Legal
Privacy
Last updated 11 August 2026
Who we are
Own the Patch is a trading name of Eric Phung. Eric Phung is the data controller for this website and for our relationships with clients and prospective clients. You can reach us at [email protected].
We are registered with the Information Commissioner's Office as a data controller. Own the Patch is a trading name recorded against that registration.
This notice covers our own clients and prospects. If you enquired through a website we built for one of our clients, that client is the controller of your data and their own privacy notice applies — we act only as their processor.
This website
Beyond the standard server request logs our host keeps to serve pages and defend against abuse, this site uses the services below. See our cookie notice for detail.
- Formspark and Cloudflare Turnstile — Receiving and spam-filtering enquiry form submissions.
If you contact us or become a client
When you email or message us we keep that correspondence and the details in it so we can reply and, if you become a client, deliver the service. As a client we also hold your business contact details, the content and access we need to build and run your site, and your payment records. The lawful basis is our legitimate interest before a contract, and performance of the contract after one.
How we contact businesses
We approach UK trade businesses directly about our service. Contact details are sourced from publicly available business listings and company records. Where a business is a limited company we contact it as a corporate subscriber; where it is a sole trader or unincorporated partnership we rely on consent or the soft opt-in, in line with the Privacy and Electronic Communications Regulations.
Every message identifies us and carries a way to opt out, and we act on an opt-out immediately and permanently. Ask us to stop and we will, and we keep a suppression record purely so that we do not contact you again.
Who we share it with
We do not sell personal data and we do not share it for advertising. Data reaches the providers below only so they can perform their function for us, under contract and on our instructions.
- Cloudflare — Website hosting and DNS.
- GoCardless — Direct Debit mandates and payment collection.
- WhatsApp (Meta) — Client messaging, where a client chooses to use it.
- Our email provider — Correspondence with clients and prospects.
- Google — Analytics and Search Console access for client reporting.
How long we keep it
Client and enquirer data — the content, leads and customer data we hold for you — is kept for as long as your subscription is active. On cancellation or transfer we export it, provide it to you, and delete our copies within 30 days.
Our business records — order forms, invoices, payment records and the correspondence evidencing a contract — are kept for six years and used for no other purpose. UK tax law requires this, and the deletion above does not apply to them.
Prospect correspondence that does not lead to a contract is kept for two years.
If something goes wrong
If a personal data breach affects data we hold for a client, we will notify that client without undue delay after becoming aware of it, and give them the information they need to meet their own regulatory obligations as controller.
Your rights
You can ask for a copy of the personal data we hold about you, ask us to correct or delete it, ask us to restrict how we use it, or object to it. Write to us and we will respond within one month. If you are not satisfied, you can complain to the Information Commissioner's Office at ico.org.uk.
Changes
When this notice changes we update the date at the top. Material changes to how we use personal data are flagged to clients directly.