Privacy Policy — Civil & Structural Engineering Consultancy | AES Ltd

Who is responsible

Architecture & Engineering Services Limited (AES Ltd) is the data controller for this website. Jason James McCaffrey M.Eng (Hons), Chief Executive Officer, is responsible for data protection.

Contact for any privacy matter: jjmc@jjmccaffrey.com or +44 (0)7890 278110.

This policy is written to the UK General Data Protection Regulation and the Data Protection Act 2018. It is written in plain English on purpose: a privacy policy nobody can read is not informed consent.

What is collected, and why

If you create an account

Four things, and no more:

Your email address — it is your username, and it is where the confirmation email goes.
A bcrypt hash of your password — not the password. A hash is a one-way transformation; it cannot be turned back into what you typed, which is why nobody here can tell you what your password is.
Dates — when you registered, when you confirmed the address, when you last signed in, and how many times you have signed in.
The display settings you choose to save — slider positions for the atom animation. Nothing about you.

Lawful basis: performance of a contract (Article 6(1)(b)). You asked for an account; an account cannot exist without somewhere to keep it.

If you consent to marketing

Your email address is used to send occasional updates about new engineering tools, downloads and capability notes. The box is ticked by default at registration with a plain opt-out beside it, and every change of mind is recorded with a timestamp.

Lawful basis: consent (Article 6(1)(a)), and Regulation 22 of PECR. Withdraw it at any time from your account page or from the unsubscribe link in any email — withdrawing is as easy as giving it, which is what the law requires.

If you accept analytics

Only if you accept. If you decline the banner, nothing in this section happens at all and the site works identically.

The page you opened, its title, and how long it was open
Your browser and its major version, your operating system, and whether you are on a desktop, tablet or phone — all in broad terms, deliberately not precisely enough to identify a device
An approximate town and country, resolved from your IP address at the moment of collection
Where you arrived from — direct, a search engine by name, or the host of a referring site. Never the full referring URL
A random identifier for the visit, held only in your browser tab and destroyed when you close it

Lawful basis: consent (Article 6(1)(a)).

Your IP address is never stored. It is read on the server, converted into an approximate town, and discarded within the same request. There is no field for it in the database and no way to recover one. A salted one-way hash of it is briefly kept — for at most 24 hours — purely so the location service is not asked about the same visitor twice; that hash cannot be reversed to an address.

If you use the contact form

Nothing is collected. The Send button opens your own email application with the message ready to go. Nothing you type reaches this website's server.

How long it is kept

Account details	Until you delete the account. There is no automatic expiry, because an account that vanished on its own would be worse than useless.
Marketing consent record	Kept for the life of the account, then reduced to a non-identifying stub. Regulators expect a controller to be able to show consent existed; the stub does that without holding anything personal.
Analytics records	180 days, then deleted automatically. Deletion actually runs — it is triggered whenever the analytics page is opened, not merely promised here.
Location cache	24 hours, as a salted hash only.
Unconfirmed registrations	The confirmation link expires after 48 hours. An account never confirmed cannot be signed in to.

Who it is shared with

Nobody, for their own purposes. Ever. Your data is not sold, rented, traded or passed to advertisers, data brokers or partners.

Three processors are involved in running the site, and only to the extent described:

Hostinger International Ltd — hosting. Your data sits on their servers because the website does.
ip-api.com — receives an IP address to resolve into a town, and is given nothing else: no name, no email, no account reference, no page. It cannot connect the address to a person because it is never told there is one.
Google Maps — draws the map on the private administrative page. It receives coordinates of towns, never anything about an individual. This runs only when the site owner opens that page; no visitor ever loads it.

Marketing email, if you consent to it, is sent by AES Ltd directly.

Your rights

Under UK GDPR you have the following rights. Where a button on this site already does the job, it is named — a right that needs a letter written is a right most people never use.

Access Art. 15	See everything held about you. Your account page lists it in full; Download a copy exports the lot.
Rectification Art. 16	Correct anything wrong. Settings and consent are editable directly; email jjmc@jjmccaffrey.com to change an address.
Erasure Art. 17	Delete my account permanently on your account page. Immediate, complete, irreversible, and confirmed by email.
Portability Art. 20	The Download a copy button gives you machine-readable JSON another system can import.
Restriction Art. 18	Ask for processing to be paused while a dispute is resolved. Email us.
Objection Art. 21	Object to processing, including marketing. Untick the box — the objection takes effect at once.
Withdraw consent Art. 7(3)	Marketing: your account page. Analytics: the cookie policy has a button that clears the choice and asks again.

No fee is charged, and no reason need be given. Anything not covered by a button is answered within one month, as the regulation requires.

Deletion in practice

The law allows up to a month. This site does it immediately, because there is no operational reason to wait.

When you confirm deletion: your email address, password hash, dates and saved settings are removed from the database outright; any analytics rows that pointed at your account stop pointing at anything and become indistinguishable from an anonymous visit; the consent history is stripped of your address and reduced to a stub proving a lawful basis once existed. A confirmation email is then sent — the last use of the address before it is gone.

What cannot be undone: exactly that. There is no recovery, no grace period, and no archived copy waiting quietly somewhere. That is what erasure means, and it is worth understanding before you press the button.

Security

The whole site is served over HTTPS. There is no unencrypted route to it.
Passwords are stored as bcrypt hashes, never as text, and never logged.
Session cookies are marked HttpOnly, Secure and SameSite=Lax — unreadable by scripts, never sent over plain HTTP, never attached to requests started by another site.
Every database query uses prepared statements, so nothing typed into a form can be executed as a command.
Repeated failed sign-ins from one connection are locked out for fifteen minutes.
Visitor accounts and the site owner's administrative login use entirely separate session mechanisms. No visitor account can reach any administrative page — not because permission is refused, but because there is no path between the two.

Children

This site sells professional engineering consultancy and is not directed at children. Accounts are not knowingly created for anyone under 13. If you believe a child has registered, email jjmc@jjmccaffrey.com and the account will be erased.

Complaints

Please raise anything with us first — most concerns are resolved the same day. You also have the right to complain directly to the supervisory authority:

Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Helpline 0303 123 1113 · ico.org.uk

Changes to this policy

The date at the top of this page is the date it last changed. A change that materially affects how your data is used will be notified by email to account holders before it takes effect, not applied quietly and dated afterwards.

Privacy policy.