What this site knows about you.

The short version

• This site sets no cookies unless you allow them. Google Analytics is the only thing that would set one, it is off until you press Allow on the banner, and pressing No thanks keeps it off for good. Matomo also runs, on a server we control rather than Google's, and it is configured to set nothing at all on your device — so it needs no permission and asks for none. There is no tag manager, no advertising pixel and no profiling.
• There are no accounts, no logins and no database. Every page was built in advance and is served as a file.
• The contact form sends nothing to this website. It writes an email in your own mail app and leaves it to you to press send.
• The only thing this site keeps on your device is the light or dark theme you chose and only if you used the switch — the cookie page has the detail.
• Your browser does talk to Google. A silent clip loads by itself behind the home page heading and behind case studies that have footage — no click involved — and anything you start playing, or turn the sound on for, follows you to the pages you go to next, this one included. Set out in full further down.

The rest of this page works through each of those and through the three places where personal data is genuinely involved: an email you choose to send, the web server's access log and the video you did not choose.

Who is responsible

Nick Hutson is the data controller for this site — a composer working as a sole trader in the United Kingdom. Anything in this notice, including a request about your own data, reaches him at nickhutson@mac.com.

No data protection officer has been appointed and none is required. A DPO is mandatory for public authorities and for organisations whose core activity is large-scale monitoring or large-scale processing of special-category data. A one-person composing practice with a brochure site is neither.

There is no postal address for the business, so a request about your data — or a complaint about how it was handled — goes to the email address above rather than to a letterbox and reaches Nick directly.

What this site does not do

It is easier to begin with the absences, because there are a lot of them and each one was a decision rather than an oversight.

• Two kinds, and they work differently. **Matomo** is self-hosted at st.rs.thetomtaylor.co.uk, runs for everybody, and stores nothing on your device — it is switched to cookieless mode, which is why it needs no consent. It does see your IP address, the page you are on and your browser, as any web server does, and the data sits on our own infrastructure rather than a third party's. **Google Analytics** runs only after you press Allow, counts pages viewed rather than building a profile, and refuses ad_storage outright so no advertising signals are sent. Say no to Google, or say nothing, and Matomo plus the server's access log described below are the whole record.
• No advertising, no retargeting, no ad network, no conversion tracking.
• No social media pixels and no share widgets. The links to YouTube, X and Facebook are ordinary links and following one is the only way anything loads from X or Facebook. YouTube is the exception, for the reason set out below.
• No mailing list and no newsletter sign-up. There is nothing to subscribe to.
• No profiling, scoring or automated decision-making.
• No payments. No card details ever reach this site, because nothing is sold on it.
• No comments, uploads, reviews or user accounts.
• Nothing is sold, rented or handed to anyone for marketing. There is nothing collected that could be.

If you use the contact form

The form on the contact page does not work the way most forms do and the difference matters for your privacy.

What you type stays in your browser. When you press the button, the browser hands the whole message to whatever email program your device is set up to use, with the address, the subject and the body already filled in. Nothing is transmitted to this website: there is no server here to receive it, no form endpoint and no third-party form service such as Formspree in between.

From that point you are composing an ordinary email, which you can edit, add to or abandon. If you do send it, it arrives at nickhutson@mac.com. That is an Apple iCloud address, so Apple carries and stores the message in the way any email provider does.

What Nick then holds

Your name, your email address and whatever you chose to write — typically an organisation, the kind of project, when it needs to be finished and the brief itself.

Why he may hold it

To answer you and to take the steps you asked for before any contract is agreed (UK GDPR Article 6(1)(b)), along with the legitimate interest in keeping a record of enquiries about the work (Article 6(1)(f)).

How long

An enquiry that does not turn into work is deleted after 30 days. One that does turn into work stops being an enquiry: it becomes the correspondence attached to a commission and is kept as a business record for as long as that job and the accounts covering it require — tax records in particular have minimum periods of their own.

The thirty days is a real deletion rather than a filing decision: an enquiry that goes nowhere is removed, not archived. The reason the second case is not given a number is that it genuinely does not have one — how long the paperwork for a commission has to exist is set by the job and by the accounts, not by this page and inventing a figure here would be a promise that the first booking would break.

