Privacy policy
This policy explains what personal data I collect through this website, why I use it, and the rights you have.
Last updated 20 September 2026.
Who I am
This website is operated by Dan Tarbuck, a sole trader trading as exoReach. I am the data controller for personal data collected through https://exoreach.co.
Contact: dan@exoreach.co.
What I collect
I collect personal data in three main ways.
Information you send me
If you use the Start a project form, I receive the details you submit. That typically includes your name, email address, business name, website address if you provide one, what you would like help with, a description of what needs to improve, and an indication of investment.
If you email me, I also hold the content of that correspondence and any files you attach.
Information collected automatically
Servers and the website software may record technical information such as IP address, browser type, the pages requested, and the date and time of the request. This is ordinary hosting and security logging.
Cookies and similar tools are described in the cookie policy.
What I do not collect through this site
The public website does not take card payments, does not create a public user account, and does not currently run advertising or analytics tags that profile you for ads.
How I use personal data
I use personal data to:
- Respond to enquiries and decide whether I can help.
- Carry out work we have agreed, including websites and Business Brain projects.
- Keep records of conversations, proposals and invoices.
- Run, secure and improve this website.
- Comply with the law, including tax and accounting duties.
Legal bases
Under UK GDPR I rely on these bases, depending on the situation:
- Legitimate interests: running a professional practice, answering genuine enquiries, keeping the site secure, and keeping records of how we worked together.
- Contract: taking steps before a contract, and performing a contract once we have agreed the work.
- Legal obligation: keeping records the law requires.
- Consent: only where I specifically ask for it, for example if I later use optional cookies that need consent. You can withdraw consent at any time.
Who I share data with
I do not sell personal data. I share it only where needed to run the practice:
- Hosting and email providers who store the website and deliver messages.
- Specialist partners working on a project, only as needed for that job, and under my instruction.
- Professional advisers, such as an accountant, where the law or the work requires it.
- Authorities, if the law requires disclosure.
Those providers act as processors or independent controllers according to their role. I expect them to handle data lawfully.
How long I keep it
Enquiry records are kept while they are useful for the conversation and for a reasonable period afterwards, then deleted or reduced to what I still need.
Project files, contracts and invoices are kept for the life of the work and for as long as tax, accounting or legal duties require.
Server logs are kept for a short period for security and diagnostics, unless a longer period is needed to investigate an incident.
Where data is stored
I am based in the United Kingdom. Hosting and email providers may store data in the UK, the European Economic Area, or another country.
If personal data is transferred outside the UK, I rely on a lawful transfer mechanism, such as an adequacy decision or appropriate contractual clauses, as required.
Security
I take reasonable technical and organisational steps to protect personal data. No method of internet transmission or storage is completely secure, and I cannot guarantee absolute security.
Your rights
You have the right, in the circumstances the law allows, to:
- Ask for a copy of the personal data I hold about you.
- Ask me to correct inaccurate data.
- Ask me to delete data, or to restrict how I use it.
- Object to processing that relies on legitimate interests, and to object to direct marketing.
- Receive data you provided in a portable format, where the right applies.
- Withdraw consent, where I am relying on consent.
To exercise these rights, email dan@exoreach.co. I may need to confirm your identity before I respond.
You can also complain to the Information Commissioner’s Office at ico.org.uk.
Children
This site is aimed at businesses. I do not knowingly collect personal data from children.
Changes
I may update this privacy policy. The date at the top of this page will change when I do.
Contact
Privacy questions: dan@exoreach.co.
Use of the site is also covered by the terms of service.