Your data rights

UK GDPR and Data Protection Act 2018 · Last updated 9 September 2026

This page explains the rights you have over your personal information under UK data protection law, how to use them, and the commitments JxD Collective makes when handling data. It sits alongside the privacy policy, which describes what is collected and why.

Who is responsible

JxD Collective, a sole trader business run by Josh Davies, is the data controller for information collected through this website and in the course of design work.

When building or maintaining a website for a client, JxD Collective usually acts as a data processor instead, handling information on that client's instructions. In those cases the client is the controller and their own privacy policy applies to their visitors and customers.

Your rights in full

The right to be informed

You are entitled to know what is collected about you and what happens to it. That is set out in the privacy policy.

The right of access

You can ask for a copy of the personal information held about you, along with an explanation of how it is used. This is often called a subject access request. There is no charge, and a response will be provided within one month.

The right to rectification

If anything held about you is wrong or incomplete, you can ask for it to be corrected.

The right to erasure

You can ask for your personal information to be deleted. This will be done unless it has to be kept for a legal reason, most commonly tax and accounting records relating to work that has been invoiced.

The right to restrict processing

You can ask for use of your information to be paused, for example while you are disputing whether it is accurate.

The right to data portability

Where information was provided by you and is processed on the basis of consent or a contract, you can ask for it in a common, machine-readable format, or ask for it to be sent to someone else.

The right to object

You can object to information being used on the basis of legitimate interests. You can also object to direct marketing at any time, and it will be stopped. In practice this site sends none.

Rights around automated decision-making

No automated decision-making or profiling with legal or similarly significant effects takes place. The only automated check on the site is the anti-spam challenge on the enquiry form, which decides whether a submission looks automated, not anything about you personally.

The right to withdraw consent

Where processing relies on your consent, you can withdraw it at any time. Doing so does not affect anything already done on the basis of that consent.

How to make a request

Write using the contact details above and say clearly which right you want to use. It helps to include enough detail to find your records, such as the email address you used and roughly when you got in touch. You may be asked to confirm your identity before information is released, so that data is not disclosed to the wrong person.

Requests are answered within one calendar month. If a request is particularly complex, that can be extended by up to two further months, and you will be told within the first month if that happens.

Data protection commitments

• Only what is needed. The enquiry form asks for the least information required to reply and quote. Only your name and email address are mandatory.
• No selling, no sharing for marketing. Your details are never sold, rented or passed on for anyone else's marketing.
• No mailing list. Getting in touch does not sign you up to anything.
• Security in transit. The site runs over HTTPS, and enquiries are transmitted over encrypted connections.
• Kept to a minimum. There is no customer database on this site. Enquiries arrive as email and are deleted once they are no longer needed.
• Deletion on request. Ask for your details to be removed and they will be, subject only to records that must be kept by law.

If something goes wrong

In the event of a personal data breach that is likely to result in a risk to people's rights and freedoms, the Information Commissioner's Office will be notified within 72 hours of becoming aware of it, and anyone at high risk will be told directly and without undue delay.

Complaints

If you are unhappy with how a request has been handled, please raise it directly so it can be sorted out. You can also complain to the Information Commissioner's Office, the UK's independent regulator for data protection.