The server's access log

The site is served by nginx from files on disk. Like nearly every web server, it writes a line to an access log for each request: the IP address it came from, the time, the page or file requested, the response code and size, the page you arrived from if your browser sent one and the browser's user-agent string.

An IP address counts as personal data under UK GDPR, so it is worth stating even though nothing is done with it beyond what that sentence describes. The log exists so the site can be kept running and abuse can be spotted. It is not joined to anything else and not analysed to build a picture of who visits.

The lawful basis is legitimate interests (Article 6(1)(f)) — keeping the site secure and available.

Access logs are kept for 30 days and then deleted. Nothing is archived past that point and nothing is copied out of them first. The hosting provider that runs the server necessarily handles them as part of running it and that is as far as they go.

Video from YouTube

The video on this site is hosted on YouTube and Google is the only company your browser talks to while you are here. There are four ways that can happen, they are not equivalent and what separates them is how deliberately you asked — so each is set out on its own.

What contact there is has been kept as small as it can be. Every thumbnail is an image file served from this site rather than a hotlink to Google and every embed uses youtube-nocookie.com instead of youtube.com.

Video you press play on

Every video card, the window it opens and the clip in the career timeline on the About page load nothing at all until you click. You can browse a page listing more than a hundred videos and your browser will not have made a single request to Google.

A video you kept playing

Dismissing that window does not necessarily stop the video. Dismiss it while it is still playing — with Escape, or by clicking outside it — and it carries on, with a row in the play bar at the foot of the page and it follows you as you move around the site — onto any page, including ones that have a clip of their own behind the heading. This is the one case that really is a single session: the same player is kept alive rather than torn down and rebuilt, so moving between pages asks nothing further of Google. Stopping it outright is its own control, both in that window and in the play bar. It also ends when the video does, when you start something else — a track or another video — or when you load a fresh page rather than following a link. And a video you had already paused stops however you dismiss it, rather than being carried on in silence.

The clip behind a page heading

The home page and case studies that have footage of their own, play a silent clip behind the headline. No click is involved: about a second after the page opens, a YouTube player loads itself and starts playing, muted. The home page then changes clip roughly every twenty-two seconds and will work through eight of them if you leave it open — and each new clip is a fresh player load and a fresh viewing session as far as Google is concerned. It does not start at all if you are already carrying something.

A clip you turned the sound on for

Turn the sound on and that clip stops being background: it then keeps playing as you move around the site, including onto pages that have no video behind their own heading. It is not one player carrying on. The player is destroyed with the page you leave and a new one is loaded on the page you arrive at, resuming at the right second — so what looks like continuous playback is a fresh player load and a fresh viewing session with Google on each page you stay on.

Whether that means one player or two depends on the order you did things in and the rule is the same either way: a second player is never started while one is already carrying sound and one that is already running is never killed. So arriving at a page with a clip behind its heading while you are carrying a video loads nothing extra — the page's own clip does not start at all. Going the other way, dismissing a video on a page whose clip was already running leaves both loaded, yours audible and the page's muted: two viewing sessions with Google rather than one, in that order only.

The lopsidedness there is deliberate and it favours you. Stopping the page's own clip at that moment would mean destroying a player that is already loaded and starting a fresh one the instant your video ended — more requests to Google rather than fewer, in the name of tidiness.

Underneath all of it there is one rule and it is the shortest way to stop any of this: only one thing on the site is ever audible and it is whatever you started last. Press play on a track and a carried video stops. Press play on a video and the reel stops. Nothing keeps running underneath something you started afterwards.

This page is one of the pages a player can follow you onto, by either route. If you kept a video playing, or turned the reel's sound on, before arriving here, then a YouTube player is loaded and running behind this notice while you read it. It seemed wrong to describe that anywhere but here.

The carried reel only happens if you turned its sound on earlier in this visit and have not stopped it or started something else since. Neither kind is ever part of a fresh page load: arrive at this page directly, having started nothing and nothing is requested from Google at all.

