Legal
Privacy notice
This notice explains what happens to personal data when you contact us or use this site. It is written to be read, not to be survived.
DRAFT - the ICO registration number and the three retention periods still need deciding. Worth a solicitor's eye before it goes live.
Last updated: 23 September 2026
Who we are
444Video (444 Video Limited, registered in England and Wales, company number 15988386, registered office 24 Kemble Road, Monmouth, Wales, NP25 5GB) is the data controller for the personal data described here. For anything in this notice, email info@444.video.
We are registered with the Information Commissioner’s Office under registration
[ICO REGISTRATION NUMBER].
What we collect, and why
When you contact us. The contact form asks for your name, email address, organisation and whatever you write in the message. If you email us directly we hold whatever you send. We use it to answer you and, if we end up working together, to run the project.
Our lawful basis is legitimate interests - responding to someone who has deliberately got in touch is what they are asking us to do. Once you become a client, the basis for the data we need to deliver the work is performance of a contract.
When you use the site. Our host keeps ordinary access logs, which include IP addresses, for security and troubleshooting.
We measure visits in two ways. Cloudflare Web Analytics runs for everyone: it counts page views in aggregate, sets no cookies and does not build a profile of you or follow you across other sites. Google Analytics runs only if you accept it: it does set cookies, and it tells us which pages are read and roughly where visitors come from. If you decline, or ignore the banner, Google Analytics is never loaded - no tag, no script, no request.
What we do not do. We do not sell personal data, share it with advertisers, use it for automated decision-making or profiling, or send marketing email to people who have not asked for it.
How long we keep it
| What | How long |
|---|---|
| Enquiries that do not become work | [12 months] from the last message |
| Client correspondence and project records | For the life of the engagement, then [6 years] for tax and contractual reasons |
| Web server access logs | [30 days] |
| Analytics | Aggregate only, retained indefinitely - it is not personal data |
Who else handles it
We use a small number of established suppliers, each of which processes data on our instructions:
- Google Workspace - email and documents
- Slack - where enquiries are notified internally
- Cloudflare - sits in front of the site for security and performance, and may set a strictly necessary cookie to identify malicious traffic
- Our own hosting - the site runs on infrastructure we operate ourselves in the United Kingdom
- Cloudflare - as well as sitting in front of the site, supplies the cookieless Web Analytics we use for aggregate visit counts
- Google - Google Analytics, but only where you have accepted it. Google processes that data for its own purposes as well as ours, which is why it is behind a consent choice rather than switched on by default
- OpenStreetMap - supplies the basemap tiles on our field report pages. Your browser requests those tiles directly, so the OpenStreetMap Foundation’s tile servers see your IP address when you open a page with a map on it. No other page loads them.
- CDN-hosted libraries - the field report pages load two open-source charting and mapping libraries. Where we serve them ourselves, nothing leaves our own infrastructure; where we do not, your browser fetches them from the library’s CDN.
Where a supplier processes data outside the UK - which includes Google, if you have accepted analytics - that transfer relies on the appropriate safeguards, normally the UK International Data Transfer Addendum or the UK extension to the EU-US Data Privacy Framework.
Cookies
We set no cookies of our own.
Google Analytics sets cookies, so we ask first. Accepting is one click and so is declining, and nothing is loaded until you choose. You can change your mind at any time using Cookie settings at the foot of any page - declining afterwards stops Google Analytics loading on your next page view, and you can clear the cookies already set through your browser.
Cloudflare may set a strictly necessary security cookie to identify malicious traffic. That one is exempt from consent requirements under PECR, so it is not part of the choice above.
Our reading is that analytics of this kind needs consent: the “strictly necessary” exemption is narrow, and while the Data (Use and Access) Act 2025 introduced a statistical-purposes exception, it is drawn tightly around a site’s own first-party measurement rather than third-party tools.
Your rights
Under UK GDPR you can ask us to give you a copy of the personal data we hold about you, correct it if it is wrong, delete it, restrict or object to how we use it, or provide it in a portable format. Ask by emailing info@444.video and we will respond within one month.
If you are not satisfied with how we have handled your data, you can complain to the Information Commissioner’s Office at ico.org.uk, by phone on 0303 123 1113, or in writing to Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. We would rather you raised it with us first, but you do not have to.
Changes
If we change this notice we will update the date at the top. Material changes will be flagged on the page for a reasonable period.