Effective Date: January 2, 2026
Data Controller
Steve Harvey
3 Mayfield Avenue
Kessingland, UK NR33 7QT
This is the privacy notice for oast.com.
It explains what personal data (PD) and non-personal data (NPD) I might collect from you, how that happens, how it's kept safe, who it might be shared with, and how you can access, change or limit it. It also sets out the legal rights you have over your own data. Any capitalised term not defined here carries the meaning given elsewhere on this site.
Depending on the legal basis I rely on to process it, you may hold some or all of the following rights over your personal data under the General Data Protection Regulation (GDPR) and other applicable law:
To be informed
You're entitled to know what personal data I collect about you and how it's processed.
Of access
You can ask for confirmation that your data is being processed, and get access to it.
To rectification
You can have inaccurate or incomplete data corrected.
To erasure
Also known as the right to be forgotten — you can ask for your data to be deleted where there's
no compelling reason for me to keep processing it.
To restrict processing
You can ask me to "block" or restrict processing of your data. Where that applies,
I can still store the data but not process it further.
To data portability
You can request the data you've given me, for your own use elsewhere. I'll provide it
within 30 days of a request — get in touch using the details at the top of this notice.
To object
You can object to my processing your data where it's based on:
Automated decision-making and profiling
You have the right not to be subject to a decision based solely on
automated processing — including profiling — that produces legal effects or similarly significantly affects you.
Complaints
If you believe your data hasn't been handled in line with the GDPR, you can complain to the
relevant supervisory authority. If they don't deal with your complaint properly, you may also have the right to a judicial
remedy.
For more on your rights under the law, see the ICO's guide to the GDPR.
Non-personal data (NPD) is data that can't be tied back to an identifiable person.
Personal data (PD) is any information relating to an identified or identifiable person — someone who can be identified directly or indirectly, whether by name, ID number, location data, an online identifier, or by one or more factors specific to their physical, physiological, genetic, mental, economic, cultural or social identity. It covers similar ground to "Personally Identifiable Information" (PII), but is broader.
A Visitor simply browses the site. A Member has registered to use a service or buy something. User covers either.
Information I Collect
Use of Cookies
How Your
Information Is Used
Retaining and Destroying Your PD
Updating Your
PD
Revoking Your Consent
Protecting the Privacy of Third
Parties
Do Not Track
Links to Other Sites
Children's Privacy
Email Policy
Security
Policy
Use of Your Card Details
Transferring Data from the
European Union
Changes to This Notice
How much information you share with me when using this site is largely up to you.
Legal basis for processing
Where you submit data via a signup form, my legal basis for collecting and
processing it is your consent.
If you'd rather not provide it
Without enough data from you, I may not be able to offer everything the
site provides — though plenty of it can still be used without handing over any PD.
I collect data in these ways:
Automatically
Your browser or device sends some information automatically — the site you arrived from (if
any), the one you head to next, your IP address (or your proxy's), your ISP's name, browser and device type, operating system,
and how you browse the site. I use this to spot trends and improve the site.
While browsing
If you accept cookies while using the site, some may carry PD.
On registration
Signing up as a user or member means giving me your name, email address and anything else
the form asks for.
On purchase
Buying something means giving me your name, email, address, and payment details, plus
anything else requested at checkout.
This site uses cookies — small files or pieces of data saved to your device when you visit certain sites. They can carry text
readable by the server that issued them, generally a string of characters that identifies your device, and sometimes other
information too.
By accepting cookies here, you're giving me — and any third parties I work with — permission to place,
store and access the cookies described below.
Cookies may also be used to:
Most browsers let you turn cookies off, though doing so may stop parts of the site working properly.
Web beacons
I may use web beacons to gather general information about how the site, promotions or
newsletters are used — for instance, tracking how many people open an email, and understanding visitor behaviour more
broadly.
Google Ad and Content Network
Third-party vendors, Google included, use cookies to serve ads based on past
visits to this site. Google's DoubleClick cookie lets it and its partners show ads based on visits here and elsewhere. You can
opt out of DoubleClick's interest-based advertising at optout.aboutads.info, or, in Europe, at youronlinechoices.eu.
Google Analytics
This site uses Google Analytics to understand how it's used — things like age, gender,
interests, visit frequency, and pages viewed. I use this to analyse traffic, remarket, and improve marketing and the site
generally. Analytics advertising features are enabled here, including remarketing and demographic/interest reporting. Google
Analytics only collects the IP address assigned to you on the day you visit, and I don't combine that with your PD. A permanent
cookie is set so Google can recognise you on a return visit, but only Google can use it. More detail on how Google handles this
data is at google.com/policies/privacy/partners.
You can opt out of Google Analytics at tools.google.com/dlpage/gaoptout.
Google Remarketing
Wondering why you're seeing ads for something you looked at?
This site
uses a remarketing service run by Google and partner networks, which can show you ads for things you've previously viewed
here, on other sites you visit later. It works by reading a cookie already in your browser, or setting one when you first visit
a site using remarketing.
You can opt out via Google's ad settings or the Network
Advertising Initiative's opt-out page.
