Privacy notice

You provide your name, agency name, email address, optional phone number and message when you contact me through the form. Name, agency, email and a message are required so I can understand and respond to an enquiry; you can use the direct contact links instead. Please do not include seller information, property-owner details or sensitive personal information.

The website records the submission time, a random enquiry reference and a hash of the submitted fields to recognise a retry. A hash is not anonymisation. Rejected form submissions are not added to the enquiry database, although hosting systems may record the request.

If you use the AI support planner, you provide coverage dates, selected Essex or Ipswich locations, expected appraisal volume, volume basis and the type of support needed. These requirements may reveal business plans, even without your name.

For ordinary enquiries, including messages from people representing an agency, my intended basis is legitimate interests: communicating with prospective business clients and responding to the support they request. I must confirm and document that this use is necessary and proportionate, taking account of your reasonable expectations and rights, before launch.

Where you personally ask me to take necessary steps towards a contract with you as an individual, such as a sole trader, the contract basis may apply. A possible contract with your employer does not by itself make the contract basis applicable to your personal data.

Protecting the form, preventing repeat submissions and investigating technical faults are intended to rely on legitimate interests in operating a safe, reliable website, subject to the same assessment. The optional AI feature processes the requirements you submit to provide the draft you request; its intended basis is legitimate interests in responding to that request, with contract used only where its conditions actually apply.

I do not use this form to enrol you in marketing or send automatic visitor confirmation emails. The site does not run advertising or marketing analytics. Any future marketing or different use would need its own lawful-basis and electronic-marketing review.

Validated enquiries are saved privately in Lovable Cloud before an owner notification is requested through Lovable managed email. The notification includes your contact fields, message and reference, and uses your validated email as reply-to. It goes only to my business address, max@theagencypartner.co.uk, using noreply@mail.notify.theagencypartner.co.uk as sender. An accepted or sent event is not proof of inbox receipt.

My business mailbox uses Google Workspace. Direct email, telephone and WhatsApp links open the respective service only when you choose them; WhatsApp is a separate Meta service. Their own processing terms apply to your use of those services. There are no embedded WhatsApp widgets on the site.

Website hosting and asset delivery, Lovable Cloud, managed email, Google Workspace and Lovable AI are relevant service categories. Lovable publishes a data-processing agreement and subprocessor roster. Its public agreement distinguishes processing customer data on customer instructions from some service/log processing for its own purposes. I still need to confirm the agreement applicable to my account and the providers involved in each flow; I do not claim that every provider acts solely as my processor.

The planner sends your validated requirements and a calculated planning estimate to Lovable AI Gateway, using an OpenAI model (gpt-6-astra). It streams the draft and any drafting notes back to your browser. The website does not write your brief or proposal to its application database or browser storage, and it does not send the proposal to me unless you choose to copy and email it.

The request uses store: false. This does not establish that hosting, gateway or provider logs retain nothing. OpenAI publishes API data controls with default abuse-monitoring retention of up to 30 days, exceptions and approved reduced-retention options. These are general provider terms, not a verified retention period for this managed Gateway flow. Gateway logging and other traces may be separate; my applicable payload policy, retention controls, processing locations and provider terms remain to be confirmed.

The output is an optional AI-generated draft, not an agreed quote, booking, assessment of your eligibility or decision with legal or similarly significant effects. I do not use it to make automated engagement decisions or profile you. Availability and practical arrangements require a direct discussion.

Web requests necessarily disclose connection information such as IP addresses to the hosting and delivery services. Platform request/error logs may contain URLs, timestamps, browser information, error messages or stack traces. The application can forward page errors to Lovable reporting hooks when present; these were not present in the local public-page audit. The actual hosted-preview and future production logging settings and retention remain unverified.

The enquiry database and its spam limiter do not record IP addresses or user-agent strings. This statement does not cover separate provider logs. Fonts are now served with the website rather than requested from Google Fonts. The cookies notice describes the storage observed on public pages and the separate preview/authentication limitations.

