Privacy Notice
How personal data is collected and used on dandawson.org, the lawful bases for it, and the rights you have.
1. Who we are and what this covers
This notice explains how personal data is processed on the website at dandawson.org (the “Site”). The Site is the professional portfolio of Dan Dawson and is operated by Vernacular Labs LLC, a Florida limited liability company with its principal place of business at 1015 Atlantic Blvd #168, Atlantic Beach, FL 32233, United States.
In this notice, “we”, “us” and “our” refer to Vernacular Labs LLC, which is the controller of the personal data described below and determines the purposes and means of the processing.
We have not appointed a data protection officer and are not required to appoint one. We have not appointed a representative in the European Union or the United Kingdom under Article 27 of the EU or UK GDPR, on the basis that our processing of the personal data of individuals in those territories is occasional, does not involve special category data or criminal offence data on a large scale, and is unlikely to result in a risk to their rights and freedoms.
This notice does not form part of any contract. It applies only to the Site, and not to any other website, service or platform reached through a link from the Site, nor to any client engagement carried out by Vernacular Labs LLC, which is governed by the agreement for that engagement.
2. Personal data we process
We process two categories of personal data, both provided or generated by you when you use the Site. There are no accounts, no login and no subscription.
- Usage data
- Pages viewed and the order in which they were viewed, scroll depth, links and elements interacted with, time spent on a page, referring website, approximate location derived from your IP address (city level and no more precise), device type, operating system, browser, language, and identifiers stored in or read from cookies and similar technologies. Collected automatically as you use the Site.
- Contact data
- Your name, email address, the enquiry type you select, and the content of your message. Collected only if you choose to submit the contact form.
We do not knowingly collect any special category data as defined in Article 9 of the UK and EU GDPR, or any sensitive personal information as defined under United States state privacy laws. The Site provides no means of submitting such data.
3. Purposes of processing and lawful bases
Measuring how the Site is used, so we can understand which content is read and improve it
- Data used
- Usage data
- Lawful basis
- Consent, where consent is required for the storing of or access to information on your device. Where it is not, our legitimate interests in understanding and improving our own website (Article 6(1)(f)).
Measuring how quickly the Site’s pages load and how often they are viewed, in aggregate, so we can keep the Site fast and reliable
- Data used
- Usage data, limited to the page viewed, referring website, approximate country, browser, operating system, device type and page-load timings
- Lawful basis
- Our legitimate interests in operating a fast and reliable website (Article 6(1)(f)). This measurement does not store or read cookies or other identifiers on your device. See section 4.
Responding to an enquiry you send us
- Data used
- Contact data
- Lawful basis
- Our legitimate interests in responding to correspondence addressed to us, and, where the enquiry concerns work, taking steps at your request before entering into a contract (Articles 6(1)(f) and 6(1)(b)).
Protecting the Site and the contact form against spam, abuse and automated submissions
- Data used
- Usage data, contact data
- Lawful basis
- Our legitimate interests in the security and availability of the Site (Article 6(1)(f)).
Recording the consent choices made on the Site, so we can demonstrate what was agreed and when
- Data used
- Consent record, including a randomly generated identifier, the choice made, the time, and technical information about the request
- Lawful basis
- Compliance with a legal obligation to demonstrate consent (Article 6(1)(c)), and our legitimate interests in establishing and defending legal claims (Article 6(1)(f)).
Where we rely on legitimate interests, we have assessed that those interests are not overridden by your interests or fundamental rights and freedoms. You may ask us for further information about that assessment, and you may object to that processing. See section 9.
You are not required by law or by contract to provide any personal data to us. Providing contact data is voluntary; if you do not provide it, we will not be able to respond to you. If you decline consent to measurement, the Site remains fully available to you.
4. How measurement is carried out
Measurement requests from your browser are sent to www.dandawson.org/metrics, which is infrastructure we operate. Data is then transmitted from that infrastructure to Google Analytics on a server-to-server basis, rather than directly from your browser to Google.
Google Analytics receives usage data. It does not receive contact data, and the two are not linked. We also retain a copy of the measurement records on infrastructure we operate, so that we are not dependent on Google in order to answer questions about our own website.
Separately, we use Cloudflare Web Analytics to measure page views and how quickly pages load. A script delivered by Cloudflare reads timing information from your browser and sends it to Cloudflare with the address of the page and the referring website. Cloudflare reports this to us only in aggregate: page views and visits by country, browser, operating system and device type, and page-load times. It does not use cookies, local storage or any other identifier stored on your device, and Cloudflare states that it does not fingerprint visitors. Because nothing is stored on your device, it runs whatever consent choice you make. It is not linked to Google Analytics, to the measurement records described above, or to contact data.
6. Recipients of personal data
Personal data is disclosed to the following recipients, each acting as a processor or service provider on our behalf except where stated:
- Google LLC and Google Ireland Limited, for analytics (Google Analytics) and for hosting the measurement infrastructure (Google Cloud). Google acts as an independent controller for certain limited purposes described in its own terms.
- Cloudflare, Inc., for content delivery, security, spam prevention (Turnstile), website performance analytics (Cloudflare Web Analytics) and storage of measurement records.
- Webflow, Inc., for hosting the Site and processing contact form submissions.
Contact data is stored in a spreadsheet held in a Google Workspace account controlled by Vernacular Labs LLC and is accessible only to our authorised personnel.
