What we collect, and what happens to it.

Enquiry details. When you send the form on the contact page or email us directly, Zander Custom Services keeps your name, your email address, the company you named if you named one, and what you wrote. Booking a call adds the name, email address and time you chose. Those are held by the calendar service that sends the invitation.

Our own analytics. Every page records the path you looked at, the site that referred you, the country the request came from where the proxy can tell, and whether the device is a phone, a tablet or a desktop. No cookies are set. No raw IP address is ever written down: the address is combined with a salt that changes every day, hashed, and discarded inside the same function that read it. Yesterday’s hashes cannot be matched to today’s, so the record stops being able to follow anyone after a day.

Google Analytics. Every page also loads Google Analytics, which sets two cookies on this site, named _ga and _ga_ followed by an id, holding a random identifier for your browser, and sends Google the pages you viewed, when, roughly where from, and what kind of device. Google uses your IP address to work out a rough location and says it doesn’t store it. We’ve turned off the advertising features: nothing here is used to build an advertising profile, follow you across devices, or report your age or interests. The identifier is a random number, not your name, and nothing on this site ever joins it to an enquiry.

A browser that asks not to be tracked gets neither: the Do Not Track setting stops our own recording, and it stops Google Analytics from being switched on for that visit, so no cookie is set and nothing is sent. Google’s own opt-out add-on for browsers does the same for Google, and clearing the two cookies ends the identifier. There’s no advertising pixel and no session recording on this site.

Enquiry details are used to reply to you, to scope and quote the work, and, if you go ahead, to invoice it and deliver it. They don’t go on a mailing list, into a newsletter, or to anybody else for any other reason.

Analytics, ours and Google’s, are used to see which pages get read and which get ignored, and whether anything sent out actually brought someone here. They aren’t used to identify an individual. Our own record holds nothing that could; Google’s holds a random cookie value that we never connect to a name.

On infrastructure we run and administer ourselves, in Australia. It’s the same class of system our founder looks after for a healthcare provider under Privacy Act obligations, and it’s held to the same standard.

Three outside services hold a narrow slice. Google holds the analytics described above, on its own servers, which may be outside Australia, under Google’s terms. The calendar behind the booking page holds what it needs to send you an invitation. Once you’re a client, the payment processor holds what it needs to issue and collect an invoice. None is given anything beyond that, and nothing is sold to anyone, ever.

Our own analytics rows carry no identifier that outlives the day they were written, so after a day there’s nothing in them to keep or delete about a person. Google keeps its analytics data for the retention period set on our account, fourteen months, and its two cookies expire two years after your last visit.

Enquiries are kept while there’s a reason to keep them: a conversation that’s still open, a quote you might come back to, or a record of work we’re required to hold for tax. When none of those applies any more, or when you ask, it is deleted.

Email hello@zandercs.com and say what you want. A copy of everything held about you, a correction, or deletion: all three are yours to ask for. There’s no form to fill in, and we’ll confirm in writing when it is done.

If you’re not satisfied with how a request was handled, the Office of the Australian Information Commissioner takes privacy complaints at oaic.gov.au.