Draft for review before public launch. Complete the legal entity and mailing address below. The operator must also verify provider contracts, international-transfer safeguards, hosting-log retention, and the historical collection disclosures before treating this notice as final. This draft describes the website implementation; it does not certify legal compliance.
Who is responsible for your information?
SundayClicks is the trading name of [LEGAL ENTITY NAME — complete before launch]. That entity is the controller of the personal information described in this notice.
Mailing address: [FULL MAILING ADDRESS, INCLUDING COUNTRY — complete before launch].
Privacy contact: Email our privacy team (opens Gmail in a new tab).
This notice covers visitors, people making business inquiries, and related correspondence. Separate terms or notices may apply to an agreed client engagement. Privacy laws apply according to factors such as location, the nature of our activities, and statutory thresholds. Nothing in this notice reduces rights provided by applicable law.
What information do we collect?
We collect information you choose to send, limited delivery records, and technical information generated when the website is used.
| Category | Examples and sources | Why it is needed |
|---|---|---|
| Identifiers and contact details | Your name and email, provided directly in a form or email. | Respond to you and manage the conversation. |
| Business and professional information | Company name, website, service of interest, and business context you provide. | Understand the inquiry and assess a possible scope. |
| Correspondence and acknowledgement | Your message, subsequent emails, permission to respond, notice acknowledgement, submission time, and inquiry reference. | Handle the request and document the communication. |
| Internet or network activity | Hosting systems may process IP address, requested URLs, timestamps, browser/device information, referrer, response status, and security events. | Deliver the site, investigate errors, and prevent misuse. |
| Delivery and abuse-prevention records | A random request identifier, a hash derived from your email, delivery status, and creation, update, and expiry times. | Reduce repeated submissions and avoid duplicate delivery. |
Name, email, service of interest, message, and the required acknowledgement are needed to use the form. Company and website are optional. You can email us instead. Not providing contact details may prevent us from responding.
A previous form also allowed a primary goal, budget range, website platform, notes, and preferred meeting details. Previously submitted records may remain in the website database under the retention schedule below. The current form does not request those extra fields or store complete new inquiries in that database.
Please do not submit passwords, payment details, government identifiers, medical information, or other sensitive personal information. We do not intentionally request such information, precise location, biometric information, or advertising profiles. A free-text message may contain information you volunteer; we handle it only as needed for the request or an applicable obligation.
Information comes from you, from your browser or device through hosting infrastructure, and from our providers’ delivery and security systems. If you supply another person’s details, share only what you are authorised to provide.
Why do we use it, and on what legal basis?
We use information to handle inquiries, operate the website, protect it from abuse, and comply with applicable obligations. We do not add form users to a marketing list.
| Purpose | EEA / UK legal basis, where applicable |
|---|---|
| Discuss a service requested by an individual who may contract with us | Steps requested before entering a contract, or performance of that contract: Article 6(1)(b). |
| Respond to general inquiries or a business representative | Legitimate interests: Article 6(1)(f). Our interest is conducting relevant business communications and assessing requested services, balanced against your rights and reasonable expectations. |
| Protect and maintain the site; manage duplicate submissions | Legitimate interests: Article 6(1)(f). Our interests are service reliability, fraud and spam prevention, and proportionate troubleshooting. |
| Meet applicable legal requirements and handle rights requests | Legal obligation: Article 6(1)(c), where that law provides this basis. Necessary legal-claim handling may rely on legitimate interests. |
| A distinct optional use that genuinely relies on consent | Consent: Article 6(1)(a), requested separately before that use. There is no optional marketing or tracking consent in the current form. |
The required checkbox records permission to respond and acknowledgement of this notice. It does not waive your rights, authorise marketing, or replace the applicable basis for necessary handling. If we rely on consent for a particular use, you may withdraw it by emailing us; earlier lawful processing is unaffected. You may also ask us to stop an inquiry conversation.
We do not use this site to make decisions about you based solely on automated processing that have legal or similarly significant effects. Automated validation and spam checks may reject a submission; direct email provides an alternative contact route.
Who receives the information?
We use the following providers to operate the website and respond to messages. Information is disclosed for these service purposes, not for our advertising campaigns.
