Last updated: 29 October 2026
This page explains what personal data I collect when you use this website or ask me about a kitten, what I do with it, how long I keep it, who else handles it, and what rights you have under UK data protection law. I have kept it in plain English. If anything is unclear, email me and I will explain it properly.
Who I am
Burnthwaites Siamese & Orientals is my cattery. I am Ross Davies, and I am the data controller for this website and for the Burnthwaites kitten waiting list under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
You can email me at ross@burnthwaitessiamese.co.uk.
What I collect and why
1. Kitten enquiries and the waiting list
When you send a kitten enquiry, I collect what you type into the form: your name, email address, phone number if you give one, your town or area, the breed, colour or sex you would like, when you are hoping to bring a kitten home, what you tell me about your home, and anything else you add.
I use it to reply to you, to work out whether one of my kittens would suit you, and to keep your place on my waiting list. Alongside your enquiry I keep a status (for example waiting, offered or reserved) and my own private notes, such as when we last spoke. Your enquiry is kept on this website and is not visible to the public. Only I can open the waiting list, using a single-use sign-in link sent to my own email.
Lawful basis: steps taken at your request before a possible sale (UK GDPR Article 6(1)(b)), because you have asked me about a kitten, and my legitimate interest in running a fair waiting list (Article 6(1)(f)).
How long I keep it: your enquiry is deleted automatically 12 months after it was last updated, or sooner if you ask me to remove it.
2. Litter news emails
The enquiry form has a separate box: “Yes, tell me when a litter that suits me is born”. It is not ticked unless you tick it. If you do, I may email you when a litter is born that might suit you. I write and send these myself, only when I have news. Each person gets their own email, so nobody sees anyone else’s address, and every email has a link to stop them.
Lawful basis: consent (UK GDPR Article 6(1)(a) and the Privacy and Electronic Communications Regulations, regulation 22). You can withdraw it at any time with the link in any of my emails, or by emailing me.
How long I keep it: until you unsubscribe or your enquiry is deleted. When you unsubscribe, I keep a scrambled (one-way hashed) copy of your email address, so that an older enquiry cannot be emailed by mistake. If you later send a new enquiry and tick the box again, I will treat that as a fresh yes.
3. The contact form
The contact form collects your name, email address and message. It is not stored on this website. The form emails it straight to me, and I use it only to reply to you.
Lawful basis: legitimate interests (UK GDPR Article 6(1)(f)), replying to a message you have sent me.
How long I keep it: up to 24 months after our last exchange, then deleted.
4. Comments on blog posts
If you leave a comment, I collect your name, email address and comment. Your name and comment are shown publicly once approved. Your email address is not. WordPress also records your IP address and browser details to help filter out spam.
Lawful basis: consent (UK GDPR Article 6(1)(a)), given when you submit the comment.
How long I keep it: until you ask me to remove it. I will do that within 30 days of your request.
5. Server logs
My web host automatically records standard technical details when any page is visited, including your IP address, browser details, the page requested and the time. These are used only for security and to fix problems, and are not combined with anything else to identify you.
Lawful basis: legitimate interests (UK GDPR Article 6(1)(f)), keeping the site secure and working.
How long I keep it: 30 days, then deleted automatically.
6. Visitor statistics (Google Analytics)
I use Google Analytics to see which pages people read and how they found the site. It only runs if you accept analytics cookies in the cookie banner. If you decline, no analytics cookies are set and nothing is sent to Google Analytics.
Lawful basis: consent (UK GDPR Article 6(1)(a) and the Privacy and Electronic Communications Regulations, regulation 6).
How long I keep it: no longer than 14 months, after which Google deletes the visit-level data.
7. Fonts
The lettering on this site is loaded from Google Fonts. To show it, your browser connects to Google’s servers, which means Google receives your IP address. No cookies are set for this.
Lawful basis: legitimate interests (UK GDPR Article 6(1)(f)), displaying the site properly.
Cookies
- Analytics cookies (Google Analytics): only if you accept them in the cookie banner.
- Comment cookies (WordPress): only if you leave a comment and choose to have your details remembered.
- Waiting-list sign-in cookie: used only when I sign in to my own waiting list. Visitors never receive it.
This site does not use advertising or social-media tracking cookies.
Who else handles your data
I do not sell, rent or trade your personal data. These service providers handle it only as far as they need to for the website to work:
- Hostinger: hosts the website and its database, including enquiries and comments, and runs the content delivery network that serves the pages.
- Google: delivers the website’s emails (Google Workspace), measures visits if you accept analytics cookies, and serves the fonts.
- Gravity Forms: the software that runs the enquiry form. It runs on this website and does not send your enquiry anywhere else.
- Cats Whiskers Web Designs: builds and maintains this website and may see enquiry data while doing so.
Police, councils and other authorities
I do not routinely pass data to public authorities. I will share information with the police, a local council, Trading Standards or a court only when the law requires it, or where it is necessary to prevent or detect fraud or crime, or to protect a cat’s welfare.
Data outside the UK
Google may process personal data outside the United Kingdom. Where that happens, it is covered by a UK adequacy decision (including the UK-US Data Bridge) or by approved contract terms (the UK International Data Transfer Agreement or Addendum).
Your rights
- Access: ask for a copy of the personal data I hold about you.
- Correction: ask me to put right anything that is wrong.
- Deletion: ask me to delete your data, including taking you off the waiting list.
- Restriction: ask me to pause using your data in certain circumstances.
- Portability: ask for your data in a format you can take elsewhere.
- Objection: object to anything I do on the basis of legitimate interests.
- Withdrawing consent: where I rely on your consent, you can withdraw it at any time.
To use any of these rights, email me at ross@burnthwaitessiamese.co.uk. I will reply within one calendar month and there is no charge.
Keeping it safe
The whole site runs over an encrypted (HTTPS) connection. The waiting list is on a private page that search engines are told not to index and that only opens with a single-use link sent to my own email. Access to the website’s admin area is restricted.
No system is completely secure. If a breach of personal data is likely to put your rights at risk, I will report it to the Information Commissioner’s Office within 72 hours and tell anyone affected without undue delay.
Children
This site is not aimed at children under 13, and I do not knowingly collect their data. If you think a child under 13 has sent me their details, email me and I will delete them.
Changes to this policy
If I change how I use your data, I will update this page and the date at the top.
Complaints
If you are unhappy with how I have handled your data, please email me first so I can put it right. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator:
Information Commissioner’s Office
Wycliffe House, Water Lane
Wilmslow, Cheshire SK9 5AF
Helpline: 0303 123 1113
Website: ico.org.uk