Legal
Privacy policy
What I do with your information when you contact me or place an order through these sites, and what I do with it afterwards.
Who is responsible for your information
Jonathan McHarg Consulting Ltd is the data controller for the information collected through this website.
Registered in England and Wales, company number 16349817. Registered office: 6 Mellstock Road, Poole, Dorset, BH15 3DP.
For anything about this policy, or about your own information, email hello@mcharg.com or call 01202 138435. It reaches me, usually the same day.
What this policy covers
This policy covers two sites: it.mcharg.com, and the Microsoft 365 ordering app at email-order.mcharg.com. It explains what happens when you browse them, what happens when you send an enquiry, and what happens when you place a licence order.
If you become a client, a separate arrangement covers the information I handle in the course of the work — including anything I host on your behalf, and the data protection terms that go with it. That is set out in your terms of business rather than here, and every hosting client has one.
What I collect, and when
When you send an enquiry
The contact form asks for your name, company, email address and, if you choose to give it, a phone number. It also asks what your enquiry is about, roughly how many people use IT in the business, who looks after your IT at the moment, what you need help with, whether there is a deadline behind it, and how you would prefer me to reply.
Only the name, company, email, subject, size band, what you need help with, and your consent are required. Everything else is optional, including the phone number. The form also records which page you sent the enquiry from, so I know what you were reading.
Please don't put anything confidential or sensitive into the form. If the problem is sensitive, say so in a sentence and we will find a better channel for the detail.
When you order Microsoft 365 licences
The ordering app at email-order.mcharg.com asks for your name, email address and phone number; your company name and address; your company registration number, if you are a limited company; your domain name; and the licences, add-ons, number of users and billing term you have chosen. Placing an order sets up a direct debit for the licences.
If you ask me to set up mailboxes as part of the order, you may also give me names and email addresses for your staff. Those details belong to your people. You stay responsible for them as their employer, and I use them only to carry out the setup you have asked for.
An order form is never the place for a password. If the setup needs access to something you already run, we will arrange that separately.
When you email or call
I keep the correspondence, and whatever is in it, for the same reasons and the same length of time as an enquiry sent through the form.
When you simply read the site
The web server keeps standard access logs: your IP address, the page requested, the time, and which browser made the request. These are used to keep the site running and to deal with abuse. They are not used to build a profile of you, and they are not combined with anything else.
Neither site sets any cookies, and neither runs analytics or advertising scripts. The ordering app keeps nothing in your browser either, so if you start an order and leave it half-finished, nothing of it is kept. The cookie policy covers that in full.
Why I am allowed to hold it
| What for | Lawful basis |
|---|---|
| Replying to your enquiry and working out whether I can help | Steps taken at your request before entering into a contract |
| Taking your licence order, fulfilling it and billing for it | Performance of a contract with you |
| Keeping order, invoice and direct debit records | Legal obligation — company and tax law |
| Keeping a record of who approached me and what about | Legitimate interests — running and accounting for a business |
| Keeping the site up and dealing with abuse | Legitimate interests — security of the service |
| Sending you occasional updates, if you ticked that box | Consent, which you can withdraw at any time |
The updates tick box is separate from the enquiry and genuinely optional. Leaving it unticked makes no difference to the reply you get.
Where it goes
An enquiry is stored in the website's own database and emailed to me. Both the website and the mail relay are mine, hosted on a server in London, in the United Kingdom.
Enquiries are also recorded in a customer system I built and run myself, so that I can keep track of conversations. It is hosted on the same infrastructure.
A licence order travels further than an enquiry does. Everything on the order form — the Microsoft licences and the Proofpoint, Exclaimer and DropSuite add-ons — is bought through a single distributor, Pax8. Your company name, address, domain name and the items you have chosen are passed to them so the subscriptions can be set up, and each vendor then receives what it needs to licence its own product. If you ask me to register a domain, the registrar receives what registration requires. None of them receive more than the service itself needs.
These are suppliers, not marketing partners. Pax8 handles the order on my instructions and sets out its own practice in its privacy notice. The vendors behind the products are large international companies, and some of this processing happens outside the UK under their own standard contractual terms. If you want the detail for one of them before you order, ask me and I will point you at their current terms.
I don't sell data, I don't share it with marketing networks, and I don't pass it to anybody in order to be paid for it.
The one third party involved in serving these pages
The typeface on both sites is served by Google Fonts. Loading it means your browser makes a request to a Google server, which sees your IP address. No cookie is set and nothing identifying is sent. If you would rather that did not happen, a font-blocking extension or a privacy-focused browser will stop it, and both sites will still work.
How long I keep it
- Enquiries that do not become work — two years from our last contact, then deleted.
- Enquiries that become work — kept for the duration of the engagement and then for six years afterwards, which is what company and tax records require.
- Licence orders — kept for as long as the licences run and then for six years afterwards, which is what company and tax records require.
- Mailing list — until you unsubscribe, and then only a record that you asked to be removed, so I don't add you back.
- Server access logs — a rolling period of a few weeks, then overwritten.
How it is kept
Both sites are served over HTTPS. The servers are patched, access to them is restricted, and the data on them is backed up. Email to me goes over an authenticated, encrypted connection.
No system is perfect, and I would rather say that than claim otherwise. If something does go wrong and your information is affected, I will tell you and, where the rules require it, the Information Commissioner's Office.
Your rights
Under UK data protection law you can ask me to:
- tell you what I hold about you, and give you a copy
- correct anything that is wrong
- delete it, where there is no reason for me to keep it
- stop using it for a particular purpose, or restrict what I do with it
- hand it over in a portable form
- stop sending you updates, which you can also do from any email I send
Email hello@mcharg.com and I will deal with it within one month. There is no charge.
If you are not happy with how I have handled it
Tell me first and give me the chance to put it right. If that doesn't resolve it, you can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113. You do not have to come to me first, but it is usually quicker.
Changes to this policy
If what I do with your information changes, this page changes with it and the date at the top is updated. If a change is significant and affects people who have already contacted me, I will say so rather than leave it to be noticed.