Privacy notice

This explains what personal data I collect, why I collect it, how long I keep it, and what you can do about it. It is written to meet the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR).

Who I am

JMBurdett Systems is a sole trader business operated by Jack Burdett, based in Surrey, United Kingdom. I am the data controller for the personal data described in this notice.

Where I get your data, and what I collect

There are three different ways I might hold data about you, and they work differently. This section says which applies to you.

1. If I contacted you first

If you received an email from me without asking for one, your details were collected from publicly accessible sources: your firm's own website, its public Google Maps business listing, and the public register at Companies House. I did not buy a list, and your details did not come from a data broker.

What I hold is limited to business contact information: firm name, business email address, business website, town or city, publicly listed company number and director name, and publicly visible information about the services the firm offers.

Lawful basis: legitimate interests (UK GDPR Article 6(1)(f)), meaning my interest in contacting businesses that may benefit from a relevant service. I have assessed this as proportionate because contact is limited to business email addresses, the message relates to that firm's actual operations, volumes are low, and every message carries a plain way to opt out. Under PECR, marketing email to corporate subscribers is permitted where a clear opt-out is offered.

You can object at any time and I will stop. See Your rights.

2. If you contacted me

If you book a call or email me, I hold your name, email address, the firm you work for, and whatever you choose to tell me about your business, including your answers to the questions on the booking form.

Lawful basis: legitimate interests, and where we go on to work together, performance of a contract (Article 6(1)(b)).

The same applies if you try one of my demonstration assistants. Those are working demos of the product on invented firms, not real businesses. Anything you type reaches me, not a third party, and I only use it to respond to you. Please don't put anything genuinely sensitive into a demo.

3. If you used a system I built for one of my clients

If you interacted with an assistant or enquiry form I built for a client of mine, that client is the data controller, not me. I act as a data processor on their instructions. Their privacy notice governs that data, and a request about it should go to them, though I will help them answer it.

This website

The site is deliberately light. It sets no advertising or analytics cookies and does not track you across other websites. My hosting provider processes standard server logs, including IP address, for security and reliability.

Fonts load from Google Fonts, so your browser makes a request to Google's servers. If you book a call, that happens on Cal.com under their own privacy notice.

Who your data is shared with

I do not sell personal data and I do not share it for anyone else's marketing. These are the providers I use to run the business:

Some of these providers process data outside the UK, mainly in the US. I may also disclose data where legally required to.

How long I keep it

Keeping your address after you opt out sounds backwards, but it is the only reliable way to guarantee you are never contacted again, and it is what the ICO expects.

Your rights

Under the UK GDPR you have the right to:

• Be informed, which is what this notice is for
• Access a copy of the personal data I hold about you
• Rectification: have inaccurate data corrected
• Erasure: ask me to delete your data
• Restrict processing: ask me to pause using it
• Data portability: receive your data in a portable format
• Object, including an absolute right to object to direct marketing, which I must always honour
• Rights around automated decision-making: I make no decisions with legal or similarly significant effects by automated means alone

To exercise any of these, email jack@jmburdett.com. I will respond within one month, free of charge. Replying "no", "stop" or "unsubscribe" to any email from me is enough. You do not need to mention this notice.

Complaints

If you think I have handled your data badly, please tell me first and I will try to put it right. You can also complain to the UK regulator at any time:

Changes

If this notice changes materially I will update the date at the top. It was last reviewed on 21 September 2026.