Privacy

What I do with your data.

Short version: I use it to reply to you, and that's it. No mailing list, nothing sold on, and what you type goes to nobody but me. Analytics cookies are set only if you press Accept all on the banner — and not before.

Last updated: 9 September 2026

Who is responsible for your data

Workings is a trading name of Loaded Dice Ltd, registered in England and Wales, company no. 12429789, registered office Unit C4, Windmill Parc, Hayes Road, Sully, Vale of Glamorgan CF64 5AD. Loaded Dice Ltd is the data controller for anything you send through this site — in practice that means me, Graham, because I own the company and nobody else reads the inbox. You can reach me at graham@theworkings.uk.

What I collect, and when

The audit tool on the front page runs entirely in your browser. Your answers are not sent anywhere and are not saved — close the tab and they are gone. Nothing at all is stored on your device until you answer the cookie banner; what gets stored after that depends entirely on which button you press, and is listed in full under cookies and browser storage below.

The only time anything leaves your device is if you choose to send me something — either the audit form after seeing your number, or the message form on the contact page. At that point I receive:

• Your email address.
• Your name or company name, if you gave one.
• If you used the audit form: the answers you gave the audit tool and the figures it worked out — hours per task, hourly cost, trading weeks, the annual total.
• If you used the contact form: whatever you typed into the message box.
• The date and time you submitted it.
• A shortened version of your IP address, with the last part removed (for example 81.2.69.0 rather than the full address), plus your browser's user-agent string. I use these to stop the form being abused by bots. I do not store your full IP address.
• To rate-limit the form, a one-way scrambled fingerprint of your IP address (a salted hash — it can't be turned back into the address) is kept briefly — usually an hour or two, at most a day or so — and then deleted automatically. It is used only to count submissions and for nothing else.

Why I'm allowed to hold it

Under UK GDPR my lawful basis is legitimate interests (Article 6(1)(f)): you asked me to look at your figures, and I need your email to reply. The interest is mutual and the data is the minimum required to do it. If you would rather I did not hold it, say the word and it goes.

The shortened IP address and user-agent are also held on legitimate interests, for the narrow purpose of keeping the form working and free of spam.

Analytics and advertising cookies are different, and legitimate interests does not stretch to cover them. Those run on your consent (UK GDPR Article 6(1)(a), and regulation 6 of PECR for the act of storing them). That is what the banner is for. No consent, no cookies — and withdrawing it later is one click, described under cookies and browser storage.

The single exception is the record of your answer itself. If you decline, I have to store the fact that you declined, or the banner would ask you again on every page and effectively nag you into saying yes. Storing that one item is treated as strictly necessary, so it does not need consent of its own.

What I do with it

• I read it and reply to you personally, usually within a working day.
• If we end up working together, it becomes part of the normal client record.
• That is the entire list. I do not add you to a mailing list, run you through an automated sequence, sell your details, or share them with anyone for marketing.

If I contacted you first

Everything above is about people who came to this site and pressed send. This section is the other direction. If an email from me landed in your inbox and you came here to find out how I got your address, this is the honest answer.

Where I got it. From public sources, and only ever business contact details belonging to a limited company — the Companies House register, and the company's own website. I do not buy lists, I do not scrape LinkedIn, and I do not use a data broker or one of the tools that guesses at an address from a name. If I wrote to a general address published on your own site — sales@, info@, enquiries@ — that is exactly where it came from.

What I hold. The company name and number, the town of the registered office, the website, the published email address, the name of a current director as it appears on the public register, and a short note on why I thought the company might be a fit. That is the lot. No personal email addresses, no phone numbers, no home addresses, and nothing about anybody's private life.

Why I'm allowed to. Legitimate interests again (UK GDPR Article 6(1)(f)) — mine in finding a small number of clients, and a limited company's in hearing about something that might save it money. I wrote the balancing test down before I sent anything, and rather than make you ask for it, it is published here in full. Under PECR a limited company is a corporate subscriber, which is why every company I write to is one: sole traders and ordinary partnerships count as individuals and would have to have asked to hear from me first, so they are not on the list.

What you get. One email, written by me, about your business specifically. If you do not reply, that is the end of it — there is no sequence behind it, and no second, third and fourth message dressed up as a friendly nudge.

Making it stop. Reply and say so, or email graham@theworkings.uk. I delete the record the same day and add the address to a short suppression list, which exists for one reason only: so I do not accidentally write to you again. You do not have to give a reason and I will not ask for one.

Who else touches it

I use a small number of suppliers to run the site. They process data on my instructions only. (The typefaces are hosted here rather than fetched from a font service, so reading the page does not involve one.)

• Cloudflare — hosting, the form endpoint, the database the submission is written to, the email that tells me it arrived, and the cookieless visit counting described under counting visits without cookies below. Data is held in Cloudflare's network; some processing may occur outside the UK under Cloudflare's standard data protection terms and the UK International Data Transfer Addendum.
• Google — Google Analytics counts visits to the page, and Google Ads tells me whether an advert led to an enquiry. What each of them does, and what changes when you accept, is set out in cookies and browser storage and analytics below. Google processes this outside the UK, under the UK International Data Transfer Addendum.
• Cal.com — if you book a call, that booking is handled by Cal.com under their own privacy notice.

Cookies and browser storage

Every storage permission on this site starts switched off. That is not a setting I can quietly reverse later: it is applied before the Google tag is allowed to load, so the tag has nothing to write to until you say otherwise.

