Privacy Policy

We collect as little personal data as we can. With your permission, we use Google Analytics to understand how this website is used. Otherwise, we only hold what you choose to send us, and what we need to work with clients.

Who we are

This website is run by Ostrich and Zebra, a trading name of Hudson Portfolio Limited. We are the controller of the personal data described in this policy, which means we decide how and why it is used.

• Company: Hudson Portfolio Limited, registered in England and Wales, company number 14020027
• Registered office: Gilmarde House, 47 South Bar Street, Banbury, Oxfordshire, OX16 9AB
• Information Commissioner's Office registration: ZB486319
• Contact: hello@ostrichzebra.com or 01865 507264. Our data protection contact is Ashton Lee Hudson, at the same email address.

What we collect and why

For each kind of personal data, we set out the lawful basis we rely on under UK data protection law.

When you visit any page

The site is hosted by Cloudflare. To deliver pages and keep the site secure, Cloudflare processes technical information such as your IP address, browser type and the page you requested.

Lawful basis: our legitimate interest in running a secure, working website.

If you accept analytics cookies

Google Analytics records the pages you view, how you arrived, how long you stay, the type of device and browser you use, and your approximate location (country and city, worked out from your IP address). Google Analytics does not store your full IP address. We see this information only in combined reports, never as a record of one person, and use it to improve the site.

We do not use Google Analytics for advertising, and we do not link your visit to your Google account.

Lawful basis: your consent. You can withdraw it at any time using Cookie settings, which also appears at the bottom of every page.

If you reject analytics cookies, or have not chosen yet

No analytics cookies are set. When a page loads, your browser still sends Google a basic signal without any cookie or identifier, which tells Google that a page was viewed and that analytics cookies were not accepted. Google uses these signals to estimate overall visitor numbers, and they cannot be used to recognise you on a later visit.

Lawful basis: our legitimate interest in understanding, in general terms, how much the site is used.

When you request a discovery call

The enquiry form collects your name, email address, business name and turnover range, and your telephone number and website if you choose to give them. We use them to reply to you and to prepare for the call. We don't add you to a mailing list.

Lawful basis: our legitimate interest in responding to enquiries and, if you go ahead, taking steps at your request before entering into a contract.

When you email or call us

We keep the content of our correspondence and its details, such as dates and email addresses, so we can reply and keep proper records.

Lawful basis: our legitimate interest in running the business.

If you become a client

We process the contact and business information needed to deliver and invoice the work, and any data you share with us as part of it.

Lawful basis: performing our contract with you, and complying with our legal obligations, for example for accounting records.

Please don't send us anyone else's personal data unless we ask for it.

Cookies

Cookies are small files a website stores in your browser. Some sites also use your browser's local storage, which works in a similar way. This site uses analytics cookies only if you accept them, plus a few things it needs to work.

Analytics cookies, only if you accept

• _ga, set by Google Analytics. Lets it tell one visitor from another, so visits can be counted. Lasts 2 years.
• _ga_<ID>, set by Google Analytics. Keeps track of your current visit. Lasts 2 years.

Needed for the site to work, so no consent is required

• Security. Cloudflare, which hosts the site, may set a cookie to protect it from abusive traffic.
• Spam protection. The enquiry form uses Cloudflare Turnstile to check that a person, not automated software, is sending it. Turnstile does not set cookies to track you, and Cloudflare does not use the information it checks for advertising.
• oz-consent (local storage). Remembers whether you accepted or rejected analytics cookies, so we don't ask on every page. Lasts 12 months, then we ask again.

We do not use advertising cookies, and no cookies on this site are used to track you across other websites.

You can change your choice at any time using Cookie settings. You can also block or delete cookies in your browser's settings, although blocking the cookies the site needs may stop parts of it, such as the enquiry form, from working.

How long we keep it

• Enquiries and correspondence: up to two years after our last contact, then deleted.
• Client data: at least two years after our work together ends, and longer where the law requires it, for example six years for accounting records.
• Google Analytics data: 14 months, after which Google deletes it automatically.
• Technical information processed by Cloudflare: a few days, as part of its normal security and operations logs.
• Your cookie choice: 12 months, on your own device.

Who we share it with

We don't sell personal data. We share it only with the companies that help us run the business, which act on our instructions under contracts that require them to protect it:

• Cloudflare, which hosts this website and runs the spam check on the enquiry form.
• Resend, which delivers enquiry form submissions to our inbox.
• Microsoft, which provides our email and business records through Microsoft 365.
• Google, which provides Google Analytics.
• Our insurers and professional advisers, where reasonably necessary.

We may also disclose personal data where the law requires it, or where it is needed to establish, exercise or defend legal claims.

Outside the UK

Cloudflare, Resend, Microsoft and Google may process information in the United States and other countries outside the UK. Where they do, the transfer is protected by the UK–US data bridge, where the company is certified under it, or by the UK International Data Transfer Addendum to the standard contractual clauses approved by the Information Commissioner.

Your rights

Under UK data protection law, you have the right to:

• ask for a copy of the personal data we hold about you;
• ask us to correct it if it is wrong, or to delete it;
• ask us to limit how we use it;
• object to our using it where we rely on our legitimate interests;
• withdraw your consent to analytics cookies at any time, using Cookie settings;
• receive data you gave us, where we rely on your consent or a contract, in a format you can take elsewhere.

To use any of these rights, email hello@ostrichzebra.com. There is no charge, and we will reply within one month. We may need to confirm who you are before we act on a request.

We do not make decisions about anyone using automated processing.

Complaints

If you have a concern about how we handle your personal data, please contact us first at hello@ostrichzebra.com and we will try to put it right.

You also have the right to complain to the Information Commissioner's Office, the UK's data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113.

Changes to this policy

If we change how we handle personal data, we will update this page and the date at the top. If a change affects your choice about cookies, we will ask you again.