Last updated: 11 October 2026
Who we are
HolmesPortfolio is based in England. We run this website, holmesportfolio.co.uk, and make the HolmesPortfolio Forms plugins for WordPress.
We decide how the personal data described on this page is used. This makes us the controller under UK data protection law.
To ask about your data, email david@holmesportfolio.co.uk or use our contact form.
Visiting this website
We count page visits with our own analytics tool. It stores no personal data, sets no cookies and does not follow you to other websites.
We do not use cookies for tracking or advertising. The only cookies are the ones WordPress needs to work, such as the one that keeps you signed in if you log in to this site.
Like all web hosts, our host keeps technical logs of requests to the site, including internet addresses. They are used to keep the site running and secure.
What we collect, why, and how long we keep it
Messages you send us
- What: the answers you give on our contact form and our support form. These are your name and email address, what your enquiry is about, the details you give for that kind of enquiry, and your message. The details can include a website address, your organisation’s name, which HolmesPortfolio Forms plan you use, your project’s timing and budget, or the browser and tools you were using when you found an accessibility problem. Each form also keeps the address of the page you sent it from, a short description of your browser and your tick to say you’ve read this notice.
- Why: to reply to you and deal with your message.
- Lawful basis: our legitimate interest in answering people who contact us.
- How long: up to 1 year, then we delete it.
Use our contact form to ask about a project or a charity website, or to tell us about an accessibility problem on this website. Use our support form for anything about HolmesPortfolio Forms. Each form sends your message to our email inbox and keeps a copy on this website. It also sends your reference to your email address. Sending a message doesn’t add you to our mailing list. Please do not send us personal data about other people, such as your own customers, unless you need to.
You don’t have to tell us about your health or a disability, even to report an accessibility problem or ask for an adjustment. If you do tell us, we use it only to help you. We keep it only for as long as we need it, and for no more than 1 year.
If you represent a registered charity, you can use our contact form to ask for a place on our waiting list for charity websites. Your message is your place on the list. We keep it so we can contact you when we have space to build your charity’s website. We only email you about that. It is not a mailing list. We rely on the same legitimate interest as for other messages. We keep your message for up to 1 year and then delete it, which takes you off the list. To leave the list sooner, email us or use our contact form.
Both forms have several pages. Each time you go to the next page, the website keeps a copy of your answers so far. It is encrypted when encryption is switched on for this website. Sending the form deletes that copy. If you don’t send it, the website deletes the copy within 3 days. If a page needs fixing, the website keeps your answers for up to 10 minutes so it can show them to you again. After you send a form, it keeps the thank-you message, which shows your name, reference and email address, for up to 30 minutes.
While the form’s emails wait to be sent, this website keeps a copy of your answers. This usually takes a few seconds. The copy is encrypted when encryption is switched on for this website. The website deletes it once the emails have gone. If the emails can’t be sent, it deletes the copy about 25 hours after you sent the form.
Feedback on HolmesPortfolio Forms
The HolmesPortfolio Forms plugins sometimes ask for your feedback. Their button opens our feedback form. The plugins don’t send us anything themselves.
- What: which plugin you use, whether you have a free trial or a paid licence, your rating, and what you tell us is working well or could be better. Giving your email address is up to you. The form also keeps the address of the page you sent it from and your tick to say you’ve read this notice. That address shows which plugin the link came from and, for Pro, whether a free trial is running.
- Why: to improve HolmesPortfolio Forms, and to reply to you if you give your email address. We only use your email address to reply.
- Lawful basis: our legitimate interest in improving our products and answering people who contact us.
- How long: up to 1 year, then we delete it. This covers the email the form sends us, the copy on this website and any replies between us.
Please don’t include personal data about other people, such as your own customers or their form answers. If your answers need fixing before the form will send, the website keeps them for up to 10 minutes so it can show them to you again. Sending feedback doesn’t add you to our mailing list. We won’t quote your feedback in public without asking you first.
Signing up from the HolmesPortfolio Forms plugin
You can choose to sign up from inside the free plugin. Nothing is sent unless you tick the box and press Sign up. If our server can’t be reached, your site tries again up to 6 times over about a day. We then email you a link to confirm your sign-up. The link works once, for 14 days.
