Privacy Policy
1. Who we are
This website and the KernForms platform are operated by P&C Creative Planning (“we”, “us”, “our”). We are a sole trader and the data controller of the personal data described in this policy.
Contact: pandcworkshop@proton.me
2. What this policy covers
This policy explains how we handle personal data when you:
- visit our website at kernforms.co.uk; or
- contact us by email or through a contact form.
It does not cover personal data processed inside the KernForms platform on behalf of our client companies — see section 7.
3. What we collect and why
If you contact us (by email or contact form), we collect:
- your name;
- your email address; and
- the content of your message.
We use this only to read and respond to your enquiry and to keep a record of our correspondence.
Cookies and analytics. Our website does not set non-essential cookies and does not run analytics or tracking. We do not build profiles of visitors.
Hosting and technical data. Our website is hosted on Cloudflare. To deliver the site and protect it from abuse, Cloudflare processes limited technical data — such as your IP address and standard server log information — on our behalf. We rely on our legitimate interest in the security and reliable delivery of the website for this.
4. Legal basis
We rely on our legitimate interests (UK GDPR Article 6(1)(f)) in responding to enquiries and running our business. Where we ever ask for your consent, we rely on consent (Article 6(1)(a)), which you may withdraw at any time.
5. Who we share it with
We do not sell your personal data. We share it only with the service providers that make our communications work:
- Proton Mail (Proton AG, Switzerland) — handles the email through which we receive and reply to your messages.
- Resend (Resend Inc., United States) — processes contact form submissions on our behalf to deliver your enquiry to our inbox.
- Cloudflare — hosts our website and processes limited technical/log data as described in section 3.
6. International transfers
Proton Mail is based in Switzerland, which the UK recognises as providing an adequate level of data protection. Cloudflare and Resend are based in the United States; where they process data outside the UK, those transfers are covered by an appropriate safeguard such as standard contractual clauses. Where any provider processes data outside the UK, we rely on an appropriate transfer mechanism (adequacy, standard contractual clauses or certification).
7. Data inside the KernForms platform
When a client company uses KernForms, the personal data of that company’s employees and workers is processed on that company’s instructions. In that situation:
- the client company is the data controller; and
- we are the data processor.
We are not a joint controller of that data. If you are an employee of a company that uses KernForms and you have questions about how your data is used, please contact your employer — they are responsible for that information. Our obligations as processor are set out in our Data Processing Agreement with each client.
8. How long we keep it
We keep enquiry correspondence only as long as needed to handle your enquiry and for a reasonable period afterwards for our records, then delete it.
9. Your rights
Under UK data protection law you have the right to: access your personal data; have inaccurate data corrected; have your data erased; restrict or object to processing; data portability; and to withdraw consent where we rely on it. To exercise any right, email us at the address above. We will respond within one month.
10. Complaints
If you are unhappy with how we have handled your personal data, you can complain to us first. You may also complain to the Information Commissioner’s Office (ICO) — ico.org.uk — Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF; helpline 0303 123 1113.
11. Changes
We may update this policy. The version and “last updated” date at the top show the current version. Material changes will be reflected here.
KernForms — kernforms.co.uk — P&C Creative Planning — Version 1.0 — 10 June 2026