what this site does with your data.

burningsuit is the trading name of Burningsuit Limited, a company registered in England and Wales under number 05738130. The registered office is The Courtyard, Shoreham Road, Upper Beeding, West Sussex, BN44 3TN.

I'm Alan Harman-Box, and burningsuit is me, so any question about your data comes straight to me at alan@burningsuit.co.uk. Burningsuit Limited is the data controller for the parts this site runs itself: the analytics below, and any enquiry or booking details once they reach me.

I use Plausible Analytics to see which pages people read and roughly where they arrive from. It's cookieless.

For each page view it stores the page address, the referring page, and your browser, operating system and device type (worked out from the user-agent your browser sends, which isn't itself kept), plus a coarse location - country, region and city - worked out from your IP address, which also isn't kept. There are no cookies, no browser storage, and no persistent identifier. To count unique visitors without one, Plausible works out a daily hash from a rotating secret plus the site and your IP and browser; the raw IP and user-agent are processed transiently to compute that hash, never written to storage, and the secret is deleted every 24 hours. So the data is isolated to a single day, site and device, and there's nothing there to build a profile from.

Why I do this: I want an aggregate, anonymous picture of which pages get read and where visitors come from, so I can make a small advisory's site better. That's my legitimate interest, and it's the lawful basis I rely on for this measurement. There's no profiling, and I don't sell or otherwise trade any of it.

Plausible is the processor here and I'm the controller, bound by Plausible's data processing agreement. Plausible is an Estonian company, and all visitor data stays in the EU on EU-owned infrastructure (in Germany, Finland and Slovenia); none of it is transferred to the US. The aggregated statistics are kept for three years.

If you'd rather not be counted, you can exclude this device right here. It takes effect straight away and costs you nothing.

exclude this device

One note on how this works: the analytics only run if your browser runs JavaScript. If you have JavaScript switched off, the script never loads in the first place, so there's nothing to opt out of. The button above sets a small flag in this browser that tells Plausible to ignore this device; pressing it again clears the flag.

The site is hosted on GitHub Pages, run by GitHub, Inc. GitHub logs visitors' IP addresses for security purposes; that's covered by GitHub's own privacy statement. GitHub is a US company, so serving the site this way involves a transfer of that log data to the US under GitHub's terms.

The "book a call" links take you to Cal.com to pick a time. That booking happens on Cal.com's own site, run by Cal.com, Inc. (a US company), under their privacy policy. When you book, I receive the details you give - your name, email and the time you chose - and from that point I'm the controller of them.

The "email me" links just open your own email program with my address filled in; the site itself doesn't process or send anything. Once your email reaches me, I handle it on Microsoft 365, and I'm the controller of it.

I keep enquiry and booking details for as long as the enquiry, or any work that follows from it, needs, and then I delete them. There's no fixed clock, and I don't hang on to things I've no reason to keep.

Under UK data protection law you have rights over your personal data. In plain terms, you can ask for:

• access - what I hold about you, and a copy of it;
• rectification - anything wrong put right;
• erasure - your data deleted;
• restriction - a pause on how I use it;
• objection - to my using it at all, including the analytics above;
• portability - where it applies, your data in a portable form.

To exercise any of these, email me at alan@burningsuit.co.uk. If you think I've handled your data badly you can complain to the Information Commissioner's Office, the UK's data protection regulator; you're welcome to raise it with me first.

This notice reflects how the site works today. If I change the setup, a different analytics tool say, or a new way of taking bookings, I'll update this page to match it.

Last updated: 16 July 2026.