Last updated: 25 October 2026

This website, londonguitarteacher.co.uk (“the website”), is operated by Andrew Pitsillides, trading as London Guitar Teacher (“we”, “us”). This notice explains what personal data the website handles, why, and your rights under UK data protection law (UK GDPR and the Data Protection Act 2018).

The short version

If you send an enquiry, the personal data we handle is what you type into the contact form. Your enquiry is emailed to us and is not stored on the website or in any website database.
If you have had lessons and agreed to review emails, we may email you once to ask for an honest Google review, with up to two reminders. Taking part is optional and does not affect your lessons. You can withdraw your agreement using the unsubscribe link or by contacting Andrew.
Ordinary browsing of the public pages does not set cookies, and you will see no cookie banner. Our analytics put privacy first: they cannot identify you or follow you between websites. The enquiry form’s spam protection runs on our server, not in your browser: it loads nothing from other websites and stores nothing on your device (see “Spam protection” below). (The restricted admin area for the teacher is protected by an emailed sign-in code and a password; using its sign-in flow can set authentication and security cookies.)

What we collect and why

Contact form. If you send an enquiry, we receive the details you provide, typically your name, email address, phone number (optional) and your message. We use these solely to respond to your enquiry and arrange lessons. Our lawful basis is legitimate interests (responding to an enquiry you chose to send). The checkbox on the form confirms you have read this notice before sending. It is not used as a separate legal basis.

We do not create accounts, run mailing lists from this form, or use your details for marketing.

Who receives your enquiry

Enquiries are received by the teacher and, during the initial website setup period, by ProudSite (the website agency that operates this site on the teacher’s behalf), solely to make sure enquiries are not missed while the site’s email domain is being configured. Once setup completes, enquiries go to the teacher only.

How your enquiry travels

When you submit the form, the website passes your message to Resend, an email service provider, which delivers it to our inbox as an email. Resend acts as a processor and does not use your data for its own purposes. Resend is based in the United States; transfers of your enquiry data are made under the UK’s international data transfer safeguards (Resend’s data processing agreement incorporates the applicable standard contractual clauses / UK addendum). Nothing you submit is stored by the website itself. You can ask us (contact details below) for a copy of the safeguards that apply to this transfer.

The website is hosted on Cloudflare Pages. Like any web host, Cloudflare processes technical connection data (such as IP addresses) to serve pages and protect against attacks.

Some images are loaded from other services: pictures stored with the website’s content come from Sanity’s image service (cdn.sanity.io), and a few stock photos come from Unsplash (images.unsplash.com). When your browser loads one of these images, that service receives your IP address and basic browser details, as any web server does. Neither sets cookies on you through this website.

Spam protection on the enquiry form

The enquiry form has no third-party spam check in your browser: it loads nothing from other websites and stores nothing on your device. Instead, when you send an enquiry, the website’s contact handler (which runs on Cloudflare, our host) checks it before passing it on:

Spam filter. The handler looks for clear signs of automated spam in what you typed, such as more than three web links, link code, or common sales pitches. A message that fails is not sent, you are told why, and nothing about it is kept.
Sending limits. So that nobody can use the form to flood the teacher’s inbox, the website limits how many enquiries it sends each hour and each day, and how many it sends from one internet connection each day. For the last limit, the handler takes your IP address (for an IPv6 address, only its first half, which identifies a network rather than a device), combines it with a random value that changes every day, and keeps only a four-character fragment of the result, which tens of thousands of different IP addresses share, together with the date and a count. Your IP address itself is not stored. We treat these fragments as personal data. Because a fragment is shared, a busy shared connection (a school or office network, say) can occasionally reach the limit; if that happens, please phone or email.
How long. An automatic task that runs every 15 minutes deletes each day’s random value and fragments once that day (UTC) is over, so normally within about 15 minutes of midnight UTC. Hourly totals, which hold only the hour and a number, are deleted after two days. Deleted records can remain in Cloudflare’s automatic database backups for up to 30 days before those backups expire.
Failed sends. If our email provider definitely refuses an enquiry, we give its place in the limits back; if even that fails, the place returns with the next hour or day. If the outcome is uncertain (for example, the connection to the provider drops), it is still counted, because the email may have been delivered.
If the form cannot send your enquiry (a limit is reached, the filter stops it, or a technical problem), you are shown the teacher’s phone number and email address so you can get in touch directly. These are also shown next to the form at all times.
Alerts. When the hourly or daily limit is used up, when an enquiry email fails, or when the limits cannot be checked, the website tries to email an automatic alert to ProudSite, the agency that operates it, so the problem can be dealt with. If the website’s database or its email provider is itself down, that alert cannot be sent; such failures show in the hosting logs instead. Alerts contain no details about you or your enquiry.

