ACHMED ESSER BID WRITING · MANAGEMENT · DIRECTION BID WRITING · MANAGEMENT · DIRECTION
Contact
10Observatory
10.0Looking Glass10.1Bidcraft Century10.2Bidder’s Underworld10.3World Clock10.4Market Observatory10.5Evidence10.6Strategy Field10.7Champion10.8Measured10.9Roles10.10Field Studies10.11Open Data
11Workstations 12Writer

PRIVACY · THE DATA SHADOW

A small footprint, kept visible.

Choose an action and see which data objects move, where they stop and which lawful purpose is intended. The instrument observes no visitor.

Effective 6 August 2026 Editorial review 6 August 2026 Statement version 2026.08.06 Official-source watch Official routes reached
01Collect the minimum02Separate messages from analytics03No sale or advertising profile04Make complaints and rights usable

THE FOOTPRINT OBSERVATORY · SELECT AN ACTION

Every action casts a different data shadow.

The moving objects show this published data-flow map. They do not inspect the action you are actually taking.

SELECTED STATE DELIVERY + SECURITY Deterministic · no visitor score
01browser request02Namecheap shared host03requested page04host security boundary
A request reaches the shared web host.

Ordinary request information may be processed by the current Namecheap shared host to serve and protect the site. Cloudflare page measurement remains off unless the visitor explicitly allows it.

What this permits or explains
Deliver a requested route and defend the service.
Where the boundary remains
No enquiry profile is built from an ordinary visit.

THE SITE IN PRACTICE · IMPLEMENTATION TRACE

Five boundaries keep one visit from becoming a profile.

The site separates browser-local preferences, infrastructure security, aggregate measurement, research outputs and direct correspondence.

01 · Browser-local

Motion + analytics choice + workstation state

Stored on the visitor’s browser and clearable there.

02 · Security

Request logs + pseudonymous rate-limit file

One-hour active window; host temporary-file lifecycle governs underlying deletion.

03 · Aggregate measurement

Explicitly allowed Cloudflare measurement

No name, email or message text is sent as an analytics event.

04 · Direct correspondence

Enquiry fields

Kept only for the purpose and period explained in the operative notice below.

05 · Research

Aggregate role and procurement evidence

Not used for individual sales or candidate scoring.

This rendered route currently carries 1,930 visible words in the Living Sitemap catalogue. Shared navigation and footer text are excluded from that measure.

EVIDENCE-LED DEVELOPMENT · OPEN THE PERIOD

Privacy moved from files to flows.

The UK framework developed as records became networked, searchable and capable of moving between organisations at scale.

1984

Computerised records enter statute

The first UK Data Protection Act created a statutory regime for automatically processed personal data.

Data Protection Act 1984 ↗
1998

Principles widen

The 1998 Act replaced the earlier regime and carried data-protection principles into a broader processing environment.

Data Protection Act 1998 ↗
2018

Rights and accountability deepen

The UK GDPR and Data Protection Act 2018 established the modern transparency, lawful-basis, rights and accountability framework.

Data Protection Act 2018 ↗
2025—26

Use and access are amended

The Data (Use and Access) Act amended, rather than replaced, the UK GDPR, DPA 2018 and PECR. The ICO says all its data-protection provisions were in force by 19 June 2026.

ICO · DUAA overview ↗

The timeline explains development; it does not imply that one date alone determines the law, guidance or duty applicable to a particular situation.

AUTHORITATIVE SOURCE WATCH · WEEKLY

Official routes reached

The monitor reached every selected authority. Reachability is not a legal conclusion.

LAST ROUTE CHECK 4/4 7 September 2026 at 21:50
01 · official route reachedUK GDPR200 ↗02 · official route reachedData Protection Act 2018200 ↗03 · official route reachedICO · Data (Use and Access) Act overview200 ↗04 · official route reachedICO · Data protection complaints200 ↗

This monitor reports source-route observations. It does not certify that the law is unchanged, that the interpretation is complete or that the site is compliant in every circumstance. A confirmed source variation creates an editorial review task; it never changes the operative statement automatically.

OPERATIVE STATEMENT · VERSION 2026.08.06

The stable wording beneath the moving instrument.

Operative privacy notice · reviewed against the Data (Use and Access) Act position in force by 19 June 2026. The living sections above explain and monitor; this versioned section states the site’s intended operating position.

