Who we are
Hesketh & Son is a trading name of Hesketh and Son AS, a business registered in Norway (org. no. 938 355 908, Brønnøysund Register Centre, Norway's equivalent of Companies House). We draft tender, grant, and award submissions for small and mid-sized firms in the UK and Norway.
This page sets out what we collect when you visit heskethandson.com, why we collect it, and what you can do about it.
What we collect
1. Server logs, kept by our hosting provider.
Our host, Bunny CDN, keeps standard server logs for every visit to this site: your IP address, the pages you request, and the time you request them. We use these logs to keep the site secure and running, and to understand basic traffic patterns. We do not use them to build a profile of you as an individual. Our host retains these raw logs for a short period, a few days, after which they are automatically deleted; from them we keep only aggregate visit counts, which cannot identify you. Our legal basis is legitimate interest (in plain terms: a reasonable, low-impact use that doesn't need your separate permission): keeping our website secure and working correctly.
2. Personalised links we send you.
If we have sent you a personalised link, for example a page we have built around your company's public evidence, and you follow it, we may note that your organisation viewed the page. We use this to follow up on our proposal to you: for instance, to know a link has been read before we write or call again. We do not track you as an individual across other sites, and we build no profile beyond your organisation reading the page we sent you. Our legal basis is legitimate interest: following up on business correspondence we have already opened with you.
3. Email correspondence.
If you write to us, by email or through the form on this site, we hold that correspondence to answer you, to deliver the work you have asked for, and to keep a record of what we have agreed. We do not add your address to a marketing list without telling you first. If we have written to your company before you wrote to us, the section "If we write to you first" below says what we hold and why.
4. Cookies and analytics.
This site sets no cookies. We use Google Analytics 4 to count which pages are read and where visitors arrive from. It runs in a mode where no analytics cookie is set and no identifier is stored on your device. For each page you open, Google receives standard measurement data, including the page address, the site that sent you here, your browser and device details, and your IP address; Google uses the IP address to estimate the town or region you are in and, by its own documentation, does not show it to us, so our reports show a location, never an IP address. We see counts, not people, and those reports give us no way to identify you. We run no advertising trackers and no session-recording tools. Google Ireland Limited and Google LLC process this data on our behalf, including in the United States, under the EU-US Data Privacy Framework (and its UK Extension, for our UK visitors). Google keeps the individual measurement pings we send for two months, then deletes them; the standard reports we read are based on aggregated data, which that limit does not affect. Our legal basis is legitimate interest: knowing whether anyone reads what we publish. If you would rather not be counted, use this switch: . You can also install Google's own opt-out add-on. Turning it off sets one local storage entry on your device (hs-analytics=off) so we know not to load Google's script; it holds no other information. If what we collect changes, we will update this page before it does, not after.
If we write to you first
Sometimes we write to a care provider about a public notice before they have written to us. When we do, this is what we hold and why.
What we hold. Your company's name, the address your company publishes on its own website for contact, your registration at Companies House, your CQC registration and the postcode areas you serve, and the public notice we wrote about. Where the published address carries a person's name, we hold that name only as part of the address.
Where it came from. Your own website, the CQC register, the Companies House register and the public notice on Find a Tender or Contracts Finder. We do not buy lists, guess addresses or use lookup services.
Why. Our legitimate interest in offering a free scored read of your evidence before a notice you may be bidding for closes. We write once, and at most once more while the notice is open, then stop.
How long. Twelve months after the last time we wrote, then it is deleted. If you tell us not to write again, we keep your address on a do-not-contact list for as long as we exist, so we cannot write again by mistake.
Your choices. Reply "no thanks" to any note and we will not write again. You can ask what we hold, ask for it to be deleted, or object to this use at any time: hello@heskethandson.com. The controller is Hesketh and Son AS, org. no. 938 355 908, Vitaminveien 26, 0483 Oslo, Norway.
Your rights
Under UK GDPR, you can ask to see the data we hold about you, ask us to correct or delete it, and object to how we use it. If you are in Norway or elsewhere in the EEA, the same rights apply to you under the GDPR as it applies there, and you can also raise a concern with Datatilsynet, the Norwegian data protection authority. If you are in the UK, you can raise a concern with the Information Commissioner's Office (ICO) at ico.org.uk.
We would rather you came to us first. Write to hello@heskethandson.com and we will sort it directly.
Contact us
Questions about this page, or about what we hold on you: hello@heskethandson.com. A named person reads and answers every message sent there.