Privacy & cookies.
What this website collects, why, and what we do not collect. We have tried to write it in plain English rather than the usual thousand words of hedging.
No cookie banner, because there are no tracking cookies.
This site sets no advertising cookies, no tracking cookies and no third-party profiling of any kind. Our analytics cannot identify you, does not follow you between websites, and stores nothing on your device. We are not in the business of selling attention - we sell IT support.
The only things this site stores on your device are the ones needed to make it work: your light/dark preference, and a short-lived sign-in token if you use the downloads or remote-support pages. Those are listed in full in section 03.
The data controller.
FIRST4TECH Limited, registered in England & Wales, company number 06032192. Registered office: Zone 2, Wrentham Business Centre, Prospect Park, Exeter, EX4 6NA. We are registered with the Information Commissioner's Office.
For anything on this page - questions, requests, complaints - write to info@first4tech.co.uk or ring 01392 457120.
Everything this site keeps on your machine.
UK law here (PECR regulation 6) is not really about cookies - it covers anything stored on or read from your device, including browser storage. So rather than publish a cookie list that omits the things that are not cookies, here is the complete list. All of it is first-party, and all of it is strictly necessary for something you asked the site to do, so none of it requires consent.
| name | type | purpose | lifetime |
|---|---|---|---|
| f4t-theme | local storage | Remembers whether you chose the light or dark theme. Holds the literal word "light" or "dark" - nothing else, and nothing that identifies you. | Until you clear your browser storage |
| f4t-theme-hint-seen | local storage | Records that you have already been shown the one-off "you can switch themes" hint, so we stop showing it. | Until you clear your browser storage |
| f4t.unlock | session storage | Only on /downloads and /sos. Holds the short-lived token proving you entered a valid access code, so you are not asked again on every file. | Expires with the token, and when you close the tab |
| f4t.admin | session storage | Only for staff, on the admin page. Holds the signed-in administrator's session token. | Expires with the token, and when you close the tab |
No cookies are set by this website. If your browser reports one, it did not come from us - please tell us, because we would want to know.
How we count visitors without tracking them.
We use Plausible Analytics to understand which pages are useful and which are not. It is an open-source, privacy-focused alternative to Google Analytics, and we chose it specifically so that this page could stay short.
What it records, per page view:
- The page address - the hostname and path. Query strings are discarded, apart from standard campaign tags (the utm_ parameters) where a link carries them.
- The referring site, if you arrived from a link elsewhere.
- Your browser name and version, operating system and device type.
- Your country, region and city, derived from your IP address.
What it does not do, and cannot do:
- It sets no cookies and stores nothing on your device.
- It stores no IP addresses. Your IP address and browser string are used momentarily, in memory, to generate a one-way hash that distinguishes one visit from another, and the key used to generate it is rotated and destroyed every 24 hours.
- Because that key is destroyed daily, there is no way - for them or for us - to recognise a returning visitor from one day to the next.
- It builds no profiles, follows you to no other site, and the data is never sold or shared with advertisers.
The result is statistics, not surveillance: we can see that a page was read 200 times, never that you read it. Plausible processes and stores this data on servers in Germany, operated by Hetzner, and it does not leave the EU. The service is provided by Plausible Insights OÜ, a company incorporated in Estonia, acting as our data processor.
Why there is no consent banner. The consent requirement in PECR regulation 6 is triggered by storing information on, or reading information from, your device. This analytics does neither, so the requirement is not engaged, and asking you to dismiss a banner would be theatre. We still tell you about it - that is what this section is - because transparency is a separate obligation, and one we owe you regardless.
Prefer not to be counted at all? Any tracker blocker will stop it, and we make no attempt to work around blockers or to disguise the script as first-party.
The contact form.
The form on /contact collects your name and email address, optionally your company, phone number and what the enquiry is about, and your message. It is emailed to our team, and if you gave an address you get a confirmation copy. It is not fed into any advertising system.
Lawful basis. Where you are asking about work we might do for you, Article 6(1)(b) - steps taken at your request before entering into a contract. For general correspondence, Article 6(1)(f) legitimate interests, the interest being simply that we can answer people who write to us. We do not rely on consent here, because contacting us is the request; there would be nothing meaningful to withdraw once the email has arrived.
How long we keep it. Enquiry emails live in our mailboxes. We keep them while we deal with your enquiry and for a reasonable period afterwards in case you come back to us. Enquiries that do not lead to work are deleted within 24 months of our last contact. If you become a client, your details move into your client record and are kept for as long as we work together, plus the period we are required to keep business records.
You can object to this processing at any time, and ask us to delete your enquiry - see section 08.
Access codes and support sessions.
The /downloads and /sos pages are for existing clients and are gated behind an access code. If you ask for a code by email, we store your email address alongside that code so we can check it and expire it. Those records sit on our own server rather than with a third party, and are removed once the code has expired.
Starting a remote support session creates a short-lived session record, so the engineer on the phone can see that your download has started and that you have opened the installer. It holds no personal data beyond the session itself and expires on its own.
Lawful basis. Article 6(1)(b), performance of our contract with you - this is how we deliver the support you are paying for.
Abuse prevention.
To stop the contact form being used for spam, and the access-code gate being brute-forced, our server counts recent failed attempts against the IP address they came from. Those counters are held in memory only, are discarded as they age out, and are lost entirely whenever the application restarts. They are not combined with anything else and are not used to identify anyone.
Lawful basis. Article 6(1)(f) legitimate interests - keeping the service available, and our clients' access codes secure.
Our web host also keeps standard server logs, which include IP addresses, as every web server does. They are used for diagnosing faults and investigating abuse.
What you can ask us to do.
Under UK GDPR you have the right to be informed (this notice), to access a copy of your personal data, to have inaccurate data rectified, to have data erased in certain circumstances, to restrict how we process it, and to object to processing carried out on the basis of legitimate interests.
Where we rely on legitimate interests - the enquiry handling in section 05 and the abuse prevention in section 07 - you have the right to object at any time, and we will stop unless we have compelling grounds not to. Just tell us.
Data portability applies only where processing is based on consent or on a contract and is carried out automatically, so in practice it covers client records rather than general enquiries. We carry out no automated decision-making or profiling - no part of this website makes a decision about you.
To exercise any of these, email info@first4tech.co.uk. We will respond within one month, and there is no charge.
If we get it wrong.
Tell us first if you can - most things turn out to be a misunderstanding we can fix the same day. But you have every right to go straight to the regulator, and complaining to us is not a precondition.
You can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint, or on 0303 123 1113.
Updates to this notice.
If we change what we collect, we change this page, and the review date at the top changes with it. We do not quietly broaden it and hope nobody re-reads it.