Privacy notice
What personal data Hobfolk processes, why, on what lawful basis, who it is shared with, how long it is kept, and your rights under UK GDPR.
1. Who we are
Hobfolk, Bradford Court Business Centre, 123–131 Bradford Street, Digbeth, Birmingham B12 0NS. Contact: hello@hobfolk.com. Hobfolk is a trading name of Farwinger Limited, registered in England and Wales, company no. 16047814. Contracts are with Farwinger Limited.
2. What we collect, and why
| Data | Why | Lawful basis |
|---|---|---|
| Name, work email, company, phone | To answer your enquiry and, if it goes further, to run the engagement | Legitimate interests; then contract |
| What you tell us about your business | To judge whether we can help, and to scope the work | Legitimate interests; then contract |
| Correspondence with us | To keep a record of what was agreed | Legitimate interests; legal obligation |
| Billing and payment records | To invoice you and to meet tax obligations | Contract; legal obligation |
| How the site is used | To see which pages are read, and where a page loses people | Consent, except the cookieless count below |
2a. Cookies and measurement
One thing measures this site with no cookie at all; three others set one, and only after you say yes. The cookieless count below runs from the moment the page loads and needs no asking, because it cannot identify you. Google Analytics, Microsoft Clarity and a Google Ads tag are wired in and will run if you accept — nothing from any of the three is fetched until you click Allow on the banner, and declining keeps them off for that visit. We do advertise, so you may have arrived here from one of our adverts; if you accept the measurement and then go on to start a conversation with us, the record of that enquiry notes which advert brought you, so we can tell which adverts are worth paying for. None of it builds a profile of you or follows you around other sites, and nothing is sold to anyone, ever.
| What | What it stores | How long |
|---|---|---|
| Cloudflare Web Analytics — counts page loads, the page, the referring site, country and device type. Runs for every visitor, before any consent choice, because it sets nothing on your device | Nothing. No cookie, no identifier, no record on your device | Not applicable |
| Google Analytics and Microsoft Clarity — visit counts and, for Clarity, a recording of how the page was used, to see where a page loses people. And a Google Ads tag, so that if an advert brought you here and the visit becomes an enquiry, we can tell which advert paid for itself. All three are switched on, and all three are gated: nothing is fetched until you accept on the banner below, and accepting never turns on ad personalisation — the Ads tag never builds a remarketing audience or follows you with ads elsewhere | First-party cookies from each, once you accept. Cleared if you withdraw consent below | Per provider; cleared on withdrawal |
| Meta pixel and LinkedIn Insight — prepared in the code, not switched on. No account exists for either yet, so nothing is configured to load them, for anyone. If either is turned on, this page changes first and you will be asked before it loads | Nothing | Not applicable |
| Reading and browsing this visit — collected as you move around the site, so that if you start a conversation on the contact page, it can pick up from what you have already read instead of asking you again | In sessionStorage, the list of pages you have read during this
visit, roughly how far down each one you scrolled, how long each was open in front of
you, and whether you opened any of its FAQ questions — deleted when you close the tab. In
localStorage, a single mark that says this browser has been here before, and
nothing else. No identifier either way | This visit; until you clear it |
| A count of what was read — as you leave a page, the same few numbers above are sent to us so we can see which pages are worth reading and which are not. This is our own measurement, and it runs alongside the third-party analytics above rather than instead of it. It is how we know whether the site works at all | To us only: the page, how long it was open, how far down it was read, how many FAQ
questions were opened, which page of the visit it was, where you arrived from, and the
country, region and city Cloudflare derives from your connection. Your IP
address is never stored. The visit carries a random reference that is created in
sessionStorage and gone when you close the tab, so two visits cannot be
connected to each other and none of it is connected to you. No cookie is set and nothing
is shared with anyone | This visit |
| Campaign parameters — if you arrive from a tagged marketing link or a Google Ads click, the campaign, source, medium and search term named in that link, and the page you landed on | One entry in sessionStorage, first-party, sent
nowhere unless you go on to start a conversation on the contact page — and then only to us,
as part of that enquiry | This visit |
Nothing on the contact page depends on any of that. It still knows the town the request came from, the time of day there and the weather — all of which come from the request itself and are stored nowhere.