I have approved monthly enquiry reviews. Closed or unanswered enquiries are deleted through a controlled private review workflow when 12 calendar months have passed since the last substantive contact, unless a documented legitimate reason or legal hold requires longer retention. This is a manual responsibility, not a scheduled automatic purge; the first operational review remains to be completed.

The website now tracks active, closed, unanswered and unreviewed enquiries, confirmed last substantive contact, review time and documented retention holds. Active enquiries and held records are protected from the controlled deletion workflow. Existing enquiries remain unreviewed with no inferred last-contact date until their correspondence is checked; they are never deleted based on creation date alone. New enquiries start active, with the initial message as first contact. Private deletion requires explicit selected references and a current version check; changed or ineligible selections are rejected.

Minimal review timestamps/deletion counts and random retired references are retained separately, without enquiry fields or payload hashes. Retired references prevent old retries recreating deleted enquiries; these operational records have no automatic purge and their continued need is reviewed separately. Email notifications, mailbox correspondence, provider logs and backups are separate copies; deleting an enquiry row does not delete those copies. Their retention and any contract/accounting-record policy need a separate owner/provider review. No universal statutory retention period is asserted here.

Spam-protection references and timestamps stop counting after their rolling 24-hour window. Records older than 24 hours are removed on the next form intake; if no further intake occurs they can remain physically stored longer. The planner stores operational access-denial status separately, without visitor requirements or proposals, until access is restored and that state is cleared.

The form validates fields in the browser and server, bounds request size, checks the submission origin and uses a honeypot and shared persistent submission limits. Enquiry tables have row-level security enabled, and anonymous and signed-in visitor roles have no direct read/write access. Privileged storage and sending credentials stay on the server.

The notification template escapes visitor text and has a fixed owner recipient. Same-reference retries do not create another enquiry or another notification. Notification errors are logged by category rather than by message contents. These controls reduce risk but cannot guarantee absolute security or email delivery. Secure account access, mailbox access, backups and provider arrangements also need ongoing review.

Public provider documents disclose processing across Europe, the UK, the US and global infrastructure. Lovable describes global website delivery separately from the region where database information is stored. I cannot yet confirm the full processing-country and subprocessor map for this account, including email, AI, logs, support access and backups. Please do not assume all data stays in the UK or that store: false proves this.

The public Lovable data-processing agreement includes EU Standard Contractual Clauses amended by the UK Addendum for relevant UK transfers. OpenAI also publishes UK Addendum provisions. Their publication does not by itself establish which agreement or safeguards cover every transfer for my account. Before launch I need to confirm contractual coverage, actual recipients and countries, any adequacy basis or applicable UK transfer mechanism, required assessments and onward-transfer safeguards. You can contact me to request relevant safeguard information; I will update this notice with verified account-specific details. This remains a launch-review item.

You can ask me for access to your personal data, correction, erasure or restriction, and object to processing based on legitimate interests. Portability may apply to automated processing based on consent or contract. These rights depend on the circumstances; I will explain any lawful limitation. If future processing relies on consent, you can withdraw it without affecting earlier lawful processing.

Contact me using the details above, preferably including your enquiry reference if you have it. I may need proportionate information to confirm identity. I will normally respond within one month; where a lawful extension is necessary I will explain it within that month. There is normally no fee.

You can complain directly to the Information Commissioner’s Office (ICO) at ico.org.uk/make-a-complaint/ or on 0303 123 1113. You do not have to contact me first.

I review enquiries monthly under the retention policy above, and apply the same 12-month approach to enquiry emails in my mailbox, subject to documented exceptions. Provider agreements, processing locations, transfers and log retention described above as unconfirmed remain under review, and I will update this notice when they are verified. I have confirmed that no ICO data protection fee is payable for my business; that is my own assessment based on my current activities, not a formal ICO determination, and I will reassess it if what I do changes.

This version was last updated on 3 November 2026. An engagement involving client CRM access or seller data needs separate written confidentiality and data-protection arrangements; it is not covered merely by submitting this website form.