Privacy notice: businesses I contact, people who reply, and visitors to this website

Who is responsible

Laguda Nigel Abiodun. I am the individual responsible for this activity, and I carry it out personally under the name Petit Solutions. I decide why and how I use the information described in this notice, so I am its controller. 54 Peddie Street, Dundee, DD1 5LZ, United Kingdom. Contact: info@petitsolutions.com.

Who this notice is for

1. Businesses I contact by email at the general mailbox they publish. This is a small number of businesses, each sent one email and at most one follow-up.
2. People who reply to me or write to info@petitsolutions.com.
3. People who visit petitsolutions.com, including anyone who uses its contact form.
4. People at businesses I already know, whom I contact to ask whether my services could help their business.

If you use the contact form on this website

The contact form on petitsolutions.com does not send your message to me itself. When you submit it, it opens a pre-filled email to info@petitsolutions.com in your own email program, containing your name, your company, your work email, the kind of help you need and your message. Nothing reaches me unless you send that email. If no email program opens, nothing has been sent: please write to info@petitsolutions.com directly. The form does not store what you type. I treat an email sent this way as an enquiry, in the same way as any other email to info@petitsolutions.com. I use it to reply to you and to discuss work if you ask. The legal basis, the services that hold it, how long I keep it and your rights are as set out below for replies and enquiries.

If you visit this website

petitsolutions.com is hosted by Cloudflare, so Cloudflare handles your browser's requests for its pages, which include your IP address. Cloudflare states that, for websites on this plan, its records of requests and security events are kept for at least 31 days. That statement gives no maximum, and I have not confirmed which details of a request, such as the IP address, those records hold. The website uses no analytics or visit-counting script, and its pages load no fonts or other content from any other company. When the site was checked on 12 October 2026, loading a page set no cookie that the page itself could read, and stored nothing in your browser's local or session storage. I use this information only to run the site and keep it secure. Legal basis: my legitimate interests in running a working and secure website (UK GDPR Art. 6(1)(f)).

What information I hold

About businesses I contact: the business and trading name; its legal form, where its page or the public register shows it; the company number and its status on the public register; town; the service the business advertises; the general email address and the contact page it publishes; the web page I read it from, with the date; a one-line note on why I chose to write; and the dates I wrote. My list may also hold a few organisations that could refer work to me, such as accountants and trade associations, with similar business details. My outreach list and its contact records hold no staff names, personal email addresses, phone numbers or postal addresses.

About people who reply: your name, your contact details, your business and what you tell me.

About people at businesses I already know: your name, your work contact details, your role, and what you tell me about your business's needs.

Where it comes from

Your business's own public website and the public company register. If you reply, the information comes from you. If I already know you, your contact details come from my previous dealings with you, and everything else comes from you.

Why I use it, and the legal basis

• Direct marketing of the services I offer under the name Petit Solutions. I write to a few businesses to offer these services, and I keep a record of that contact. This counts as direct marketing even when my first message asks a question. Legal basis: my legitimate interests (UK GDPR Art. 6(1)(f)). Art. 6(11)(a) names direct marketing as an example. I have recorded a legitimate interests assessment, and you can ask me for a copy.
• Replying to you, and discussing work if you ask. Legal basis: my legitimate interests.
• Not contacting you again. If you ask me to stop, I keep a short record so that I never contact you again. Legal basis: my legitimate interests. When you object to direct marketing, the law requires me to stop using your information for that purpose (UK GDPR Art. 21).

No decision about you is made solely by automated means. My AI assistant helps me organise and draft, but I make the decisions, and I send every message myself.

Who I share it with

I do not sell it. I share it only with the services I use to hold and handle it (for the website, see above): Cloudflare Email Routing, which forwards mail sent to info@petitsolutions.com to my Gmail mailbox, and Gmail, where that mail is held and through which I send my messages from info@petitsolutions.com (using Gmail's "Send as"). I also use Claude, an AI assistant provided by Anthropic, through my own claude.ai account on the Claude Max (5x) plan. The account has a setting that lets Anthropic use my conversations and coding sessions with Claude to improve its AI models. When I checked it on 12 October 2026, it was switched on, and I switched it off that evening (UK time). With the setting off, Anthropic states that it does not use new sessions for future model training unless the account has otherwise opted in to training, although it may still use sessions its safety systems flag to detect harmful content. Sessions before I switched it off on 12 October 2026, including sessions that read my list of businesses, may already have been used, and Anthropic does not remove data from model training that has already started. No one else can see the account. It reads my list of the businesses I contact and helps me draft my initial outreach emails. Replies and enquiries are handled without Claude: I do not give them to it. It has no access to my mailbox, and I send every message myself.

Information sent outside the UK. Each of the companies named below says that it holds, or may process, information outside the UK. So information held by these services is, or may be, held outside the UK.

