Privacy Policy

UKAY ("we", "us") operates this website. For the purposes of the UK GDPR and the Data Protection Act 2018 we are the data controller for the information described below. You can reach us at hello@ukay.example, or by using the contact form on this site.

We are not a law firm, and we are not a regulated immigration adviser. This site provides general information only.

We only collect information you choose to give us. If you do not use the contact form, we do not collect anything that identifies you.

When you submit the contact form we store:

• Your name
• Your email address
• Your phone number, if you choose to provide one (it is optional)
• The topic you selected
• The message you wrote
• The date and time of submission
• A one-way cryptographic hash of your IP address, and your browser’s user-agent string

We do not store your IP address. Before anything is written to our database, your IP address is combined with a secret value and passed through a SHA-256 hash function. The result cannot be reversed back into an IP address.

We use that hash for one purpose only: to limit how many messages can be sent from the same connection in an hour, which is what stops the form being used for spam. It is not used to profile, track or identify you.

Our lawful basis for processing your contact details and message is consent, which you give by ticking the box on the form. You can withdraw that consent at any time by asking us to delete your message.

Our lawful basis for the hashed IP address and user-agent is legitimate interest: protecting the website from automated abuse. We have balanced this against your privacy by hashing the address so that we hold no identifiable record of it.

We keep contact form submissions for up to [24 MONTHS] from the date you send them, so that we can answer follow-up questions and keep a record of what was asked. After that they are deleted.

Rate-limiting records expire automatically and hold no personal data.

Your message is stored in our database and read by the person who operates this site. We do not sell your data, we do not share it with advertisers, and we do not use it to build marketing profiles.

We use the following processors to run the website: [HOSTING PROVIDER, e.g. Vercel] for hosting, [DATABASE PROVIDER] for the database, and, once email notifications are switched on, [EMAIL PROVIDER, e.g. Resend] to deliver notification messages. Each is bound by a data processing agreement. Some may process data outside the UK; where they do, transfers rely on the UK International Data Transfer Addendum or an adequacy decision.

Under UK data protection law you have the right to ask us for a copy of the personal data we hold about you, to have it corrected, to have it deleted, to restrict or object to how we use it, and to receive it in a portable format. You also have the right to withdraw consent at any time.

To exercise any of these, email hello@ukay.example and tell us which right you want to use. We will respond within one month. If you are not satisfied with our response you can complain to the Information Commissioner's Office at ico.org.uk.

Submissions are transmitted over HTTPS and stored in a database that is not publicly accessible. Access to the administration area requires a password that is stored only as a bcrypt hash, and sessions use a signed, httpOnly cookie.

No system is perfectly secure. Please do not send us passport numbers, visa reference numbers, financial details or medical information through the contact form — we do not need them to answer a question.

This site is intended for people aged 16 and over. If you are under 16, please ask a parent or guardian to contact us on your behalf.

If we change how we handle personal information we will update this page and change the date at the top. Material changes will be noted clearly.