Privacy policy

Last updated: 19 September 2026

1. Who is responsible for your information

Newbury Oak Limited is the controller of personal information collected through this website and our business enquiries. We are registered in England and Wales, company number 13315128, at 83–89 Phoenix Street, Sutton-in-Ashfield, Nottinghamshire, England, NG17 4HL.

For privacy questions or requests, email info@newburyoak.com and mention “Privacy” in the subject.

2. What we collect

If you use our contact form, we collect your name, email address, optional business name, the area you want help with and your message. If you email us, we receive your email address and whatever information you include in your message.

You choose whether to contact us. We need a name, a valid email address and enough information about your enquiry to respond. Please do not send passwords, payment details or sensitive personal information through the form.

Our server temporarily processes your IP address to respond to requests and protect the form against abuse. The form stores a coded version for short-term rate limiting rather than keeping your raw IP address with your enquiry. Technical error information may also be processed when needed to investigate faults or security incidents; form message contents are not written to application logs.

3. Why we use your information

• To answer your enquiry and discuss possible work. Where you ask us to take steps towards a contract with you, we rely on that pre-contractual purpose. For other business enquiries, including where you contact us on behalf of an organisation, we rely on our legitimate interest in responding to relevant requests and running our business.
• To keep the website reliable and protect it against misuse. We rely on our legitimate interest in providing a secure, functioning website.
• To meet legal obligations or deal with legal claims. Where applicable, we rely on the relevant legal obligation or our legitimate interest in establishing, exercising or defending legal rights.

We do not add contact-form enquirers to marketing lists. The form does not make automated decisions about you, and enquiry content is not sent to our AI agents or model providers.

4. Who handles your information

Information is available to authorised people who need it to deal with your enquiry. We use Hetzner to host the website and contact-form service in Germany, Resend to deliver contact-form notifications, and Microsoft 365 for business email. Resend receives the contact details and message you submit so it can deliver your enquiry to us. These providers process information to supply their services. We do not sell your enquiry details.

Some service-provider processing may take place outside the UK. Where information is transferred internationally, applicable adequacy arrangements or appropriate contractual safeguards are used. Microsoft describes its processing commitments and transfer safeguards in its Data Protection Addendum. Resend describes its processing, including processing in the United States and contractual transfer safeguards, in its Data Processing Addendum. Our chosen sending region is Ireland; this does not mean all Resend processing stays in Ireland. Contact us if you would like information about the arrangements relevant to your enquiry.

We may also share information with professional advisers or authorities where needed to comply with the law or establish, exercise or defend legal rights.

5. How long we keep it

Contact-form copies on the website server are kept for up to 30 days after the email service accepts the notification. Unresolved delivery records are kept for up to 90 days so a delivery problem can be investigated. The coded rate-limiting records are removed within 24 hours.

Resend retains email content, delivery information and logs for up to 30 days under its standard retention policy.

Email correspondence is kept for as long as needed to answer the enquiry and manage any resulting work. When deciding what to retain, we consider whether the conversation is still active, whether it relates to an ongoing agreement, and any legal, accounting or dispute requirements. We review information and delete it when it is no longer needed. If we agree to work together, additional information about the handling of project data may be provided as part of that agreement.

6. Cookies and tracking

This website does not use analytics, advertising cookies, tracking pixels or embedded social-media feeds. The contact form does not require cookies or local browser storage. Links to third-party websites take you to services with their own privacy and cookie policies.

7. Your rights

Depending on the circumstances, you may ask for access to your personal information, correction of inaccurate details, deletion, restriction of processing or a portable copy of information you have provided.

Your right to object: you may object to processing based on our legitimate interests. Tell us about your circumstances so we can consider your request.

These rights are subject to conditions and exceptions under data protection law. You can exercise them by emailing us. We may need to verify your identity before sharing or changing personal information.

8. Questions, complaints and updates

If you are concerned about how we have handled your information, please contact us so we can look into it. You can also complain to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint or by calling 0303 123 1113.

We will update this policy if the way we use information changes. The date above shows when it was last revised.