• Cloudflare (website hosting and Email Routing). Cloudflare's terms name Cloudflare, Inc., of San Francisco, United States, as the provider. Its data processing addendum, which forms part of those terms, describes Cloudflare as a processor, which handles information on its customer's behalf. Cloudflare's privacy policy says that it primarily stores the information it covers in the United States and the European Economic Area. Neither document says this separately for Email Routing. The UK has adequacy regulations for the United States, the Data Protection (Adequacy) (United States of America) Regulations 2023, but they cover only a US recipient listed as participating in the UK Extension to the EU-US Data Privacy Framework. On 14 October 2026, the Data Privacy Framework List showed Cloudflare, Inc. as participating in the UK Extension, with the status "Active - Re-certification under Review". I rely on those regulations for information Cloudflare holds in the United States. Cloudflare's data processing addendum applies the EU standard contractual clauses, as amended by the UK Addendum, to transfers from the UK, but treats transfers made under that framework as not needing the clauses. If Cloudflare stops being listed, those clauses apply instead. The UK regulator's guidance (ico.org.uk) states that "All the countries in the European Economic Area (EEA) have full adequacy". Those countries include Ireland, and UK adequacy regulations cover the information Cloudflare holds there. Cloudflare's data processing addendum is published at https://www.cloudflare.com/cloudflare-customer-dpa/, and you can ask me for a copy at info@petitsolutions.com.
• Google (Gmail). Google's privacy policy, in its UK version as read on 14 October 2026, names Google LLC, of Mountain View, United States, as the data controller for users of Google services based in the United Kingdom, unless a service-specific privacy notice says otherwise. Google states that its users' information may be processed on servers located outside the country where they live. On 14 October 2026, the Data Privacy Framework List showed Google LLC as participating in the UK Extension, with the status "Active". So the UK's adequacy regulations for the United States, described above, cover information sent to Google LLC.
• Anthropic (Claude). Anthropic's privacy policy names Anthropic Ireland, Limited as the controller responsible for the personal data of its users in the UK. Its consumer terms, as read on 14 October 2026, are a contract with Anthropic, PBC, under the law of California, United States. Anthropic states that its users' personal data is transferred to its servers in the United States, and that it relies on standard contractual clauses, with an approved equivalent for the UK. Its privacy policy does not name that UK document. Anthropic does not appear on the Data Privacy Framework List (searched on 14 October 2026), so the UK's adequacy regulations for the United States do not cover it. The UK's adequacy regulations do cover Ireland, as described above. Anthropic states that questions about its international transfers, or the safeguards it applies, can be sent to privacy@anthropic.com. It sets out no procedure for obtaining a copy. Anthropic does not state whether it handles information about other people that I give Claude as a controller in its own right or on my behalf. Its privacy policy, as read on 15 October 2026, states that if personal data is included in what a user gives Claude, Anthropic collects it, and that the user is responsible for having the necessary rights, permissions or authority to include it. I give Claude only the business information described in this notice. I do not give it replies or enquiries. Anthropic Ireland, Limited's registered address is 6th Floor, South Bank House, Barrow Street, Dublin 4, D04 TR29, Ireland.

How long I keep it

• My list of businesses:
  • If my outreach is not authorised by 12 April 2027, the list holding your business's details is deleted.
  • If the outreach runs, the details of every business on the list that I did not contact are deleted within 3 months after the outreach ends.
• Your business's details in my contact records (the business details above and the dates I wrote): if I contacted your business and we did not go on to work together, they are deleted 12 months after my last contact.
• Replies and enquiries, including the name and details of anyone who writes to me: deleted 90 days after the last exchange, unless I have recorded a need to keep them for an active conversation. In that case I keep them only while the need lasts. When a reply is deleted, only your business's details stay, under the line above.
• If I already know you and contacted you about my services: if you do not reply within 30 days, I delete your details from my business records. If you reply, your reply is kept as set out above for replies.
• If you ask me to stop: I keep your business name, the address or domain you asked me to stop using, the date and channel of your request, the date I recorded it, and a note of what the request covered. I keep this only for as long as I need it to honour your request.
• Copies held by my AI assistant: where I have given any of this information to Claude, copies are also held in my Claude account and, for sessions run on my computer, in the assistant's session records there. Those copies may be kept longer than the periods above. I delete those conversations in my Claude account by the same dates where the service lets me. Anthropic states no fixed period for a conversation that has not been deleted. It removes a deleted conversation from its systems within 30 days, and it may keep content its safety systems flag for up to 2 years. Sessions held before I switched the setting off on 12 October 2026 may also be kept by Anthropic in de-identified form for up to 5 years.

Your choices and rights

• You can ask me to stop at any time. Reply "no thanks" to any message, or write to info@petitsolutions.com. It costs nothing. Your request takes effect when it reaches me, and I will not contact you again.
• You also have the right to ask me for access to the information I hold about you, and to ask me to correct it, delete it or restrict how I use it. You have the right to object to my use of it. If you object to direct marketing, I stop using your information for that purpose. The right to data portability (to receive information you have given me in a form you can pass on to someone else) applies only where the legal basis is your consent or a contract with you, and the information is processed by automated means. It does not apply where I rely on my legitimate interests.
• I will reply to a request about your rights without undue delay, and within one month of receiving it. If I need to ask you for information to confirm who you are, the month starts when I receive it. If a request is complex, or you make several, I may need up to two more months. If so, I will tell you within the first month and explain why. There is no charge, unless a request is manifestly unfounded or excessive.

Complaints

Please tell me first, at info@petitsolutions.com. You also have the right to complain to the UK data protection regulator, the Information Commission. Its website still uses the name Information Commissioner's Office (ICO). You can complain online at https://ico.org.uk/make-a-complaint/data-protection-complaints/ or call its helpline on 0303 123 1113. It will ask for a copy of the complaint you first made to me.

Changes

Last updated: 16 October 2026. I will update this notice if anything in it changes.