Privacy notice

Who is responsible

WhoActs is led by Robert Prime. This website and its enquiries are operated through Simon and Prime Ltd, company number 13180513, of Wiston House, 1 Wiston Avenue, Worthing, England, BN14 7QL. The company is the controller for personal data collected through this public website.

What we collect

• The name, work email, organisation, role, use case and message you choose to submit.
• Source, medium and campaign parameters attached to the enquiry URL.
• Basic technical and aggregate visit data supplied by Vercel Analytics without WhoActs setting tracking cookies.
• Connection information used briefly for best-effort, instance-local rate limiting and form-abuse protection.

Why we use it

We use enquiry data to respond, assess whether a design-partner conversation is suitable, prepare a scoped proposal where requested, protect the service and keep a record of the resulting business relationship.

The legal bases are our legitimate interests in operating and securing the website, and taking steps at your request before entering a contract. If another basis is required for a connected pilot, it will be documented before that processing begins.

Who receives it

The website is hosted by Vercel. When direct delivery is configured, valid enquiries are delivered through Resend to the monitored destination configured by WhoActs. If that route is unavailable, the browser prepares the same enquiry for the visitor to send by email. Our email provider then holds a sent message in the ordinary course of business. These providers act under their own published terms and data-processing arrangements.

We do not sell website enquiry data. We disclose it only where a service provider needs it to operate the site or where law requires us to do so.

Retention and security

The form does not write enquiry content to a WhoActs database. The delivered email is normally retained for no longer than 24 months unless a contract, dispute, legal obligation or active conversation requires a longer period.

We use server-side validation, best-effort instance-local rate limiting, a honeypot field, encrypted Vercel environment variables and restricted mailbox access. No internet service can promise absolute security, so do not submit credentials, secrets, payment data or special-category personal data through the form.

Your rights

Depending on the law that applies, you may ask for access, correction, deletion, restriction, objection or portability. Contact rob@mrprime.com. UK individuals may also complain to the Information Commissioner’s Office at ico.org.uk.

Changes

We will update this notice before materially changing the categories of data, purposes, providers or connected-product processing described here. The date at the top identifies the current version.