We may also disclose personal data where required to do so by law, by a court or by a regulator, where necessary to establish, exercise or defend legal claims, or to a successor in connection with a merger, acquisition or sale of assets, in which case this notice will continue to apply to the personal data transferred until it is replaced.
We do not sell personal data, and we do not share it for cross-context behavioural advertising or targeted advertising. No personal data is disclosed to advertising networks or data brokers.
7. International transfers
Vernacular Labs LLC is established in the United States, and the recipients listed in section 6 are or may be located in the United States. If you access the Site from the United Kingdom, the European Economic Area or Switzerland, your personal data will therefore be transferred outside that territory.
Those transfers are made in reliance on the safeguards published by each recipient, which include the European Commission’s standard contractual clauses and the UK International Data Transfer Addendum, and, where applicable, certification under the EU-US, UK Extension and Swiss-US Data Privacy Framework. You may request further information about the safeguards applied, and a copy where one is available to us, by contacting us using the details in section 12.
8. Retention
Personal data is kept only for as long as is necessary for the purposes set out in section 3, after which it is deleted or aggregated so that it no longer identifies you. We do not operate a single fixed retention period for all data. The criteria we apply in determining how long to keep a given category are:
- the purpose for which it was collected, and whether that purpose remains current;
- whether the data continues to have analytical value, which for usage data declines as it ages and as the Site changes;
- any retention or deletion period applied by the relevant service provider, which for analytics data is configured within the provider’s own settings;
- any legal, regulatory or accounting obligation requiring retention;
- the limitation period applicable to any claim that might be brought by or against us, and whether the data may be relevant to establishing, exercising or defending such a claim; and
- for consent records specifically, the need to demonstrate that consent was validly obtained for as long as the processing based on it continues, and for a reasonable period afterwards.
You may ask us at any time how long a particular category of your personal data will be kept, and you may ask for it to be erased. See section 9.
9. Your rights
If the UK or EU GDPR applies to the processing of your personal data, you have the right to:
- request access to your personal data and to be provided with a copy of it;
- request the rectification of inaccurate or incomplete personal data;
- request the erasure of your personal data;
- request the restriction of processing;
- object to processing carried out on the basis of legitimate interests;
- receive your personal data in a structured, commonly used and machine-readable format, and to have it transmitted to another controller, where processing is based on consent and carried out by automated means; and
- withdraw your consent at any time, where processing is based on consent. Withdrawal does not affect the lawfulness of processing carried out before it.
Exercising these rights is free of charge. We will respond within the period required by applicable law. We may ask you for information reasonably necessary to confirm your identity before acting on a request, and we may decline or charge a fee for requests that are manifestly unfounded or excessive, to the extent the law allows.
You also have the right to lodge a complaint with a supervisory authority. In the United Kingdom this is the Information Commissioner’s Office. In the European Economic Area it is the authority in the country where you live or work, or where the matter you are complaining about occurred. We would ask you to raise the matter with us first, but you are not required to do so.
10. United States state privacy rights
If you are a resident of California, Colorado, Connecticut, Virginia or another state with a comprehensive consumer privacy law, you may have the right to confirm whether we process your personal information and to access it, to obtain a copy of it in a portable format, to correct it, to delete it, to opt out of its sale, sharing or use for targeted advertising or profiling, and to appeal a decision we make on such a request where your state provides for an appeal.
The categories of personal information collected in the preceding twelve months are identifiers, internet or other electronic network activity information, and approximate geolocation information. They are collected directly from you and automatically from your device, for the business purposes described in section 3, and are disclosed to the service providers named in section 6.
We have not sold or shared personal information in the preceding twelve months, and we do not process sensitive personal information. No personal information is knowingly sold or shared in respect of any consumer under 16 years of age.
We honour the Global Privacy Control signal as an opt-out preference signal, and treat it as a withdrawal of consent to measurement. We do not respond to browser “Do Not Track” headers, as no common standard for them has been agreed.
We will not discriminate against you for exercising any of these rights. You may use an authorised agent to submit a request, in which case we may require proof of that authorisation. To make a request, use the contact details in section 12.
11. Other matters
Children
The Site is directed to a professional audience and is not intended for children. We do not knowingly collect personal data from anyone under the age of 16. If you believe a child has provided personal data to us, contact us and we will delete it.
Automated decision-making
We do not carry out automated decision-making producing legal or similarly significant effects, and we do not profile you for such purposes.
Security
We maintain technical and organisational measures appropriate to the risk, including transport encryption, access controls, and limiting the personal data collected to what is necessary. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
Other websites
The Site links to third-party websites, including LinkedIn. We are not responsible for the content or privacy practices of those websites, and this notice does not apply to them.
Changes to this notice
We may update this notice from time to time. The version number and effective date at the top of this page will change when we do. Where a change materially affects the personal data collected, the purposes of processing or the recipients, we will seek consent again where consent is the basis for that processing. Continued use of the Site after a change takes effect constitutes acceptance of the updated notice, to the extent the law permits.
12. How to contact us
For any question about this notice, or to exercise any right described in it, contact us at [email protected], marked for the attention of Dan Dawson. Please tell us which right you wish to exercise and provide enough information for us to locate the relevant data.
- Controller
- Vernacular Labs LLC
- Address
- 1015 Atlantic Blvd #168, Atlantic Beach, FL 32233, United States
- [email protected]