After you sign up, your site sends us its private sign-up code, not your email address, when you open the plugin’s Help and support tab or the sign-up step of its setup wizard. This lets the plugin show whether you are signed up and on the mailing list. We don’t keep a record of these checks. Like any visit, our host’s logs record the request, including the internet address of your website’s server.
- What: your email address, the business type you pick, your website address, which version of the sign-up wording you agreed to, whether you asked to join the mailing list, a scrambled copy of your site’s private sign-up code, and the dates you signed up and confirmed. We may also add a short note, and mark a sign-up as a possible fake (see “Keeping our services safe”). Your email address, website address and our notes are stored encrypted when encryption is switched on for our sign-up service.
- Why: to recognise you when you ask for help or report a problem, and so you can change or remove your sign-up from the plugin. You don’t need to sign up to get help.
- Lawful basis: your consent.
- How long: if you do not confirm your email address, we delete the sign-up after 30 days. Once you confirm, we keep it until you remove it or ask us to delete it.
Our mailing list
You can only join the mailing list from the free plugin, and only after you confirm by email. We send each list email from this website, about 30 an hour. Every email has its own Unsubscribe link.
- What: your email address, and a record of which list emails we sent you and when.
- Why: to send occasional emails about fixes and changes to HolmesPortfolio Forms, and nothing else.
- Lawful basis: your consent.
- How long: until you leave the list. We delete the record of each list email we sent you 90 days after that email finished sending. Leaving the list doesn’t remove your sign-up. You can remove that separately.
Keeping our services safe
- What: when a website or browser contacts our sign-up service, we keep a scrambled copy of its internet address for up to 30 minutes. We also keep a scrambled copy of an email address for up to a day. The spam checks on our forms count how many times each internet address uses a form. Each count covers up to 10 minutes. When a form emails your reference to you, it keeps a code made from your email address for an hour. The site deletes old counts and codes once a day. We mark a sign-up as a possible fake if it uses a throwaway email service, or if several sign-ups come from one internet address within 30 minutes. We check these by hand. A sign-up marked as a possible fake gets no mailing list emails.
- Why: to stop too many requests coming from one place, to spot fake sign-ups, and to limit how many emails we send to one address.
- Lawful basis: our legitimate interest in keeping our services working and secure.
Who we share it with
We do not sell your personal data. Our web host, DreamHost, stores this website and its data and runs our email. DreamHost passes email through MailChannels, a service it uses to filter spam. Microsoft stores our encrypted backups in OneDrive.
We will also share personal data if the law requires us to.
Where your data is stored
This website and its data are stored in DreamHost’s data centre in Amsterdam, in the Netherlands. UK law recognises the Netherlands as giving an adequate level of protection.
DreamHost is based in the United States, so its staff may handle data from there to run and support its services. DreamHost’s data processing terms protect this with standard contractual clauses and the UK International Data Transfer Addendum approved by the Information Commissioner.
We keep weekly backup copies of this website, including its data, in Microsoft OneDrive. Each backup is encrypted with a password before it is uploaded, so Microsoft cannot read it. Microsoft may store them in the United States or other countries. We keep backups for up to 8 weeks, so data we delete can stay in a backup until that backup is deleted.
Sometimes we download a copy of our list of sign-ups to our own computer, for example to check it. We keep that copy encrypted and delete it when we have finished with it.
Your rights
Under UK data protection law you can ask us to:
- give you a copy of the personal data we hold about you
- correct it
- delete it
- limit how we use it
- send it to you, or to someone else, in a format a computer can read
You can also object to us using your data where we rely on our legitimate interests.
Where we rely on your consent, you can withdraw it at any time. This does not affect anything we did before. You can remove your sign-up yourself in the plugin, under Settings, Help and support. You can leave the mailing list with the Unsubscribe link in any email, or in the same place in the plugin.
To use any of these rights, email david@holmesportfolio.co.uk. We will reply within one month.
Complaints
If you are unhappy with how we use your data, you can complain to us by email or through our contact form. We will acknowledge your complaint within 30 days and tell you the outcome.
You can also complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113.
Changes to this notice
When we change this notice, we update the date at the top.
Our terms and conditions explain the rules for using this website.