--- title: "Privacy policy" description: "How Duck & Rubber Duck Ltd uses personal data when you visit this website, email us, or book and pay for a call." source: "https://duckrubberduck.com/privacy" --- # Privacy policy Last updated: 3 November 2026 ## Who we are Duck & Rubber Duck Ltd is the controller of your personal data. Duck & Rubber Duck Ltd is a limited company registered in Scotland, company number SC907928. Our registered office is 3F1, Third floor, 3 Hill Street, Edinburgh, EH2 3JP. Email contact@duckrubberduck.com, or write to us at 3F1, Third floor, 3 Hill Street, Edinburgh, EH2 3JP. We do not have a data protection officer. The law does not require one for a company of our size and type. ## When you visit this website We use Ketch to ask for your consent and to store your choice in a cookie and in your browser storage. The analytics tools below run only after you allow analytics. You can change your choice at any time from the privacy link Ketch shows on the page. Our lawful basis for storing your choice is legal obligation: UK law requires us to record consent. We use Vercel Web Analytics to count page views. For each view it records the page, the site that linked to it, your country and region, and your browser, operating system and device type. It does not identify you. Vercel tells repeat views apart with a hash of the request and discards that hash after 24 hours. Our lawful basis is consent. We also use Vercel Speed Insights to measure how fast pages load. For each page load it records the page, how long the page took to load and draw, your network speed, your country, and your browser, operating system and device type. It does not identify you and cannot link one page load to another. Our lawful basis is consent. Our hosting provider, Vercel, records technical data for each request: your IP address, browser type and the page you asked for. We use this data only to run and protect the website. Our lawful basis is legitimate interests: we need to keep the website available and secure. Vercel deletes these logs after a short period under its own retention policy. ## When you email us We receive your name, email address and anything you write in your message. We use this data to reply to you. Our lawful basis is legitimate interests: you contacted us and we want to answer you. We keep emails for 90 days, then delete them. ## When you book and pay for a call You book through a Google booking page, pay through Stripe, and meet us on Google Meet. We receive your name, email address, the time you booked, anything you write in the booking form, and a record of your payment. Stripe processes your card details. We never see your full card number. Our booking terms apply to the call. We use this data to arrange the call, take payment and keep our accounts. Our lawful bases are contract, because you asked us to provide a service, and legal obligation, because UK tax law requires us to keep accounting records. We keep booking details for 90 days after the call. We keep payment and invoice records for 6 years from the end of the financial year they relate to, as HMRC requires. Stripe also uses payment data for its own purposes, such as fraud prevention. For that use, Stripe is a separate controller under its own privacy policy. ## Who else receives your data We use these service providers. Each processes personal data for us under a contract: Google (booking, calendar and video calls), Stripe (payments) and Vercel (website hosting). We do not sell your data and we do not share it for marketing. These providers can process data outside the UK, including in the United States. Where they do, the transfer is covered by UK adequacy regulations, such as the UK–US data bridge, or by the UK International Data Transfer Agreement or Addendum. ## Your rights You have the right to ask for a copy of your data, to correct it, to delete it, to restrict how we use it, to object to how we use it, and to receive it in a portable format. Some rights apply only in certain circumstances. To use a right, contact us. We reply within one month. You do not have to give us personal data. If you do not, we cannot reply to you or book a call. We do not make decisions about you by automated means. If you are not happy with how we use your data, please tell us first. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk/make-a-complaint.