How I handle your data

Privacy information for this website and the planned fire risk assessment workflow research.

Research invitations have not started. Contact-processing arrangements are still being reviewed; this notice will be updated before invitations begin. There is no registration form or mailing list.

Who is responsible

I run this research as an individual. Email and website hosting providers support the services described below.

What I hold, and where it came from

Initial research uses company-level information from Companies House and company websites. If you email me, your contact details and message come directly from you. Please do not send client-identifying or sensitive information.

• Company name, website, company number, source links and the date checked.
• If you contact me: your email address, information you choose to provide, and the correspondence needed to respond.
• Technical request information, such as IP address, requested URL and browser information, processed by the hosting provider to deliver and secure the site.

Before any research invitation, relevant professional contact details may be recorded from a public business source. The invitation will identify the source and link to the updated privacy information. Publication of a contact detail is not treated as consent.

Why

To ask three questions about how fire risk assessment reports are produced, and to record the answers so that I can decide whether to build software for it. I am not advertising a product and there is nothing to buy.

For operating this informational website securely and responding to enquiries you choose to send, I rely on legitimate interests in providing information and handling that correspondence. Providing information is voluntary. Legitimate interests is the proposed basis for limited research invitations, but the separate contact assessment and messaging checks are not complete. Invitations will not start until those checks are completed.

Who else sees it

I do not sell or rent contact details. Namecheap Private Email processes email correspondence. Cloudflare Pages hosts and delivers this website and may process technical access and security information. The private contact list and identifiable research replies are not published or uploaded with this site.

These providers operate internationally, including in the United States; this is not an EU-only hosting promise. Their published information describes their processing and transfer arrangements: Namecheap privacy policy, Cloudflare privacy policy and Cloudflare data processing addendum. Provider arrangements for the planned contact workflow remain under review.

I do not add advertising trackers, marketing analytics or tracking pixels. This does not mean the hosting provider keeps no technical logs. Published research findings will be checked for identification risk and contain no names, company names or identifying client information.

How long I keep it

• If you ask me to stop, or decline: I delete your details and keep only a minimal record that you are not to be contacted again.
• Research correspondence and identifiable research records will be deleted or irreversibly anonymised when the round closes, no later than 31 December 2026. Any separate purpose or extension will be explained beforehand.
• A minimal do-not-contact record is retained only as needed to honour an objection; its necessity is reviewed annually, rather than retaining a full profile.
• Hosting-provider technical records have their own service retention rules; the research-record deadline is not a promise about all provider logs.

Your rights

You can ask me for a copy of what I hold about you, ask me to correct it, ask me to delete it, request restriction, or object to processing based on legitimate interests. Other rights depend on the processing and legal basis. Email cagri@acsimsek.com and I will act on it without undue delay, normally within one month. If a permitted extension is needed, I will explain it within that first month.

You may complain to the Dutch Autoriteit Persoonsgegevens, the UK Information Commissioner's Office where relevant, or another competent data protection authority.

I do not make solely automated decisions about you with legal or similarly significant effects.