The last three rows are the only things this site writes, and they are worth being precise about. None of them is a tracking cookie. None sets an identifier that outlives the tab, none is read by anyone but us, and none is shared with anybody. Two of them stay in your browser unless you choose to start a conversation — at which point they travel as part of that enquiry, so the desk that answers knows which advert brought you and what you had already read, rather than asking you to repeat yourself. The third, the count of what was read, is sent to us as you leave each page: it is how we measure whether the site is any use, and it runs alongside the third-party analytics above, not in place of it. It records what was read, not who read it — the visit's reference is random, dies with the tab, and your IP address is never stored. Everything here is deleted when you close the tab, apart from the single mark that says this browser has been here before. We rely on legitimate interests for all of it.
Nothing beyond what is named above is loaded. Not loaded-but-idle — never fetched. That is why the cookie banner below asks about exactly three things, no more: Google Analytics, Microsoft Clarity and the Google Ads tag. Decline and none of the three is fetched for that visit; accept and all three load, gated exactly as described above. The cookieless count in the first row runs either way, because it cannot identify you and there is nothing about it to ask.
If Meta pixel or LinkedIn Insight is ever switched on, this page is updated first, and the cookie banner is updated to ask about them too. Google explains its own role at how Google uses information from sites that use its services.
3. Automated processing
Correspondence with Hobfolk may be read, routed and answered by an automated system. This is what the service is, and it is disclosed in the footer of every message it sends. It does not constitute automated decision-making producing legal or similarly significant effects about you under Article 22 — decisions about whether to work together, what to charge and what to agree are made by people. If you would prefer a person to handle your correspondence, say so and we will.
The same applies to the conversation on the contact page. It is answered by an agent, not a person; it will tell you so if you ask, and it never sets a price or agrees a date. What you type there is kept as a transcript so the desk that picks it up can read what was actually said, along with the town the request came from and the pages you had read. If the enquiry does not become work, that transcript is deleted within twelve months, like every other enquiry. The language model behind it is operated by a sub-processor on our behalf, named on request; the conversation is not used to train it.
A short technical log of the exchange — each message, our reply, and which of our own checks it passed — is kept separately so the desk can be tested and fixed. This log is kept for 30 days and then deleted, whether or not the conversation went anywhere; it is not the twelve-month record above and does not extend it.
If you turn sound on, the desk's replies are spoken. The words are sent to a speech sub-processor to be turned into audio and are not stored there or used to train anything; your microphone, if you use it, is transcribed by your own browser and the audio never leaves your device. Sound is off unless you switch it on.
4. Who it is shared with
- Infrastructure and model providers who process data on our instruction under written terms, for hosting, email delivery and language processing.
- Our accountants and professional advisers, where relevant.
- Nobody else. We do not sell data and we do not share it for anyone else's marketing.
Some providers are outside the UK. Those transfers are covered by the UK International Data Transfer Addendum or an adequacy decision. The current list of sub-processors is available on request and forms part of the engagement agreement.
5. How long we keep it
- Enquiries that do not become work — 12 months, then deleted.
- Client records and correspondence — the engagement, plus 6 years (limitation and tax).
- Billing records — 6 years after the end of the accounting period.
6. Your rights
You have the right to ask for a copy of your data, to have it corrected, to have it deleted, to restrict or object to processing, and to portability. Write to hello@hobfolk.com and we will answer within one month.
If we do not resolve it, you can complain to the Information Commissioner's Office at ico.org.uk or 0303 123 1113.
7. Changes
If this notice changes materially we will tell current clients directly rather than relying on you noticing a new date at the top of a page.