Last updated: 28 August 2026

This notice explains how personal information is handled on marcusdarc.com, a personal website for the music and writing of Marcus Darc. It is written for a simple site: a contact form, optional comments, and a security check from Cloudflare Turnstile. It is not legal advice.

Who we are

The data controller is Marcus Darc, a UK-based individual. You can write about privacy or any other enquiry at .

What we collect

We collect only what is needed to run this site and to reply to you:

• Contact form: first name, last name, email address, optional phone number, and optional message.
• Comments: name, comment text, and the page or work the comment relates to. Comments are moderated before they appear. Published comments may show a default avatar from Gravatar.
• Security checks: Cloudflare Turnstile (used on the contact and comment forms) and a hidden honeypot field help block automated spam. Turnstile may process your IP address, browser and device characteristics, and how you interact with the widget, solely to decide whether the submission is from a person rather than a bot.
• Hosting logs: this site is hosted on Cloudflare. Cloudflare may record technical information such as IP address, date and time, requested page, and browser type as part of providing the service and protecting it from abuse.

This site does not use first-party analytics, advertising pixels, or marketing trackers. We do not build advertising profiles, and we do not sell personal information.

Why we use it, and on what legal basis

Under the UK GDPR and the Data Protection Act 2018, and the EU GDPR where it applies to visitors in the European Economic Area, we rely on the following:

• Responding to messages you send through the contact form or by email — legitimate interests in corresponding with people who contact us, and, where relevant, steps at your request before entering a contract (for example, an enquiry about work or a purchase).
• Publishing moderated comments — your consent when you submit a comment, and legitimate interests in hosting public discussion of the work on this site.
• Keeping the site secure — legitimate interests in preventing spam, fraud, and abuse, including Turnstile, the honeypot, and Cloudflare’s hosting protections.

You can object to processing based on legitimate interests, or withdraw consent for a comment submission you no longer want published, by emailing the address below.

Who we share it with

Form submissions are sent to FormCapture (forms.behindthedot.com), which stores and delivers the message so it can be read and answered. Cloudflare provides hosting and Turnstile; see Cloudflare’s privacy policy.

Some pages embed players or media from Bandcamp and YouTube. Loading those pages may send technical data (such as IP address) to those providers under their own policies. Comment avatars may be requested from Gravatar (Automattic).

Some of these organisations are based outside the United Kingdom and the EEA, including in the United States. Where personal data is transferred internationally, we rely on the safeguards those providers offer for that transfer (for example, standard contractual clauses) as described in their own notices.

Cookies

This site does not set first-party cookies for analytics or advertising. Cloudflare and Turnstile may set cookies or similar storage that are needed to operate the site and the security check. Bandcamp and YouTube embeds may set their own cookies if you visit a page that includes them. Those third-party cookies are controlled by the relevant provider.

How long we keep it

• Contact messages are kept for as long as needed to deal with the enquiry, and for a reasonable period afterwards in case of follow-up.
• Published comments remain on the site until they are removed.
• Turnstile tokens are short-lived and used only to validate a submission.
• Hosting and security logs are retained according to Cloudflare’s practices.

Your rights

How you can exercise rights depends on where you live. In every case you can email and we will respond as required by the law that applies to you.

United Kingdom and European Economic Area

If UK GDPR or EU GDPR applies, you may have the right to access your personal data, correct it, erase it, restrict or object to certain processing, and receive a copy in a portable format. Where processing is based on consent, you may withdraw that consent. These rights are not always absolute.

You also have the right to complain to a supervisory authority. In the UK that is the Information Commissioner’s Office. In the EEA you may contact your local data protection authority.

California

We do not sell personal information, and we do not share it for cross-context behavioural advertising, as those terms are used in the California Consumer Privacy Act (CCPA) as amended by the CPRA. California residents may request to know, delete, or correct personal information we hold, using the contact address below. We will not discriminate against you for exercising these rights.

Other countries

Privacy laws in other places — including Canada’s PIPEDA and Australia’s Privacy Act — often include rights to access and correct personal information, and to complain to a local regulator. If one of those laws applies to you, write to the same address and we will handle your request in line with the applicable rules.

Children

This site is not directed at children. We do not knowingly collect personal information from anyone under 13, or under 16 where EU GDPR sets that age. If you believe a child has submitted information, please contact us so it can be deleted.

Security

The site is served over HTTPS. Forms use Turnstile and a honeypot to reduce spam. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

Changes to this notice

If this notice changes in a material way, the updated version will be posted on this page with a new “last updated” date.

How to contact us

For privacy requests or any other question: .