Privacy and cookies

Patrick Media is me, Patrick Angeles, a director and editor working from Balayan, Batangas 4213, Philippines. I make video and static images for brands in Canada, the US, the UK, Australia and New Zealand. For anything on this page, whether that is access, deletion or a complaint, write to patrick@patrickmedia.co. I am the data controller for everything described here.

No analytics cookie is set until you press Accept analytics on the banner. Until then Google Analytics runs with analytics storage denied: it sends a cookieless signal that a page was viewed and stores nothing on your device. If you decline, it stays that way. I do not use advertising, marketing or profiling cookies at all, and there are no third-party trackers on this site beyond that one analytics tag.

If you accept, Google Analytics gives me totals: pages viewed, roughly where in the world visitors come from (city level at best), which site or search sent them, and what kind of device they used. Google uses your IP address to work that out but does not store it, and I never see it. I cannot identify you from any of it, and Google advertising features are switched off, so nothing here feeds ad targeting.

If you send a note through the form on the contact page, I receive your name, email, business name, the kind of work you need, your monthly budget range if you give one, and your message. It is emailed straight to my inbox so I can reply. I use it to answer you and, if we end up working together, to run the work. A hidden field catches spam bots; if it is filled in, the submission is thrown away and nothing is sent. My lawful basis is your consent in sending it, and taking steps at your request before a contract.

Calls are booked through Calendly, embedded on the Book a call page. It collects your name, email and time zone and puts the meeting in my Google Calendar with a Google Meet link. What Calendly does with that is covered by its own privacy policy, and it may set its own cookies inside the booking window. I do not record calls.

If you are reading this because I emailed you out of the blue, this part matters. I use business contact addresses that the business itself has published: the contact page of your website, your public listing or your social profile. I do not buy lists, I do not take addresses from personal inboxes and I do not guess them. I keep a note of where I found yours, so if you ask I can tell you the exact page.

I hold your name, business, role, that public address, your website and my notes on whether we might fit and what I have sent. My lawful basis is legitimate interest, which is offering a relevant business service to a business, kept in check by a hard limit on how often anyone is contacted. In the UK I write only to limited companies and similar corporate bodies, and I leave sole traders and partnerships alone.

One reply stops everything. Every email carries an opt-out line, and “no thanks”, “unsubscribe” and “remove me” all do the same thing: I mark you opted out, the follow-ups stop and I never write again. If you would rather I delete the record entirely, say so and I will, though a short do-not-contact note is what keeps you from being added again from the same public page.

Two companies receive data you give me, and neither may use it for its own purposes:

• Google runs Analytics (only with your consent), my email and calendar, and the YouTube player on the works page. Nothing loads from YouTube until you press play, and the player uses its privacy-enhanced mode.
• Calendly handles call bookings.

The site files are served from Vercel, which processes requests and the contact form on my behalf. I never sell, rent or trade your data, and I do not share it for anyone else’s marketing. I would only hand something over if the law required it.

I work from the Philippines and the companies above are largely US-based, so data about you may be handled outside your own country. Where UK or EU data protection law applies, those transfers rely on the standard contractual clauses that Google, Calendly and Vercel publish.

• Analytics: 14 months, then Google deletes it automatically.
• Enquiries: 2 years from your last message, so we can pick a conversation back up.
• Prospect records: reviewed every year. Anything cold and going nowhere is deleted.
• Opt-outs: kept indefinitely, because that record is what keeps you off the list.
• Client records: for the contract, plus 7 years for tax and accounting.

Wherever you are reading this from, you can ask me for a copy of what I hold on you, ask me to correct it, ask me to delete it, or tell me to stop using it, including objecting to my cold emails, which I will always honour without argument. Write to patrick@patrickmedia.co and I will deal with it within 30 days. There is no charge and you do not have to say why.

These rights come from the UK and EU GDPR, PIPEDA in Canada, the Privacy Act 1988 in Australia and the Privacy Act 2020 in New Zealand. I apply the same standard to everyone rather than sorting people by country. If I have handled something badly you can complain to your own regulator (the ICO in the UK, the OPC in Canada, the OAIC in Australia or the Privacy Commissioner in New Zealand), but please give me the chance to fix it first.

If this policy changes I will update the date at the top of the page. If the change is significant, such as a new supplier or a new kind of data, I will reset the cookie banner so you are asked again rather than quietly carried over.