- FormSubmit (formsubmit.co): our server sends the form fields, acknowledgement, submission time, policy link, and inquiry reference to FormSubmit for forwarding to our inbox. The application does not deliberately include the visitor’s IP or browser headers in that message. FormSubmit may process connection metadata from our server. See its privacy notice and service documentation.
- Google / Gmail: inquiries and replies are handled in our business email inbox. Our email links open Gmail in a new tab with our recipient address and a subject prefilled. Google handles that session under its own terms; you may need to sign in. You can use our contact form instead. Google’s service processing is described in its Privacy Policy. This address is not represented as a verified Google Workspace account.
- OpenAI Sites and Cloudflare infrastructure: provide hosting, request routing, access controls, security, and the database for limited delivery records and historical inquiries. Hosting providers can process technical information needed for those functions. When private access requires an account, the hosting platform also handles authentication under its own notice.
- Authorised personnel and advisers: those who need information to handle your inquiry, administer services, meet legal obligations, or establish or defend legal claims.
- Legal or business recipients: where necessary and lawful, competent authorities or advisers in a genuine business transfer. Any materially different use would require an appropriate basis and notice.
We do not publish inquiry information or send it to advertising networks. We aim to disclose only what is necessary. The exact contractual roles and protections of each provider must be verified by the operator before public launch; this draft does not assert that a signed processor agreement is already in place.
Where is information processed?
Our inquiry inbox and hosting services can involve processing in the United States and other countries used by the named providers. Those countries may have different privacy protections from your home country.
Where GDPR or UK GDPR transfer restrictions apply, a transfer must have a valid mechanism and any required supplementary safeguards. Depending on the recipient and arrangement, this may involve an applicable adequacy decision or approved contractual safeguards, together with the required assessment. Routine transfers are not justified merely by checking the inquiry consent box.
Transfer details pending verification: [CONFIRM RECIPIENT COUNTRIES, PROCESSOR CONTRACTS, APPLICABLE TRANSFER MECHANISMS, AND HOW TO REQUEST A COPY OF SAFEGUARDS]. FormSubmit’s public notice does not establish these arrangements. Do not treat this section as confirmation that Standard Contractual Clauses, a UK IDTA/Addendum, or an adequacy framework applies to these particular accounts. The operator must resolve this before a launch that involves restricted transfers.
Contact our privacy team (opens Gmail in a new tab) for information about the arrangements applicable to your inquiry. Where required, an EEA or UK representative and their contact details must also be appointed and added following the operator’s applicability review.
How long is information kept?
Retention depends on the purpose, the relationship, and legal requirements. The following schedule distinguishes application behaviour from records that require the operator’s ongoing administration.
| Record | Period or criteria |
|---|---|
| Routine inquiries and correspondence | Proposed operating schedule: review and delete within 12 months after the last substantive contact when no engagement, dispute, or legal need remains. The operator must carry out this mailbox review; it is not an automated Gmail deletion rule. |
| Historical full inquiries in the website database | The same 12-month review schedule, unless an active relationship or legal need justifies longer retention. These records have not been automatically deleted by this redesign. |
| Current delivery/abuse receipts | Expire after 24 hours and are deleted on the next request-triggered cleanup. Deletion can occur later when no further submission triggers cleanup. Email hashes are pseudonymous personal information, not anonymous data. |
| FormSubmit archive | FormSubmit’s documentation states that form submissions are retained for 30 days. Copies already delivered to Gmail follow the inquiry schedule. |
| Client, legal, and rights-request records | Only for the period needed for the active relationship, to document rights handling, or for applicable legal retention and limitation periods. A specific legal hold overrides routine deletion only while necessary. |
| Hosting and security logs | According to the provider’s applicable security and operational retention settings and any required incident investigation. [CONFIRM ACTUAL HOSTING LOG AND BACKUP RETENTION BEFORE LAUNCH]. |
Provider backups may persist until their normal deletion cycle. Restricted retained copies should not be restored for an unrelated purpose. You may request earlier deletion; we will explain any lawful reason we must retain particular information. The operator must confirm and implement the proposed administrative schedule before finalising this notice.
How can you exercise your privacy rights?
Email our privacy team (opens Gmail in a new tab) with your request. We accept privacy questions from all visitors. The rights available and any exceptions depend on the law that applies.