Facebook Remarketing
Facebook and other third parties may use cookies, web beacons and similar
technologies to gather information from this site and elsewhere, for measurement and ad targeting. A Facebook Custom Audience
Pixel activates when you land on a page and sets a cookie, which may later show you Facebook ads related to your visit here.
Lookalike audience targeting lets me reach people similar to past visitors or customers. To opt out of Facebook's use of your
data for ad targeting, see Facebook's help page.
Information you provide may be used to:
Communications and email
I'll use the email address given at registration to contact you about the site,
and may send promotional material about the site, my own offers, or those of affiliates, unless you've opted out. You can
change your preferences at any time via your account, using the details at the top of this notice, or through the Contact page.
Sharing with affiliates and other third parties
I don't sell or rent your PD to third parties for
marketing. I may, however, use aggregated non-personal data (NPD) at my discretion, including selling it on — this would never
include your PD. I may also pass your PD to third-party service providers working on my behalf, which could include payment
processors, web analytics companies, advertising networks, call centres, data management services, help desks, accountants,
law firms, auditors, shopping cart or email providers, and delivery companies.
Sharing with Facebook and Google for marketing
Your PD may be shared with Facebook and/or Google for
similar-audience (lookalike) marketing — helping me find new audiences with interests like yours, and improve my marketing as
a result. It's only shared with these two for this purpose. Using this site and agreeing to this notice means you consent to
that use.
Legally required disclosures
I may need to disclose your PD where required by subpoena, law, or other
legal process; to assist law enforcement or government agencies; to investigate breaches of, or enforce, my terms; to defend
against legal claims, including from you or other users; or to protect the legal rights, property or safety of the business,
its users, staff or affiliates.
If the business changes hands
If this business is sold or merges with another that takes over running the
site, I retain the right to transfer your PD to them, under the terms of this notice or any update to it they make.
The same applies if the business becomes insolvent and some or all of its assets are sold on.
I keep information collected from you — PD included — only as long as needed for legal, business or tax reasons, whether stored electronically, on paper, or both. Once it's no longer needed, I'll destroy, delete or erase it.
Where the site offers a way to update your own PD, you're welcome to use it. Otherwise, contact me using the details above and I'll help directly — though I may need to retain some data to meet legal obligations or enforce agreements.
You can withdraw consent for me to use your PD at any time. Doing so won't undo disclosures already permitted by law, including: (i) disclosures to affiliates and business partners; (ii) disclosures to third-party providers handling things like payment processing, IT systems or shipping; (iii) disclosures needed to fulfil your own requests; (iv) disclosures to government or law enforcement bodies, or otherwise required by law; (v) disclosures already made before you withdrew consent; or (vi) disclosures tied to a promotion or third-party offer you've chosen to take part in. To withdraw consent, use the contact details above.
Do Not Track
Some browsers let you signal that you don't want your movements on this site
tracked. This site doesn't currently respond to that signal. You can adjust tracking and other privacy settings via your
browser's own settings or manual.
This site may link out to others that aren't under my control and aren't covered by this notice. Those sites will usually have their own privacy notices. I take no responsibility for them, and any links are provided purely for convenience — visiting them is entirely at your own risk. Check their own privacy notices to see how they handle your PD.
This site isn't designed for anyone under 16, though I recognise a child under that age might still try to access it. I don't knowingly collect PD from children under 16. If you're a parent or guardian and believe your child is using the site, please get in touch — I may ask for proof of identity before removing any account information, to prevent malicious removal requests. If I become aware a child is using the site, their information will be deleted within a reasonable time. I don't verify user age and take on no liability for doing so.
You can opt out of further emails from me or my affiliates at any time. I won't sell, rent or trade your email address to any unaffiliated third party without your permission, except where the business itself is sold, transferred, or becomes insolvent.
This site is built using industry-standard security and authentication measures to protect your PD, and any third parties
providing services to me maintain their own technical and physical safeguards too. Card details submitted through the site are
encrypted in transit using standard secure technology. That said, no method of transmission or storage over the internet can
be guaranteed completely secure.
Please keep any password for this site to yourself, and log out when finished, especially
on a shared or public device.
Buying something via this site may require card details. These are handled by third-party billing services I don't directly control. I take commercially reasonable steps to work only with providers using industry-standard encryption, but you understand and agree I'm not responsible for any misuse of your card details by those third parties.
PD I collect may be stored, processed and transferred between countries where I operate, specifically the United States and Canada. The EU hasn't found either country to provide an adequate level of PD protection under Article 45 of the GDPR, so transfers rely instead on the derogations set out in Article 49. For EU users, and with your consent, PD may be transferred to the US or Canada to provide the goods, services or information you've requested, to perform a contract, or to satisfy a legitimate business interest that doesn't override your own rights and freedoms. Wherever your PD is transferred, processed or stored, reasonable steps will be taken to protect it, in line with this notice. Using this site means agreeing to the transfers described here.
This notice may be updated from time to time. Any changes will be posted here, so users and customers always know what's collected, used and disclosed. Where I plan to use or disclose PD differently from how it was described when collected, I'll give advance notice by email to the address on file. Otherwise, PD is used and disclosed in line with whichever version of this notice was in effect when it was collected. Continuing to use the site after any change means accepting that change.
Any questions about this notice can go to the contact details at the top, or via the contact page.