01 What Data We Collect
Depending on how you interact with us, we may collect:
- Contact details — name, email address, phone number, business name and address, when you enquire about or engage our services.
- Project information — content, images, logins, and access details you provide for the purpose of building, hosting, or maintaining your website.
- Payment information — billing details and payment history, processed via third-party payment providers (we do not store full card details ourselves).
- Website visitor data — if you visit our website, we may collect IP address, browser type, device information, and pages visited, via cookies or analytics tools (see Section 6).
- Communications — records of emails, calls, or messages exchanged with us.
02 How We Use Your Data
We use personal data for the following purposes:
| Purpose | Legal Basis |
|---|---|
| Providing and managing website design, build, and hosting services | Performance of a contract |
| Invoicing and payment processing | Performance of a contract / Legal obligation |
| Responding to enquiries | Legitimate interests (responding to prospective clients) |
| Sending service-related updates (e.g. hosting renewal, downtime notices) | Performance of a contract |
| Sending marketing communications (only where you've opted in) | Consent |
| Improving our website and services | Legitimate interests |
| Complying with legal and tax obligations | Legal obligation |
We do not use your data for any purpose incompatible with the reasons it was collected without notifying you first.
03 Legal Basis for Processing
We only process personal data where we have a valid legal basis to do so under UK GDPR, namely:
- Contract — processing necessary to deliver the services you've engaged us for.
- Consent — for marketing communications, which you can withdraw at any time.
- Legal obligation — for example, retaining invoices for tax purposes.
- Legitimate interests — for example, responding to enquiries or maintaining site security, balanced against your rights and freedoms.
04 Sharing Your Data
We do not sell your personal data. We may share it with:
- Hosting and infrastructure providers (e.g. Hostinger, or similar) — to host and deliver your website.
- Payment processors — to process payments securely.
- Email and communication tools (e.g. Gmail/Google Workspace) — to correspond with you.
- Professional advisors (e.g. accountant) — where necessary for legal or tax compliance.
- Law enforcement or regulators — where required by law.
Any third party we share data with is required to handle it securely and in line with UK data protection law. Where a provider is based outside the UK, we ensure appropriate safeguards are in place (such as Standard Contractual Clauses) before any data transfer.
05 International Data Transfers
Some third-party providers we use (such as hosting or cloud services) may store or process data outside the UK. Where this happens, we take reasonable steps to ensure your data is protected to a standard equivalent to UK law, including relying on providers certified under recognised data protection frameworks or Standard Contractual Clauses.
06 Cookies & Website Analytics
Our website may use cookies or similar tracking technologies to ensure the website functions correctly. You can control or disable cookies through your browser settings; disabling essential cookies may affect how the website functions.
We do not currently use Google Analytics or any other third-party tracking or analytics tool, and the website does not set advertising or tracking cookies. If that changes, this policy will be updated to name the tool in use and explain how to opt out.
07 Data Retention
We retain personal data only as long as necessary:
- Client project and contract data — retained for the duration of our working relationship and for 6 years afterwards, in line with UK tax and contract limitation requirements.
- Enquiry data (from people who don't become clients) — retained for up to 12 months, then deleted.
- Marketing consent records — retained until you withdraw consent.
After these periods, data is securely deleted or anonymised.
08 Your Rights
Under UK GDPR, you have the right to:
- Access the personal data we hold about you.
- Rectify inaccurate or incomplete data.
- Erase your data ("right to be forgotten"), where applicable.
- Restrict or object to certain processing.
- Data portability — receive your data in a portable format.
- Withdraw consent at any time, where processing is based on consent.
- Complain to the Information Commissioner's Office (ICO) if you believe your data has been mishandled.
To exercise any of these rights, contact us at contact@sandpapersites.co.uk. We will respond within one month, as required by law.
09 Data Security
We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or misuse, including secure hosting, access controls, and limiting data access to what's necessary to deliver our services. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.
10 Children's Data
Our services are intended for business clients and are not directed at children. We do not knowingly collect personal data from anyone under 18.
11 Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The "Last updated" date at the top will reflect the most recent revision. Significant changes will be communicated to active clients directly where appropriate.
12 Contact Us
If you have questions about this Privacy Policy or how we handle your data, contact:
Tom Robinson, trading as Sandpaper Sites
Email: contact@sandpapersites.co.uk
Phone: 07706 261 786