Privacy Notice and GDPR Statement
What this site collects about you, which is nothing at all; what happens to a message if you send one; and the rights the UK GDPR gives you over both.
Last updated 30 July 2026
Who is responsible for your data
Gilt & Willow is the data controller for the personal data described in this notice, and can be reached at the address in section 10.
This notice is written to comply with the UK General Data Protection Regulation and the Data Protection Act 2018. Where a visitor is in the European Economic Area, the EU GDPR applies equivalently.
What this website collects, which is nothing
This website sets no cookies. It runs no analytics, no tag manager, no advertising pixel and no session recording. It embeds nothing from a third-party server: the typefaces are served from this site's own domain rather than from Google Fonts, so no request for them reaches anyone else.
There is no contact form, no newsletter sign-up and no account to create. No profile of you is built, and no behavioural tracking of any kind takes place.
Because no personal data is collected by the site itself, no consent banner is shown. A banner would be theatre: there is nothing to consent to.
- No cookies of any kind, including analytics and preference cookies
- No third-party scripts, fonts, images or embedded media
- No forms, accounts, or stored preferences
- No advertising, remarketing, or data sold or shared with brokers
What your hosting provider necessarily sees
Serving a web page requires a server to receive a request. The infrastructure hosting this site may therefore process your IP address and browser user-agent transiently, in server logs, for the purposes of delivering the page and defending against attack. That processing is technical and unavoidable rather than chosen, and it is not used to identify or profile you.
What happens if you write to us
If you send an enquiry, the personal data processed is whatever you choose to put in that message: typically your name, your email address, and whatever you say. Nothing further is gathered about you, and nothing is inferred and stored.
Correspondence is read by one person. It is not routed through a shared inbox, a support desk, or a customer-relationship system.
Why we are allowed to process it, in law
Where you have written to us, the lawful basis is legitimate interests under Article 6(1)(f): specifically, the mutual interest in replying to a message you chose to send. Where correspondence leads towards an agreement, the basis becomes steps taken at your request prior to entering a contract, under Article 6(1)(b).
Where a legal obligation applies — for example record-keeping, tax, or anti-money-laundering requirements — the basis is Article 6(1)(c).
No special category data is sought. Please do not send any.
How long it is kept
Correspondence that leads nowhere is deleted when it is evidently finished, and in any event within twelve months.
Where a relationship is entered into, records are kept for as long as it lasts and then for the period that financial and tax legislation requires them to be retained, after which they are deleted.
Nothing is retained indefinitely on the basis that it might one day be useful.
Where your data goes, and who else processes it
Your data is not sold, rented, shared for marketing, or passed to any data broker, advertiser or lead-generation service. There is no circumstance in which that would happen.
There is, however, one processor you should know about. The published contact address is a Gmail address, which means any message you send is processed and stored by Google on infrastructure that may sit outside the United Kingdom, under Google's own terms and its standard contractual clauses for international transfers. If you would prefer your correspondence not to pass through Google, say so in a first message containing nothing sensitive and an alternative can be arranged.
Beyond that, disclosure occurs only where compelled by law: an order of a court, a properly made request by a regulator, tax authority or law enforcement body, or an obligation under money-laundering and financial-crime legislation. In certain of those cases the law prohibits telling you that a disclosure has been made.
The rights you hold over your data
Under the UK GDPR you have the following rights. Exercising any of them is free, and a response is due within one month.
- Access — to be told whether your data is processed, and to receive a copy
- Rectification — to have inaccurate data corrected without undue delay
- Erasure — to have your data deleted, where no legal duty requires it be kept
- Restriction — to have processing paused while a dispute is resolved
- Objection — to object to processing carried out on the legitimate-interests basis
- Portability — to receive data you provided in a portable, machine-readable form
- Withdrawal — to withdraw consent at any time, where consent was the basis
Automated decision-making
No decision producing legal or similarly significant effects concerning you is made by automated means, and no profiling of you is carried out. The forecasting research described elsewhere on this site models a stock index. It does not model people, and it takes no input from anything you send.
How to raise something, and how to complain
To exercise any right above, or to ask how your data is handled, write to ishaan.narayana.uk@gmail.com.
If you are unsatisfied with the response, you have the right to complain to the Information Commissioner's Office, the UK supervisory authority, at ico.org.uk or on 0303 123 1113. You may complain to them without raising it here first, though it is usually quicker to do both.
Changes to this notice
This notice may be updated. The version published here is the one in force and carries the date it was last changed. Where a change materially affects how your data is used, anyone in current correspondence will be told directly rather than left to notice it.
Every claim above about this website's behaviour was verified against the running site rather than assumed. Two details are not asserted here because they are facts about the operator rather than the site: the controller's registered identity and postal address, and whether registration with the Information Commissioner's Office is required and in place. A controller processing personal data in the UK usually must register and pay the data-protection fee. Both should be confirmed and stated here before this notice is relied upon.
Back to Gilt & Willow