Who I am
This Privacy Policy explains how personal data is collected, used, shared and protected when you visit roberthopkins.net or send a message through it.
roberthopkins.net is a personal website run by Rob Hopkins in Ireland ("I", "me", "my"). I am the data controller for the personal data described in this policy.
I follow the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the Data Protection Acts 1988 to 2018, the European Communities (Electronic Communications Networks and Services) (Privacy and Electronic Communications) Regulations 2011 (S.I. No. 336 of 2011, the "ePrivacy Regulations") and any law that replaces them.
What I collect
- When you send a message: your name, your email address, what your message is about, the message itself, and the country your request came from where the hosting provider supplies it (worked out from your IP address, not stored separately).
- When you visit: the technical details every website receives, such as your IP address, browser, device, the pages you request and when. The hosting provider's firewall and logs use these to keep the site secure and working.
- Analytics, only if you agree: how you use this website, such as the pages you view, measured by Google Analytics through Google Tag Manager.
- Advertising, only if you agree: if advertising is switched on for this website, Google AdSense may measure and, where you allow it, personalise the adverts you see.
- Your cookie choice: which optional cookies you accepted or refused.
The tumbleweeds count how many have rolled past, but only in your own browser while the page is open. Nothing about them is stored or sent anywhere.
Please do not send special category data, such as health information, through the contact form.
Why I use it, and the lawful basis
| Purpose | Lawful basis under the GDPR |
|---|---|
| Replying to your message and keeping a record of it | Legitimate interest (Article 6(1)(f)): answering the people who get in touch. If you are asking about work, steps before a contract (Article 6(1)(b)). |
| Keeping the website and contact form secure, including spam and abuse checks | Legitimate interest (Article 6(1)(f)): protecting the website and the people who use it. |
| Analytics cookies | Consent (Article 6(1)(a)), which you can withdraw at any time. |
| Advertising cookies, if advertising is switched on | Consent (Article 6(1)(a)), which you can withdraw at any time. |
| Meeting legal obligations, such as answering a regulator | Legal obligation (Article 6(1)(c)). |
I do not sell your personal data, and I never add people who get in touch to a mailing list.
Who it is shared with
A small number of trusted providers help run this website. Each one processes personal data under a data processing agreement or equivalent terms, and only for the service it provides.
- Microsoft (Azure): hosting, the web application firewall and security logs, in the EU (the Netherlands).
- Cloudflare: DNS for the domain, and Turnstile, the check on the contact form that tells people from automated scripts.
- Resend: delivering the contact form emails.
- Google: Google Tag Manager and Google Analytics, only if you accept analytics cookies. If advertising is switched on and you accept advertising cookies, Google AdSense, for which Google acts as an independent controller under Google's privacy policy.
Personal data may also be shared if the law requires it, or to protect my rights or the rights of others.
International transfers
Some of these providers are based in, or may access data from, the United States. Where personal data leaves the European Economic Area, I rely on the EU-US Data Privacy Framework where the provider is certified under it, or on the European Commission's Standard Contractual Clauses, in line with Chapter V of the GDPR.
How long it is kept
- Contact form messages: up to two years from your last message, unless they lead to work together, when the records for that work apply.
- Security and access logs: a short period, normally no more than 90 days.
- Google Analytics data: 14 months.
- Your cookie choice: six months, after which you are asked again.
How it is protected
The website runs on Microsoft Azure in the EU and can only be reached through Azure Front Door with a web application firewall. Outbound traffic passes through a firewall with an allow list, secrets are kept in Azure Key Vault, and everything is encrypted in transit.
No website can be perfectly secure, but I take care to protect your data, and I will tell you and the Data Protection Commission without undue delay if a breach puts your data at risk.
Your rights
Under the GDPR you have the right to:
- access the personal data I hold about you and get a copy;
- correct anything that is wrong or incomplete;
- erase your data, where there is no good reason to keep it;
- restrict how it is used while a concern is looked into;
- object to its use based on legitimate interest;
- move it to someone else in a common format (data portability);
- withdraw consent at any time, for example through Cookie settings at the bottom of every page, without affecting anything done before.
To use any of these rights, send a message through the contact form and choose "A privacy or data request". I will reply within one month, as the GDPR requires, and may ask you to confirm your identity first. There is no charge.
Cookies
Only strictly necessary cookies are used, unless you agree to analytics or advertising cookies. The Cookies Policy lists them all.
Children
This website is not aimed at children, and I do not knowingly collect personal data from anyone under 16.
Changes to this policy
This policy may be updated from time to time. The date at the top of the page shows the latest version. If a change is significant, this page will say so.
Contact and complaints
To ask about this policy or to use your rights, please use the contact form and choose "A privacy or data request".
You also have the right to complain to the Data Protection Commission, the supervisory authority in Ireland, at dataprotection.ie or 21 Fitzwilliam Square South, Dublin 2, D02 RD28.