How I handle your data

Privacy information for this website and the fire risk assessment workflow research.

Participation is voluntary. There is no registration form, mailing list or automatic enrolment in future sales contact.

Who is responsible

I run this research as an individual. Email, website hosting and AI-assistance services support the activities described below.

What I hold, and where it came from

Initial research uses company-level information from Companies House and company websites. If you email me, your contact details and message come directly from you. Please do not send client-identifying or sensitive information.

• Company name, website, company number, source links and the date checked.
• If you contact me: your email address, information you choose to provide, and the correspondence needed to respond.
• Technical request information, such as IP address, requested URL and browser information, processed by the hosting provider to deliver and secure the site.

Invitations use public general business mailboxes of verified active UK limited companies or LLPs, not personal-name addresses. I record the source and collection date. Each invitation identifies that source and links to this information. Publication of a contact detail is not treated as consent.

Why

To ask three questions about how fire risk assessment reports are produced, and to record the answers so that I can decide whether to build software for it. I am not advertising a product and there is nothing to buy.

I rely on legitimate interests in understanding professional report-writing workflows, conducting limited relevant written research, responding to correspondence and operating this informational website securely. My assessment limits the data and contact burden: general corporate mailboxes, three voluntary questions, clear identity and an easy right to object.

Who else sees it

I do not sell or rent contact details. Namecheap Private Email processes email correspondence. Cloudflare Pages hosts and delivers this website and may process technical access and security information. The private contact list and identifiable research replies are not published or uploaded with this site.

These providers operate internationally, including in the United States; this is not an EU-only hosting promise. Their published information describes their processing and transfer arrangements: Namecheap privacy policy, Cloudflare privacy policy Namecheap data processing addendum and Cloudflare data processing addendum. Their published arrangements include contractual safeguards for relevant international transfers. Contact me if you would like information about the safeguards applicable to your data.

I use an OpenAI AI assistant to help review relevant research correspondence, check replies and delivery failures, prepare messages and summarise findings. Relevant message content, sender details and signatures may therefore be processed by OpenAI; this is not processing only on my computer. Access is limited to this research and related software-provider correspondence, not unrelated email or collecting personal profiles. Please do not send sensitive information or identifiable client material. Public research summaries do not include identifiable replies or signatures.

This replaces the earlier statement that identifiable replies were not supplied to an AI assistant. The workflow changed on 30 September 2026. I have disabled the account's “Improve the model for everyone” setting. This does not mean that processing is only in the EU or that no data is retained. OpenAI's Europe privacy policy explains its processing, retention, rights and international transfer arrangements. I use a personal account, not an enterprise data processing agreement. Where an identifiable reply is unnecessary, I use a non-identifying summary instead.

I do not add advertising trackers, marketing analytics or tracking pixels. This does not mean the hosting provider keeps no technical logs. Published research findings will be checked for identification risk and contain no names, company names or identifying client information.

How long I keep it

• If you ask me to stop, or decline: I stop contact, remove unnecessary research details and keep only a minimal no-contact record.
• Research correspondence and identifiable research records will be deleted or irreversibly anonymised when the round closes, no later than 31 December 2026. Any separate purpose or extension will be explained beforehand.
• A minimal do-not-contact record is retained only as needed to honour an objection; its necessity is reviewed annually, rather than retaining a full profile.
• Hosting and AI-service records have their own service retention rules; the research-record deadline is not a promise about all provider logs or backups. I will include research material in AI conversation records in the closure review and use the available deletion controls.
• Deletion from active records may precede expiry of provider backups. A restored copy must not be used to restart contact after an objection.

Your rights

You can ask me for a copy of what I hold about you, ask me to correct it, ask me to delete it, request restriction, or object to processing based on legitimate interests. Other rights depend on the processing and legal basis. Email cagri@acsimsek.com and I will act on it without undue delay, normally within one month. If a permitted extension is needed, I will explain it within that first month.

You may complain to the Dutch Autoriteit Persoonsgegevens, the UK Information Commissioner's Office where relevant, or another competent data protection authority.

I do not make solely automated decisions about you with legal or similarly significant effects.