Privacy notice

Who is responsible

Windfall Brief is a trading name. The data controller is the operator of Windfall Brief, a sole trader in England pending incorporation; the company's name, number and registered office will replace this paragraph and appear in the footer as soon as the company exists, together with its ICO registration number.

What we collect, and why

The territory form collects: the territory you name, your email address, the option you choose (territory list, sample brief, or a data request), a developer type you choose, and a timestamp. We also keep a salted hash of your IP address, used only to limit abuse of the form; the hash cannot be reversed to your address.

We use these entries solely to write to you about Windfall Brief territories and the brief itself, or to act on your data request. Lawful basis: legitimate interest in responding to an enquiry you made (UK GDPR Article 6(1)(f)). We do not sell, share or enrich them, and we do not use them for any other marketing.

The site sets no cookies and loads no analytics, advertising or third-party scripts. Our web server keeps an access log in which IP addresses are replaced by a one-way hash at the moment of writing; the log is used only to count visits and is deleted after 30 days.

How long we keep it

Territory-list and sample-brief entries: until the territory you named has opened and you have been offered a seat, or 24 months from the entry, whichever is sooner — or until you ask us to delete it. Data-request entries: for as long as needed to complete the request, then 6 months. Server logs: 30 days.

Who processes it

Entries are stored on a server we control, rented from Contabo GmbH (Germany) and located in the European Union (France), under that provider's standard terms; the EU is recognised by the UK as providing adequate protection. Our email is provided by Proton AG (Switzerland, also recognised as adequate). No other processor sees your data.

Your rights

You may ask to see, correct or delete your entry, object to our using it, or withdraw from the list at any time. Until our mailbox is connected, make the request through the form on the home page by choosing "A request about my data" — it reaches the same person and is answered within 30 days. You also have the right to complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, or 0303 123 1113.

About the research itself

Our briefs are built from public registers: HM Land Registry, planning registers, energy certificates, Planning Inspectorate decisions and similar. We name company owners from the public register only; private individuals are never named or profiled, register data is never used to contact anyone, and applicant and agent details that appear in planning records are not retained by us. Full data sources and licences are on the attributions page.