Privacy Policy
Last updated: 19 August 2026 · Effective: 19 August 2026
This policy explains what personal information Black Oak Consulting collects when you use this website, why it is collected, how long it is kept, and the choices you have. It is written to be read, not to be survived.
1. Who is responsible for your information
This site is operated by Black Oak Consulting, an assumed business name of Black Oak Design LLC, a web design, photography and 3D visualization studio based in Denver, North Carolina, United States. Preston Midkiff is the person responsible for how information from this site is handled — in data-protection terms, the data controller.
- Email: preston@blackoakconsulting.net
- Phone: 580-756-7507
- Postal address: PO Box 1, Iron Station, NC 28080
2. What information is collected
Information you give directly
If you use the contact form, or call or email, you provide: your name, email address, optionally your phone number, and whatever you write in your message. Nothing on this site asks for payment card details, government identifiers, or any special-category data — please don't send them.
Information collected automatically
Like effectively every website, the server hosting this site keeps standard access logs. These typically record your IP address, browser and device type, the pages requested, the referring page, and a timestamp. These logs are generated by the hosting provider for security and reliability, and are not used to build a profile of you.
Information that is not collected
As published, this site runs no analytics, no advertising pixels, no session recording, no social media trackers, and no third-party cookies. If that changes, this page and the cookie banner will be updated first, and non-essential tracking will only run after you opt in.
3. Why it is collected, and the legal basis
| Information | Purpose | Legal basis (UK/EU GDPR) |
|---|---|---|
| Name, email, phone, message | To read your enquiry and reply to it; to discuss and, if it goes ahead, deliver a project | Consent, and steps taken at your request prior to entering a contract (Art. 6(1)(a) and 6(1)(b)) |
| Server access logs | Keeping the site online, secure, and free of abuse | Legitimate interests — running a secure website (Art. 6(1)(f)) |
| Cookie preference | Remembering the choice you made in the cookie banner so you aren't asked again | Strictly necessary — it exists only to honor your own choice |
| Analytics (only if you opt in) | Understanding which pages are useful so the site can be improved | Consent (Art. 6(1)(a)) — withdrawable at any time |
Your details are never sold, rented, or shared for anyone else's marketing. You will not be added to a mailing list because you sent an enquiry.
4. Cookies and similar technologies
A cookie is a small file a site stores in your browser. This site uses local browser storage in one place only, and it is there because you asked for something:
| Name | Type | Purpose | Expires |
|---|---|---|---|
boc.consent.v1 |
Strictly necessary (browser localStorage) |
Stores the cookie choice you made, so the banner doesn't reappear on every visit | Until you clear your browser storage |
Nothing else is set unless you turn it on. The analytics and marketing categories in the banner are switched off by default and load no scripts while they are off. Strictly necessary storage does not require consent under the ePrivacy rules, because it only does the thing you asked for.
Changing your mind
Select “Cookie settings” in the footer of any page to reopen the banner and change or withdraw your choice. Withdrawing is as easy as giving consent, and takes effect immediately. You can also clear site data in your browser settings, which resets everything.
5. Third parties
These are the outside services this site currently relies on:
| Service | What it does | What it may receive |
|---|---|---|
| Hostinger (Hostinger International Ltd) | Serves the pages and images | IP address and request details, in standard server logs |
Fonts are served from this site, not from Google. The typefaces are stored on the same server as the rest of the page, so loading a page here sends no request to Google and no data about you reaches them. Hostinger, which hosts the site, is the only third party involved at all.
The contact form is handled on this site's own server, not by an outside form service. What you type goes straight into my email — it is not stored in, or processed by, any third-party platform.
Information may also be disclosed where the law requires it — for example in response to a valid legal request — or to establish or defend a legal claim.
6. How long information is kept
- Enquiries that don't become projects — kept up to 24 months in case you come back, then deleted.
- Client project records — kept for the length of the engagement and up to 7 years afterwards, to meet tax and accounting obligations.
- Server access logs — retained by the hosting provider on its own schedule, typically 30–90 days.
- Your cookie preference — stored in your own browser until you clear it.
You can ask for your enquiry to be deleted sooner at any time, and it will be.
7. Security
The site is served over HTTPS, so traffic between your browser and the server is encrypted. There is no database behind this site — enquiries are delivered straight to a business email account rather than stored here, which keeps the amount of information sitting around to a minimum. That said, no method of transmitting information over the internet is perfectly secure, and no absolute guarantee can honestly be given. Please don't send sensitive personal information through a web form or email.
8. Your rights over your information
Whatever jurisdiction you're in, you can ask to:
- Know what information is held about you, and get a copy of it;
- Correct anything inaccurate or incomplete;
- Delete it, where there's no overriding legal reason to keep it;
- Restrict or object to how it is used, including any processing based on legitimate interests;
- Withdraw consent at any time, without affecting anything done before you withdrew it;
- Receive it in a portable format, where that right applies;
- Not be discriminated against for exercising any of these rights.
Email preston@blackoakconsulting.net and you'll get a response within 30 days. Verification may be requested first — usually just replying from the email address the information is associated with — so that data isn't handed to the wrong person. Exercising these rights is free.
9. California residents (CCPA / CPRA)
Black Oak Consulting is a small business and does not currently meet the thresholds that make the California Consumer Privacy Act mandatory. The rights in Section 8 are honored for California residents regardless.
For the avoidance of doubt: in the twelve months preceding the date above, Black Oak Consulting has not sold and has not shared personal information for cross-context behavioral advertising, and does not do so now. The categories of personal information collected are identifiers (name, email, phone, IP address) and internet activity (pages requested), as set out in Section 2. No “Do Not Sell or Share My Personal Information” link is provided because there is nothing being sold or shared to opt out of. Should that ever change, this policy and the site will be updated first.
10. Visitors from the UK and EU
This is a United States business and information is processed in the US. If you contact Black Oak Consulting from the UK or EU, your information is transferred to the US. Where a transfer requires a safeguard, Standard Contractual Clauses or an equivalent mechanism is relied upon via the relevant service providers.
You have the right to lodge a complaint with your national supervisory authority — in the UK, the Information Commissioner's Office. Raising it directly first is welcome, and usually faster.
11. Children
This site is aimed at businesses and is not directed at children under 13. Information is not knowingly collected from children under 13. If you believe a child has provided information here, email preston@blackoakconsulting.net and it will be deleted promptly.
12. Do Not Track and Global Privacy Control
There is no consistent industry standard for responding to browser “Do Not Track” signals. Because this site sets no tracking cookies unless you opt in, the practical outcome is the same either way. A Global Privacy Control (GPC) signal is treated as a valid opt-out of any non-essential tracking.
13. Accessibility statement
This site was built to meet WCAG 2.2 Level AA: keyboard operation
throughout, visible focus indicators, text contrast of at least 4.5:1, text alternatives for
meaningful images, form labels and error messages wired to their fields, and full support for
prefers-reduced-motion. The before/after comparison is operable with arrow keys
as well as by dragging.
Accessibility work is never finished. If something on this site is difficult or impossible for you to use, email preston@blackoakconsulting.net or call 580-756-7507, and it will be fixed — and the information you were after will be provided another way in the meantime.
14. Changes to this policy
If this policy changes, the “last updated” date at the top changes with it. Material changes — anything that meaningfully affects how your information is handled — will be flagged on the site, and fresh consent will be requested where the law requires it. Previous versions are available on request.
15. Contact
Questions about this policy, or about anything held about you:
- Email: preston@blackoakconsulting.net
- Phone: 580-756-7507
- Post: PO Box 1, Iron Station, NC 28080