Why, and our legal basis. Our lawful basis is legitimate interests (UK GDPR Article 6(1)(f)): keeping the enquiry form available to genuine visitors and protecting the teacher’s inbox from spam and abuse. Because nothing is stored on or read from your device, the cookie rules in the Privacy and Electronic Communications Regulations 2003 (regulation 6) do not apply to these checks. Cloudflare processes this data for us as our processor. You can object to this processing using the contact details below, and you can always phone or email instead of using the form.

Review invitations

If you have had lessons with us and explicitly agreed to review emails, we may send you one email asking for an honest Google review, followed by up to two reminders, normally 3 and 10 days after the invitation. Agreement is optional and does not affect your lessons. We offer the same choice regardless of the feedback we expect, and every message contains both the Google link and an unsubscribe link.

What we hold: your name, your email address, an optional short lesson reference, and any private feedback you choose to write instead of a public review.
Where it is held: a Cloudflare D1 database attached to this website, in addition to the email itself. These are individual review records; contact-form messages are still not stored in the website database.
Where the data comes from: the teacher, from his own lesson records and your agreement to receive review emails. Andrew records when and how you agreed and what you were told.
Lawful basis for review invitations: your consent. You can withdraw it at any time using the unsubscribe link or the contact details below, without affecting your lessons or the lawfulness of processing before withdrawal. We do not treat past lesson bookings as consent.
Keeping your withdrawal request: we retain a minimal suppression record so we can honour your withdrawal and avoid inviting you again. Our legitimate interest is respecting your contact preferences.
Who processes it: Cloudflare stores the review records and reminder queue. Resend delivers the emails (as described above) when the website sends them. Responding or unsubscribing cancels reminders that have not already been handed to the email provider.
Private feedback is never published. If you tell us something went wrong, that goes to the teacher privately. It is never used as a testimonial or a review anywhere.
Unsubscribing stops the reminders already queued for you, not just future ones, and prevents us inviting that email address again.
How long: a scheduled cleanup, which runs every 15 minutes, deletes review requests and their reminders once they are more than 400 days old. Suppression records are kept separately for as long as needed to prevent further review invitations; they are not deleted by that cleanup.

Cookies and analytics

Ordinary browsing of the public pages does not set cookies. The rules on storing or accessing information on your device are in the Privacy and Electronic Communications Regulations 2003 (regulation 6 and Schedule A1). The enquiry form’s spam protection stores nothing on your device (see “Spam protection” above). If you press Reduce motion at the bottom of a page, your browser remembers that choice so pages stay still on your next visit. It is a single setting called ps-reduce, kept in your browser’s local storage, not a cookie. It only changes how the site looks and moves, holds no information about you, and is never sent to us. If you do not want it stored, do not press the button. To remove it, press Reduce motion again, or clear this site’s data in your browser. Either way, it costs nothing and does not affect anything else on the site. If you never press the button, nothing is stored.

The teacher’s restricted admin area is not part of the public site. Using its sign-in (an emailed code via Cloudflare Access, then a password) can set cookies needed to secure the sign-in and, after a successful sign-in, keep the session. They are strictly necessary for that service, so they also fall within Schedule A1, paragraph 4.

We do use Cloudflare Web Analytics to count page views and see which pages are useful. We chose it specifically because it puts privacy first: it uses no cookies, no local storage and no fingerprinting, and it does not track you over time or follow you between websites. It cannot identify you.

Enquiry totals. We also keep separate daily totals of contact-form emails accepted by our email provider for delivery and clicks on telephone links, to understand how the website is used. These count acceptance for sending and link clicks, not whether an email reached an inbox or a call was made. Each counter stores only the day and a number: no contact details, message content, phone numbers, IP addresses or visitor identifiers. These counters set no cookies and store nothing on your device. The anonymous totals are separate from enquiry emails and the review-invitation records described above. Reports cover up to 365 days; older daily totals are removed when a new event of the same type is successfully counted.

Cloudflare, Inc. acts as our processor for this and for delivering and protecting the site. Our lawful basis is our legitimate interest in understanding how the website is used and keeping it secure. You can object to this processing using the contact details below.

How long we keep your data

Enquiry emails are kept only as long as needed to handle your enquiry and any lessons that follow, after which they are deleted. Review invitation records are deleted after 400 days. Unsubscribe records are kept for as long as they are needed to honour your withdrawal request. If someone tries to sign in to the teacher’s restricted admin area and fails, the website records the connecting IP address and the time so that repeated password guessing can be blocked. A scheduled cleanup every 15 minutes removes records older than 24 hours, so they are normally deleted within about 24 hours; if that cleanup is ever delayed, they are deleted when it next runs.

Your rights

Under UK GDPR you have the right to access, correct, delete, restrict or object to our processing of your personal data, and to data portability. To exercise any right, contact us at the email address below. You have the right to complain to us directly about how we handle your data (contact details below) and we will respond to your complaint. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk.

Contact

London Guitar Teacher (Andrew Pitsillides) Email: andrew@londonguitarteacher.co.uk

Privacy Policy