01

Controller and contact

Achmed Esser is the controller for personal information received through this personal site and its initial enquiry route. Direct electronic contact: contact@achmedesser.com. Postal correspondence: Achmed Esser, care of Bid Champions Ltd, Charter Buildings, 9 Ashton Lane, Sale, Manchester, Greater Manchester, United Kingdom, M33 6WT. If a later engagement identifies Bid Champions Ltd or another entity as a contracting party, that entity’s data-protection role and any different notice are identified separately.

Privacy-rights requests and data-protection complaints can use the Third Chair contact route. No statutory phrase is required; beginning the message with “data rights” or “data protection complaint” simply helps it reach the correct workflow.

02

Data received

The enquiry form receives the name, email address, optional organisation, optional decision deadline and message supplied by the visitor. A short allowlisted campaign and content label may travel with an enquiry so its aggregate source can be understood. The server may process ordinary request/security logs. For form abuse prevention, a pseudonymous SHA-256 digest of the source address names a temporary rate-limit file containing submission timestamps.

The site does not ask visitors to create an account and does not sell personal information. Do not include special-category information, confidential bid material or identity documents in an initial enquiry.

03

Aggregate campaign and media events

Cloudflare Web Analytics is configured for aggregate page-use and performance measurement, but its external beacon is not requested until a visitor chooses “Allow anonymous measurement”. The choice is retained in ae-analytics-choice-v1 and can be reviewed from the footer or Cookies room. Global Privacy Control or Do Not Track keeps measurement off. Cloudflare Zaraz is a separate optional service; the Web Analytics token does not enable it.

If Zaraz is separately present and measurement is allowed, The Bidder may count a bounded landing source; selected archive, edition and proof-route opens; Reel play, 25%, 50%, 75% and completion milestones; sound being turned on; and the start or submission of the contact form. These events do not include the name, email address, message text, video seek history or form-field contents, and are not used to build an advertising profile or individual sales score. Interactions occurring before permission are not queued for later transmission.

04

Roles Observatory research boundary

The Roles Observatory analyses permitted advertised-role feeds and official labour-market statistics. Direct email addresses, telephone numbers and personal-profile references are removed before research processing; full advert descriptions are not republished or retained permanently by default.

The public output is aggregate evidence, not candidate profiling, recruitment, applicant ranking or an employment decision. Source-specific rights, retention and deletion duties are recorded in the observatory method register.

05

Purposes and lawful bases

Information needed to answer an individual’s request or provide a requested quotation may be processed because it is necessary for steps requested before a possible contract. Security, proportionate business correspondence and aggregate service improvement may rely on legitimate interests after considering purpose, necessity and impact. Legal obligations may apply to particular records. Consent is requested before non-essential storage or tracking where consent is required.

A lawful basis is applied to the actual purpose; including an activity in this notice does not make a basis valid by itself. If a purpose changes materially, the basis and notice must be reassessed.

06

Retention and recipients

Initial enquiries are retained only while needed to understand and answer the conversation, consider conflicts, establish an engagement, meet a legal duty or deal with a credible dispute. Records that are no longer needed for those purposes should be deleted or restricted. If an engagement begins, a separate contractual, professional or legal retention period may apply.

For abuse prevention, timestamps older than one hour cease to count against the form limit. That active window is not a claim that the pseudonymous temporary file itself is deleted after exactly one hour; file and host-log deletion follow the hosting provider’s retention lifecycle. Namecheap shared hosting receives the form and domain-mailbox data needed to serve and deliver the enquiry. The handler validates the supplied fields, adds a UTC submission time and hands a plain-text message to the host’s PHP mail facility; it writes no enquiry database. Any configured mailbox forwarding, client synchronisation, filtering or backup follows the actual account and provider settings. Event-level analytics are not copied into research editions or joined to enquiry messages. Personal data is not sold.

07

International processing and security

Current network evidence places the shared web and domain-mail host in Namecheap’s UK network. That is not a claim that every provider support, backup or account operation is UK-only. Optional analytics providers, mailbox routes or other infrastructure may process information outside the United Kingdom under their service terms and the transfer mechanism applicable to that processing. A person may ask for further information about an applicable transfer and a copy or description of the relevant safeguard where the law provides it.

Access is limited to the purpose and system concerned. No internet transmission is risk-free, so confidential procurement material should use a separately agreed secure route.

08

Rights and complaints

Depending on the circumstances, a person may have rights of access, correction, erasure, restriction, objection or portability. A request can be verbal or written; the dedicated Data Rights room explains the practical route.

A data-protection complaint made through the electronic contact route will be acknowledged within 30 days. Without undue delay, appropriate steps and enquiries will be taken, the person will be kept informed, and the outcome will be communicated. If the outcome remains unsatisfactory, the person may complain to the Information Commissioner’s Office.