Last reviewed:
Who we are
Sandlebridge Limited is the controller of personal information collected through this website. You can contact us at phil@sandlebridge.co.uk or by post at 93 George Street, Edinburgh EH2 3ES.
Information we collect
When you send an enquiry or charity website application, we collect the information you enter, which may include your name, email address, telephone number, organisation, budget, service interests, referral source and message or application details. We also retain submission time, delivery status, consent records and security information needed to protect the form.
Requirements-brief uploads are not currently accepted. If this changes, this policy will be updated before the feature is enabled.
How and why we use it
- To respond to enquiries, provide requested information and take steps towards a contract. Our lawful bases are taking steps at your request before entering a contract and our legitimate interests in operating and developing our business.
- To assess charity website applications and contact applicants. Our lawful basis is our legitimate interest in administering the programme fairly and securely.
- To protect the website, prevent spam and investigate failures. Our lawful basis is our legitimate interest in maintaining secure and reliable services.
- To send occasional marketing only when you select the separate marketing option and confirm the MailerLite double-opt-in email. Our lawful basis is consent. You may withdraw consent at any time using the unsubscribe link.
- To understand aggregate website use through Plausible Analytics. Plausible is configured without cookies and does not provide us with profiles of individual visitors. Our lawful basis is our legitimate interest in improving the website with privacy-minimised statistics.
We do not use this website for advertising profiling, and we do not use Google Analytics or Google Tag Manager.
Service providers
We use service providers acting on our instructions where necessary to run the website:
- Vercel hosts the website and may process request and security logs.
- Sanity stores website content and private form submissions in separate datasets.
- Postmark sends internal form notifications and acknowledgements.
- MailerLite manages marketing subscriptions and confirmation emails where you opt in.
- Cloudflare Turnstile checks form submissions for automated abuse.
- CookieYes records and applies cookie choices.
- Plausible provides privacy-friendly aggregate website analytics.
We do not sell personal information. We may disclose it where required by law, to protect legal rights, or in connection with a properly managed business reorganisation.
International transfers
Some providers may process information outside the United Kingdom. Where this occurs, we require an appropriate safeguard recognised under UK data-protection law, such as UK adequacy regulations or approved contractual protections. Provider locations and safeguards may change, so we review them as part of supplier management.
How long we keep information
Website enquiries and charity applications in the private submissions database are deleted one year after submission. Related transactional emails, security logs and provider records may have separate operational retention periods and are kept only as long as reasonably necessary for their purpose, legal obligations and dispute handling. Marketing subscription records are retained until you unsubscribe or ask us to erase them, subject to retaining a minimal suppression record where needed to honour your choice.
Cookies and analytics
CookieYes provides the website's consent controls. You can accept, reject or customise optional cookies and change your choice at any time using “Manage my cookie preferences” in the footer. Essential storage and security functions may operate without consent where they are necessary to provide or protect the service. Plausible is used as cookie-free aggregate analytics and is not used for advertising.
Your rights
Depending on the circumstances, you may ask us for access to your personal information, correction, deletion, restriction, portability or an objection to processing. Where processing relies on consent, you may withdraw it at any time without affecting earlier lawful processing.
Contact phil@sandlebridge.co.uk to exercise a right. We may need to verify your identity. You may also complain to the UK Information Commissioner's Office at ico.org.uk.
Security and changes
We use access controls, private storage, encrypted connections, anti-abuse checks and restricted server credentials to protect information. No online service can guarantee absolute security.
We will update this notice when our processing or providers materially change. The latest version will be published on this page with its review date.