EEA and United Kingdom
Where GDPR or UK GDPR applies, you may request access, correction, deletion, restriction, and, for eligible processing, a portable copy of information. You may withdraw consent for processing based on consent.
Right to object: you may object to processing based on legitimate interests because of your particular situation. If any direct marketing were introduced, you could object to that use at any time.
We will respond within the applicable period, normally one month. A permitted extension will be explained within the original period. Rights are not absolute; we will explain a refusal and available remedies. We may request proportionate information to verify identity, and normally do not charge a fee.
You can complain to your competent supervisory authority, including in the EEA country where you live or work or where an alleged infringement occurred. The EDPB authority directory provides contact details. In the UK, contact the Information Commissioner’s Office. You do not have to contact us first.
Verification and authorised representatives
Use the email associated with your inquiry where possible. We may ask for limited information that matches our records; please do not send identity documents unless we request them through an appropriate process. An authorised agent may act where permitted. We may verify the agent’s authority and, where lawful, your identity. Information used for verification is limited to handling and documenting that request.
What about US state privacy laws and GPC?
Where laws such as the CCPA, as amended by the CPRA, or another applicable state privacy law cover our processing, eligible residents may have rights to know or access information, correct inaccuracies, request deletion, obtain a portable copy, and opt out of specified processing. We will not unlawfully discriminate against you for exercising a right.
The categories, sources, purposes, recipients, and retention criteria are set out above. Relevant categories include identifiers, professional or business information, correspondence, and internet/network activity. The operator must verify the applicable preceding-12-month collection and disclosure history before this draft is finalised; this notice does not invent a historical data audit.
No sale, sharing for advertising, or targeted advertising
We do not sell personal information, share it for cross-context behavioural advertising, or process it for targeted advertising. We do not intentionally collect sensitive personal information for additional purposes that would require a right-to-limit mechanism, and we do not use significant-effect profiling.
Global Privacy Control: we respect GPC and other applicable recognised opt-out signals as requests to opt out of sale, advertising sharing, and targeted advertising. The current site does none of those activities for any visitor, so no such processing needs to be switched off when a signal is present. We do not require an account or additional form to maintain that position. Other “Do Not Track” signals do not change the site’s already non-advertising configuration.
Requests, response periods, and appeals
Contact our privacy team (opens Gmail in a new tab). We will handle requests within applicable deadlines, explain any permitted extension, and apply only lawful exceptions. California access, correction, and deletion requests generally have a 45-day response period, subject to permitted extensions.
If we decline a request, you may appeal by replying to our response or emailing the same address with “Privacy appeal” in the subject. Explain which decision you want reconsidered. We will review it, give written reasons within the applicable statutory period, and tell you how to contact the relevant state attorney general or regulator if the appeal is denied. Deadlines vary by state; we do not impose a shorter request or appeal window than the law allows.
More information about California rights is available from the California Attorney General. This notice does not claim that every state statute applies to our business irrespective of its thresholds or exemptions.
Is this site intended for children?
No. SundayClicks offers business services to adults. The site is not directed to children under 16, and we do not knowingly seek their personal information. We do not knowingly sell or share minors’ information for advertising.
If you believe a child has provided information, email our privacy team (opens Gmail in a new tab). We will assess the situation and delete information collected without the authorisation required by applicable law, including any applicable protections for children under 13.
How is information protected?
The application uses HTTPS, server-side validation, a hidden spam field, submission limits, and restricted server-side storage. It does not expose an inquiry-listing endpoint or deliberately log message bodies. Access to the inbox and hosting accounts should be limited to authorised people and protected with appropriate account controls.
No website or email system can guarantee absolute security. Avoid sending sensitive documents or credentials through the form. If a security incident requires notice under applicable law, the operator must provide that notice and take appropriate response steps.
How are changes communicated?
We will update the date at the top when this notice changes. Material changes will receive additional notice when required, and a new purpose or technology will be assessed before it is introduced. A policy update does not by itself authorise an incompatible new use.
For questions, rights requests, withdrawals, or appeals, email our privacy team (opens Gmail in a new tab) or write to the completed mailing address above. You can also use the contact page.
Before public launch: complete the marked details, implement the retention schedule, verify provider and transfer arrangements, and have a qualified lawyer review this notice against the actual business practices.