In effect from 23 August 2026
This website sets no cookies, runs no analytics or advertising trackers and loads nothing from any third party. The fonts are served from our own domain, so no outside company learns you were here. There is no contact form and nothing to fill in.
The only thing stored on your device is your light/dark preference, and only if you press the toggle yourself. It never leaves your browser.
If you email us, we hold your email so we can reply. If we emailed you first, the section on business contact details explains where we got yours and how to make it stop in one line.
This site is run by Mo Uddin, trading as Backstage Consultancy, a sole trader. We are the data controller for the personal data described here, which means we decide why and how it is handled, and we are answerable for it.
Mo Uddin, trading as Backstage ConsultancyWe have not appointed a Data Protection Officer. We are not required to: we are not a public authority, we do not monitor people on a large scale and we do not process special category data as a core activity. Privacy questions go to the address above and reach a person.
This notice covers backstageconsultancy.com and the email correspondence that follows from it, including outbound email we send.
It does not cover our client work. When we build and operate something for a client, that client is usually the data controller and we act as their processor under a separate written agreement. It also does not cover Julian, our outbound product, which will carry its own notice and terms when it launches.
Our host, Cloudflare, records ordinary web-server information for every request: your IP address, which browser and operating system you are using, which page you asked for and when. We do not use this to build a picture of you as an individual, and we do not combine it with anything else.
If you press the light/dark toggle, your browser stores that choice locally under the name
backstage-theme. It records one word, light or dark.
It is never transmitted to us and never leaves your device. Clearing your
browser's site data removes it. If you never press the toggle, nothing is stored at all and
the site simply follows your operating system's own setting.
There are none. No first-party cookies, no third-party cookies, no analytics, no advertising or social pixels, no session tracking, no fingerprinting.
You have not been asked to accept anything because there is nothing to accept. Under the Privacy and Electronic Communications Regulations, consent is required for storage that is not necessary for a service you asked for. The only storage here is the preference you set yourself by pressing a button, which is exactly the sort of functional storage the rules exempt. If we ever add analytics, this notice changes first and you will be asked properly.
Two things follow from this that are worth stating, because most sites cannot say them. The typefaces are served from our own domain rather than Google Fonts, so Google is not told your IP address when the page loads. And nothing else on the page calls out to another company at all.
There is no contact form on this site, deliberately. The contact page is an email address, so your message goes from your own email account to ours, with nothing in between that you did not choose.
When you write to us we hold your name, your email address and whatever you put in the message. Given what we do, that often includes information about how your business operates. We treat that as confidential.
We approach businesses we think we can help. If a message from us is what brought you here, this is the section that matters, and it is written to be straight with you rather than to cover us.
From public sources: your company's own website, its published contact page, Companies House, a public professional profile or an industry directory. We do not buy lists, and we do not use tools that guess at addresses. If we could not find a published address for someone, we used the company's own contact form instead.
What we hold is business contact information: a name, a role, a work email address, a company and notes from public research about that company. Nothing personal in the ordinary sense of the word.
Reply with the word "stop", or email hello@backstageconsultancy.com, and that is the end of it. No form, no reason required, no "are you sure". We keep the minimum record needed to make sure we do not contact you again by mistake, which is the one thing suppressing you actually requires, and delete the rest.
You have an absolute right to object to direct marketing under Article 21 of the UK GDPR. There is nothing for us to weigh: you object, we stop.
We score prospects against a profile of who we can usefully help, so we approach fewer people rather than more. It is a filter on our own list. It makes no decision about you and produces no legal or similarly significant effect. Nothing is automatically decided about anyone. Every message is written and sent by a person.
We do not sell personal data, we do not share it for anyone else's marketing and we do not use advertising networks. Two suppliers process data on our behalf, under contract and on our instructions only:
| Who | What for | What they see |
|---|---|---|
| Cloudflare, Inc. Served from the nearest edge location worldwide; company based in the USA. | Hosting, CDN and network security for this website. | IP address, browser user-agent, requested URL and timestamp, in server logs. |
| Namecheap, Inc. (Private Email) USA. | Our email. Anything you send to us is stored on their servers. | Your name, email address and whatever the message contains. |
We may also disclose information where the law requires it, or to establish or defend a legal claim. If that ever happened we would tell you unless we were legally barred from doing so.
Both suppliers above are US companies, so some data is handled outside the UK. Transfers are covered by the contractual protections UK law provides for this, the International Data Transfer Addendum to the European Commission's standard contractual clauses, which binds them to UK-equivalent standards and gives you rights you can enforce.
Cloudflare also serves this site from whichever of its locations is nearest to you, so the page itself may be delivered from outside the UK. That is how every content delivery network works, and the same protections apply.
| What | How long |
|---|---|
| Server logs | Short-term only, per Cloudflare's own retention. We do not export or archive them. |
| Your light/dark preference | On your device until you clear your browser data. We never receive it. |
| Email correspondence | While we are in touch, and for two years after the last message, so we have the context if you come back. Then deleted. |
| Records of client work | Six years after the engagement ends, which is the period we may need them for tax and for defending a claim. |
| Prospect contact details | Deleted when we stop pursuing the opportunity. If you have opted out, we keep only enough to honour that, and we keep it indefinitely, because that is the point of it. |
Under UK data protection law you can ask us to:
Email hello@backstageconsultancy.com and say what you want. It is free. We will respond within one month. If a request is genuinely complex we may extend that by up to two further months, and we will tell you why inside the first month rather than going quiet. We may need to check you are who you say you are before releasing anything. That protects you, not us.
If we have got something wrong, tell us first. We would rather fix it than have you go elsewhere with it.
You also have the right to complain to the UK's data protection regulator at any point, whether or not you have raised it with us. It costs nothing.
Information Commissioner's OfficeThe site is served over HTTPS only. Our email accounts are protected by strong, unique passwords and two-factor authentication. Email is authenticated with SPF and DMARC, so messages claiming to be from us can be checked. Access to correspondence is limited to the people who need it, which today is a very short list.
No system is perfectly secure. If a breach ever put you at risk we would report it to the ICO within 72 hours and tell you directly where the law requires it.
If what we do with personal data changes, we change this page first. The date at the top and bottom is the version you are reading. For anything significant, such as a new supplier seeing your data, a new purpose or analytics of any kind, we will say so plainly here rather than quietly editing a sentence.
Privacy questions, requests and objections all go to hello@backstageconsultancy.com, or by post to the address in section 1.