Before you answer the banner: nothing is stored. No cookies, no browser storage, nothing. Analytics still counts the visit, but the ping carries nothing that survives the page — Google is told a page was viewed, not who viewed it, and cannot tie it to anything you did before or after.

If you choose "Essential only" (or press Escape, which does the same thing): one item is stored, and it is the record of your refusal.

• tw_consent — browser storage, kept 12 months. Holds a version number, the word "no", and the date. No identifier, nothing that describes you. Its only job is to stop the banner asking again, and it is never sent anywhere — it stays in your browser.

Analytics carries on exactly as it did before you answered: a ping with no cookie behind it, and nothing kept that could join this visit to the next.

If you choose "Accept all", Google sets the following, all of them first-party to this site:

• _ga — cookie, up to about 13 months. A randomly generated number that lets Google recognise the same browser across visits. It is not your name, but it is an identifier.
• _ga_294TV3LSGP — cookie, up to about 13 months. Session state for this particular Analytics property.
• _gcl_au — cookie, about 90 days. Google Ads. Records whether you arrived from an advert, so I can tell which adverts are worth paying for.
• _gcl_aw — cookie, about 90 days. Only set if you actually arrived by clicking a Google advert; it holds that click's reference so the click can be matched to an enquiry. If you did not come from an advert, it is never created.
• _gcl_ls — browser storage, about 90 days. Google Ads again, doing the same job by another route.
• tw_consent — as above, but recording "yes".

Google asks for two years on the two _ga cookies. Browsers no longer allow that for cookies set this way and cap them at around 13 months, which is what you actually get.

Changing your mind. There is a Cookie settings button in the footer of every page on this site, including this one. Withdrawing is deliberately the same single click as giving — press it, choose "Essential only", and everything in the list above is deleted from your device on the spot. Not disabled, not left to expire quietly in a year and a half: removed. The only thing kept is the one-line record that you said no, so that you are not asked again.

There is no cookie wall here. Declining costs you nothing — every page, the audit tool and the forms all work exactly the same either way, and I will not ask again for a year.

What Google actually receives

Either way, Google is told the page you looked at, roughly where in the world you are, and what kind of browser and device you used. What changes is whether that arrives with an identifier attached.

Without your consent, each visit is counted on its own. Come back tomorrow and that is simply another visit, not you again. I get a total; I do not get a person. Advertising identifiers are stripped out of the ping before it is sent.

With your consent, visits are joined up by the identifier in the _ga cookie, so I can see that someone read three pages over two weeks before getting in touch, and that they arrived from a particular advert. That joining-up is the entire reason for asking. It does mean your browser exchanges data with Google's advertising domains as well as its analytics ones — that is how an advert click gets matched to an enquiry — but with ad personalisation denied it stops at measurement rather than following you off this site.

One permission stays switched off even for people who press "Accept all": ad personalisation. That is the one that would let your visit here feed into the adverts you are shown elsewhere. Measuring whether an advert produced an enquiry does not need it, so it is denied in the code rather than offered as a choice — there is no combination of buttons on this site that turns it on.

So: no advertising profile is built out of your visit, nothing is sold or handed to anyone outside Google, and I make no attempt to work out who you personally are. On my side it exists for one purpose — knowing which pages earn their place and which adverts to stop paying for.

Counting visits without cookies

Alongside Google, this site uses Cloudflare Web Analytics, and it is the one piece of measurement here that does not wait for the banner. It sets no cookies, writes nothing to your device and creates no identifier — so there is nothing for you to consent to storing. It cannot recognise you, cannot join today's visit to tomorrow's, and cannot follow you anywhere else. What it records is that a page was requested, roughly where in the world from, and how quickly it loaded.

That is deliberate rather than a loophole. It lets me see whether the site works at all — which pages get read and which ones people give up on — without needing anybody to press a button first and without building a profile of anyone. It runs whether you choose "Accept all" or "Essential only", because in storage terms it does the same nothing either way. The statement above still holds: before you answer the banner, and after you decline it, nothing is stored on your device.

How long I keep it

Audit and contact submissions are deleted automatically after 24 months — the system does it on a schedule, it doesn't wait for me to remember. If you have become a client, the normal business and tax retention rules apply instead (six years). Email correspondence lives in my mailbox for as long as it is useful and is cleared out periodically.

Prospect records — the public company details described under if I contacted you first — are deleted 12 months after I collected them, or the day you ask, whichever comes first. The suppression list is the one thing I keep indefinitely, and only ever an email address, because remembering not to contact you is the entire point of it.

Your rights

You can ask me to show you what I hold, correct it, delete it, restrict what I do with it, or hand it over in a portable format. You can also object to my processing it on legitimate interests. Email graham@theworkings.uk and I will deal with it within one month — realistically within a day, because there is not much of it and I am the only one who has to look.

One of those rights is stronger than the rest. If I emailed you out of the blue, your objection to it is absolute: there is no balancing exercise and nothing for me to weigh up. You say stop, it stops, and the record goes.

Where I rely on your consent — which is the analytics and advertising cookies, and only those — you can withdraw it whenever you like, and it is as easy as giving it was: the Cookie settings button at the bottom of any page. Withdrawing stops the counting there and then and deletes what was stored. It cannot undo visits already counted, and I would rather say so than imply otherwise.

If you think I have handled your data badly and I have not put it right, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.