on the context, lawful bases may include legitimate interests for proportionate B2B enquiries and customer management, steps requested before contracting, performance of a contract, and legal obligations for tax or record-keeping. Where a business customer instructs me to process their property, tenant or employee personal data solely on its behalf, roles and written instructions must instead be agreed in a specific UK GDPR Article 28 processor agreement before processing. I do not assume all cases require the same roles.

Enquiries may come directly from the sender, professional introductions and legitimate business contact records. The relevant data-processing agreement will identify processors/subprocessors and approved hosting or transfer countries for each matter. Third-country transfers need an applicable legal mechanism and risk assessment; a European bucket location hint does not establish a UK/EU-only processing guarantee.

External online enquiry form

If you choose the linked Jotform professional enquiry form, your business contact details, service category, volume/budget bands, and high-level message will also be processed by Jotform as the form service provider to transmit and host the enquiry. No property/client documents or privileged information should be submitted. Before submitting, review the applicable Jotform privacy and technical notices. Form provider data processing, international transfer arrangements and account retention settings are subject to separate controller/provider verification; do not assume an initial form is an approved client data room.

Business email

Business correspondence is handled through Microsoft 365 at Daniel@danielstewartprofessionalservices.uk. Microsoft processes email and associated technical data to provide the service. Initial enquiries must remain non-confidential; engagement-specific document access and processing arrangements are agreed separately.

Who may access it?

Business email and hosting service providers may process information to deliver the communication or site. I do not sell professional contact information. There is no visitor signup form, payment facility or user account on this website, and I have not enabled site-specific advertising analytics or tracking scripts. Hosting and email providers may apply essential technical processing under their own terms.

How long is it kept?

Introductory correspondence is retained only for as long as it serves the enquiry or a legitimate follow-up, subject to legal obligations. Non-active enquiries should be reviewed for deletion within 12 months of the last meaningful contact. If a project proceeds, a separate engagement-specific privacy and retention arrangement applies. Minimal suppression records may be kept where necessary to respect a no-contact request.

Records and retention

Enquiry records should be reviewed no later than 12 months after the last meaningful contact. Final customer deliverables, accounts and communications follow the applicable contract, lawful retention requirements and approved retention schedule; some business/tax records may need to be retained longer than ordinary enquiries. Processor data must be returned or deleted on the controller's instruction at termination, subject to any legal preservation obligation and the written agreement. The specific deletion and backup schedule is confirmed in the engagement documents.

Your rights

Subject to applicable law, you can request access, correction or deletion, object to processing, or request restriction. Email the controller using the address above. You can also complain to the Information Commissioner's Office if concerned.

Changes

This information will be updated if the professional service, data handling or providers change materially.