For the reel, passing through does not count either. Nothing is requested for the first second and a half after you arrive, so a page you click straight past loads no player at all — going from the home page through a grid to a case study requests nothing on the page you only crossed. Staying is what loads one. A video you kept playing works differently, because there is nothing to load: the player you already had simply comes with you.

Whichever way a player ends up loaded, the same thing reaches Google: your IP address, the address of the page the player is on and your browser's user-agent string, plus a viewing session that stays open while the clip runs. This site does not ask your permission before any of it and does not obtain your consent for it. It is disclosed here instead, which is why this section is as specific as it is.

What separates them is how deliberately you asked and the more deliberately you asked the further the player follows. Pressing play on a particular video is the clearest way of asking and that one is carried anywhere until it ends. Turning the reel's sound on is a weaker version of the same thing: that clip follows you too, but stands aside on any page that has a clip of its own. The clip behind the heading is the one nobody asked for — it goes nowhere and it does not even begin if you already have something playing.

None of that is consent and it is not offered here as consent. Starting something is not agreement that it should follow you onto a privacy notice and nothing on this site asked you whether it should. It is set out instead so that you can decide what to do about it.

What the player does at your end was measured rather than taken on trust. Loading a clip sets no cookies at all — youtube-nocookie.com genuinely does behave differently from the ordinary YouTube domain in that respect. What it does do is let Google's player keep a few housekeeping entries of its own — buffering, captions, an icon cache — in storage on Google's domain rather than this one, where this site can neither read them nor clear them and the player reports back to Google about playback while it runs. Google is a separate data controller for all of it. Their notice is at policies.google.com/privacy.

Reduce motion is the setting that governs the clips you did not ask for. Turn it on in your device or browser and nothing loads behind a heading, nothing starts by itself and nothing follows you from page to page unless you started it yourself — measured: the home page then makes no request to any Google server and stores nothing. What it does not do is stop a video you press play on and it is not meant to; that one you asked for and you can end it from the play bar whenever you like. To prevent even that, a browser setting or an extension that blocks third-party frames will. Either way the pages still work; you get the still image that would have been sitting behind the video.

Audio

The music player is an ordinary HTML audio element and every track is a file served from this site's own domain. No streaming service, no embed and no third party is involved in listening.

What is stored on your device

One item and only if you ask for it. Pressing the light/dark switch in the header writes your choice so that the next page does not flip back.

It is not a cookie: it is never attached to a request, so it never reaches this site or anyone else. The exact name, what it holds and how to clear it are on the cookie page.

Children

This site is aimed at parks, producers and theatre professionals rather than children and it collects nothing from anybody. There is no age gate because there is nothing to gate. The one thing that is not in this site's hands — the YouTube player described above — behaves the same way for every visitor, whatever their age.

Your rights

UK GDPR gives you rights over personal data held about you. Because this site collects nothing, in practice that means email you have sent and any notes kept alongside it.

Access

Ask for a copy of what is held about you.

Correction

Have anything inaccurate put right.

Erasure

Ask for it to be deleted.

Restriction

Ask that it be kept but not used while something is in dispute.

Objection

Object to processing that rests on legitimate interests.

Portability

Ask for it in a form you can take elsewhere.

Email nickhutson@mac.com to use any of them. You will get an answer within one month and there is no charge.

Anything Google holds as a result of the video embed is Google's rather than Nick's, so a request about that has to go to Google — their notice explains how.

If you are unhappy with the response, or with anything else on this page, you can complain to the Information Commissioner's Office, the UK's data protection regulator, at ico.org.uk or on 0303 123 1113.

Where data goes

Two things can involve processing outside the United Kingdom: email sent to an iCloud address, which Apple handles and any YouTube clip that loads — some of which load without you asking — which Google handles. Both are international companies operating under their own published safeguards for such transfers. Nothing else leaves the server this site is hosted on.

Changes to this notice

If the site starts doing something it does not do today — a hosted contact form, a measurement tool, an embedded map — this notice is updated before that ships and the date at the top changes with it.