Legal

Privacy Policy

Last updated: October 2026

1. Who I am

Karp Communications is a sole trader consultancy operated by Tamir Karp. I provide digital partnership services to schools and educational organisations in the UK. I also run ClearSite, the tool I built to check school websites against the information schools are required to publish. I also offer a free guide, and website setup, to independent creatives, under the working name Shopfront.

For the purposes of UK GDPR and the Data Protection Act 2018, I am the data controller for personal data collected through this website and for ClearSite reports. For personal data processed on behalf of a school client, I act as a data processor under a separate Data Processing Agreement.

Contact: info@karpcommunications.com

2. What data I collect

Through this website:

• Name and email address, if you book a Digital Audit or contact me via the website
• School name and role, if you provide them
• If you order or ask about a ClearSite report: your name, role, school, school website, work email address, your phone number if you give it, and your message
• If you ask for the free guide: your email address, your first name if you give it, and a record of the consent you gave, including your agreement to join my mailing list
• Technical data such as your IP address, which my hosting provider may log (see section 6 below)

Through cold email outreach:

• Name, professional email address, job title, and school name
• This data is sourced from the Department for Education's Get Information About Schools (GIAS) register and from contact details schools publish on their own websites, both publicly available

Through ClearSite reports:

• To prepare a report, ClearSite reads the public pages and documents on your school's website
• These can include the names and work contact details of staff and governors, for example the person who leads careers. Where a requirement asks for them, they may appear in your report
• ClearSite only reads what is publicly visible. It does not log in to your website or any school system

Through client engagements:

• Contact details of school staff I work with directly
• Any personal data contained in content I am asked to manage (social media, website, video)
• This is governed by a separate Data Processing Agreement signed at onboarding

I do not collect data from children. I do not process special category data unless specifically required by a client engagement and covered by the DPA.

3. Why I process your data

Lawful bases under UK GDPR Article 6(1):

• Legitimate interests (Article 6(1)(f)): B2B cold email outreach to named individuals at their professional work address, where the communication is relevant to their professional role. Under the Privacy and Electronic Communications Regulations (PECR), marketing emails to work addresses at organisations do not need prior consent, but every email must say who it is from and give you a way to opt out.
• Legitimate interests (Article 6(1)(f)): reading the public content of a school's website, including any staff details it contains, to prepare a ClearSite report the school has asked for.
• Contract (Article 6(1)(b)): processing necessary to deliver services under a client engagement, or to prepare and deliver a ClearSite report you order, including confirming the price before you order.
• Consent (Article 6(1)(a)): where you voluntarily provide your details through the website contact form or a Calendly booking. Asking for the free guide is also consent: the guide comes with a place on my mailing list, and the form says so before you submit it. I use your email address to send you the guide, and then to send you tips on getting online and news of my services, including paid ones. You can withdraw this consent at any time, by replying "stop" to any of my emails or by emailing me, and I will stop emailing you.
• Legal obligation (Article 6(1)(c)): keeping invoices and financial records.

4. Who I share data with

I do not sell your data to anyone. I may share data with the following categories of third-party service provider, solely to deliver my services:

• Email platform provider (for sending and managing communications)
• CRM provider (for managing contacts and client relationships)
• Calendly (for scheduling bookings)
• GitHub (website hosting)
• Cloudflare (processing of website form submissions) and Resend (delivering those submissions to my inbox)
• Anthropic and OpenAI (AI services that read the content of a school's public website to help prepare ClearSite reports). They receive the website content, not the contact details you give me, and do not use it to train their models
• Neon (the database that holds ClearSite scan data, hosted in London) and Cloudflare (backups of that database, stored in the EU)

All third-party providers are contractually required to handle your data in accordance with UK GDPR. Anthropic, OpenAI, GitHub, Cloudflare and Resend are based in the United States, although Resend delivers website form messages from its EU region. I do not transfer personal data outside the UK or EEA unless the provider has appropriate safeguards in place (such as UK International Data Transfer Agreements or adequacy decisions).

5. How long I keep your data

• Website enquiries, including ClearSite enquiries that don't lead to an order: 12 months from last contact, then deleted
• Free guide requests and my mailing list: your email address and consent record are kept until you unsubscribe or ask me to delete them. After that, only your email address is kept, on my suppression list, so I do not email you again. Cloudflare holds only a scrambled (hashed) copy of the address for 24 hours, to stop the same guide being sent twice
• ClearSite orders, reports and invoices: 6 years, as required for tax records
• ClearSite scan data (the copies of a school's public pages and documents used to prepare a report): 12 months after the report is delivered, so I can answer questions or correct the report, then deleted
• Cold outreach contacts: removed immediately on unsubscribe request; otherwise reviewed and purged every 12 months
• Client engagement data: retained for the duration of the engagement plus 12 months, unless a longer period is required for legal or tax purposes
• Suppression list: email addresses of anyone who has opted out are retained indefinitely to ensure I do not contact them again

6. Cookies

This website does not use analytics or advertising cookies and has no cookie banner.

If you book a Digital Audit, the Calendly embed may set its own cookies, and the “Meet Tamir” video from Loom may do the same. Their privacy policies apply to data collected through their platforms.

7. Your rights

Under UK GDPR, you have the right to:

• Access: request a copy of the personal data I hold about you
• Rectification: ask me to correct inaccurate data
• Erasure: ask me to delete your data (subject to legal retention requirements)
• Restriction: ask me to limit how I use your data
• Objection: object to processing based on legitimate interests, including cold email outreach
• Portability: request your data in a machine-readable format

To exercise any of these rights, email info@karpcommunications.com. I will respond within one month.

To opt out of cold email outreach, reply "unsubscribe" to any email. You will be added to the suppression list immediately and will not be contacted again.

8. Complaints

If you are unhappy with how I have handled your data, please contact me first so I can try to resolve the issue. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO):

Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
ico.org.uk/make-a-complaint

9. Changes to this policy

I may update this policy from time to time. Changes will be posted on this page with the updated date. I will not reduce your rights under this policy without notifying you.