Privacy policy

Effective 21 July 2026 · Last updated 21 July 2026

Who is responsible for your information

Matt McVickers, trading as Granite Digital, is the controller of the personal data described here. Granite Digital is a one-person practice run as a sole trader in Jersey, Channel Islands. It is not a limited company.

There is no data protection officer. A business this size is not required to appoint one, so questions come to me directly at info@granitedigital.je.

What I collect, why, and what allows me to

Jersey law calls the thing that allows me to process your data a condition for processing, in Schedule 2 of the Data Protection (Jersey) Law 2018. Every article and schedule referred to on this page is in there, and you are welcome to check any of it. There are three situations on this site and they are listed in full below. There is not a fourth.

The contact form

If you send me an enquiry I receive your name, your email address, the type of enquiry you picked and whatever you wrote in the message. I use them to read your enquiry, reply to it and, if it goes somewhere, to quote for the work.

The condition is Schedule 2, Part 1, paragraph 2: steps taken at your request with a view to entering into a contract. You asked me for something and I need your details to give it to you.

The form also carries a hidden field that real people never see or fill in. It exists to catch automated spam. If it is filled in the message is discarded and nothing is stored.

Server logs

The site runs on Google's Firebase App Hosting, which keeps ordinary web server logs. These record things like your IP address, the page requested, the time and your browser type. I do not use them to build a picture of you and I do not link them to anything else. They exist so the site can be kept up, kept secure and debugged when it breaks.

The condition is Schedule 2, Part 1, paragraph 5: legitimate interests. The interest is keeping a working, secure website, which is hard to argue with and hard to achieve any other way. The data is minimal, it is not used to make decisions about you, and nobody markets to you off the back of it, so it does not override your rights or interests.

Analytics cookies

If you agree to them, Google Analytics sets two cookies that let me see which pages people read and roughly how many visitors there are. Google does not store your IP address and I have no way of turning any of it back into a person.

The condition is Schedule 2, Part 1, paragraph 1: consent. Nothing loads until you give it, you can withdraw it at any time on the cookie policy page, and withdrawing also deletes the cookies already set. Withdrawing is as easy as agreeing was, which Article 11(3) requires.

Worth saying plainly: Jersey has no PECR, so I could lawfully run these on legitimate interests without asking. The cookie policy explains why I ask anyway.

Marketing

I do not run a mailing list and I do not send marketing email. If I ever do, it will be because you actively ticked a box asking for it, kept separate from sending an enquiry. Jersey has no soft opt-in rule, so consent is the only sensible basis, and Article 36 gives you an absolute right to tell me to stop, with no balancing test and no exceptions.

Who else sees it

Nobody buys it, and nobody gets it for their own marketing. Three suppliers handle it on my behalf, under contract, and only to do the job I use them for:

• Resend delivers the contact form email to my inbox. It sees the contents of that email.
• Google hosts the site through Firebase App Hosting, which is where the server logs sit, and runs Google Analytics if you agreed to it.
• My email provider holds my inbox, which is where your enquiry lands and stays.

I would also hand something over if the law genuinely required it, for example a court order. That relies on Schedule 2, Part 2, paragraph 7, which is where Jersey keeps the legal obligation condition rather than in Part 1.

Whether it leaves Jersey

Yes, some of it goes to the United States, because Resend and Google are American companies. Article 66 of the Jersey Law only permits that where the destination ensures an adequate level of protection.

It does here. Jersey takes its adequacy from European Commission decisions rather than keeping its own list, and the EU to US Data Privacy Framework is such a decision. Both Resend and Google are certified under it, which makes the transfer adequate under Article 66(2)(a). Both also have standard contractual clauses in their data processing terms, which are separately recognised under Article 67(2)(c). That second mechanism is deliberate belt and braces: the two previous EU to US arrangements were both struck down, and if this one goes the same way the clauses still stand.

How long I keep it

The rule is that I keep something for as long as it is still doing a job, and then it goes. That is what Article 8 requires: no longer than is necessary for the purpose. In practice that works out as:

• Enquiries that did not become work. Kept while there is a realistic chance of picking the conversation back up, then deleted. I clear these out at least once a year.
• Correspondence with clients. Kept for as long as you are a client, and then for as long as Jersey tax and company record-keeping rules require me to hold the records.
• Server logs. Short-lived. They age out automatically on the hosting platform and I do not archive them anywhere.
• Analytics. Held by Google for the period set on the account, and the cookies themselves last two years unless you clear them sooner. Turning analytics off on the cookie policy page deletes them immediately.

If you would rather I did not wait for the annual clear-out, ask and I will delete your enquiry there and then.

What you can ask me to do

Part 6 of the Jersey Law gives you these rights. Ask for any of them by emailing info@granitedigital.je. You do not need a form or a particular form of words.

• See it (Articles 28 to 30). A copy of what I hold about you.
• Correct it (Article 31), if it is wrong or incomplete.
• Delete it (Article 32).
• Pause it (Article 33), while something is disputed.
• Take it with you (Article 34), in a machine-readable format.
• Object (Article 35) to anything I do on legitimate interests, which here means the server logs.
• Stop marketing (Article 36). Absolute. I do not have to be persuaded and I cannot refuse.

I have four weeks to answer, and it is free. That is Jersey's deadline under Article 27(1), and it is not the same as the UK's. If a request is genuinely complicated I can take up to eight weeks more, but I have to tell you that, with my reasons, inside the original four.

Where processing ever rests on your consent, you can withdraw it at any time, and withdrawing has to be as easy as giving it. Withdrawing does not unwind what was lawfully done beforehand.

Automated decisions

There are none. Nothing on this site profiles you, scores you or makes a decision about you automatically. A person reads every enquiry, and that person is me.

Do you have to give me any of this

No. No law obliges you to, and you are not under a contract with me that requires it. The only consequence of not filling in the form is the obvious one: I cannot reply to an enquiry that does not have an email address on it. You are welcome to phone-free, form-free contact by emailing me directly instead.

Where your information came from

From you. I do not buy lists, scrape contact details or collect information about you from anywhere else.

Keeping it safe, and what happens if I do not

The site is served over HTTPS, the contact form is validated and length-capped on the server, and the key that sends the email is held in Google Secret Manager and never reaches your browser. Access to the inbox is mine alone and protected by multi-factor authentication.

If something does go wrong, Article 20 requires me to tell the JOIC without undue delay and, where feasible, within 72 hours, unless the breach is unlikely to be a risk to anyone. If it is likely to be a high risk to you, I have to tell you directly, in plain language.

Children

This site sells business services and is not aimed at children. Note for completeness that the age of digital consent in Jersey is 13, not 16 as it is in much of Europe.

Complaining

Come to me first if you can, because most things are a misunderstanding I can fix the same day. But you do not have to, and you have the right to complain to the Jersey Data Protection Authority, which operates as the Jersey Office of the Information Commissioner. You can also pursue a remedy through the courts.

The law this is written to

This policy is written to Jersey law, not to UK GDPR, and the two differ in ways that matter: the deadline for answering you is four weeks rather than a month, transfers out of the island are assessed under Article 66, and complaints go to the JOIC rather than to the ICO. Everything cited above is public, and here it is.

Changes to this policy

If what I do with your information changes, this page changes with it and the date at the top moves. If the change is significant, I will say what it was rather than quietly reissuing the page.