Privacy policy

1. Who I am

Worcester Websites is a website design, development and management service based in Worcester, UK. In this policy, "I", "me" and "my" mean Worcester Websites.

Under UK data protection law (the UK GDPR and the Data Protection Act 2018), I'm the controller of the personal data described here: I decide how and why it's used.

For any privacy question or request, email [email protected].

2. What I collect

When you visit this website

This site has no cookies, no analytics, no tracking pixels and no forms. I don't collect anything about you as you browse.

Like every website, though, your browser has to ask a server for each page. That request includes technical details such as your IP address, browser type, the page you asked for and the time. These details are handled by my hosting provider and Google Fonts (see section 4) so the site can load and stay secure. I don't use them to identify you.

When you email me

If you get in touch, I receive your email address, your name if you include it, and whatever you write in your message, such as details about your business or your current website.

If we work together

For client projects I also keep what's needed to do the work and get paid: contact details, project notes, content you send me for your site, and invoices.

3. How I use it, and why I'm allowed to

UK law says I need a lawful reason ("lawful basis") for each way I use personal data. Here they are:

I won't add you to a mailing list or send you marketing.

4. Who else is involved

A few services help this website and my business run. Each one only gets what it needs:

• Vercel Inc. hosts this website. Its servers receive the technical request data described above in order to deliver pages and protect the site. See Vercel's privacy policy.
• Google Fonts supplies the fonts on this site. Your browser downloads them from Google's servers, which means Google receives your IP address when a page loads. See Google's privacy policy.
• My email provider stores the emails you send me.

Some of these providers are based in, or process data in, the United States. When data leaves the UK, it's protected by the safeguards UK law requires, such as the UK–US data bridge or approved contract clauses.

I don't sell your personal data, and I don't share it with anyone for their own marketing.

5. How long I keep it

• Enquiries that don't lead to a project: deleted within 12 months of our last contact.
• Client records: kept while we're working together, then invoices and related records for up to six years, as UK business and tax rules require.
• Technical request data: kept by the hosting provider for a short time under its own policy.

6. Your rights

Under UK data protection law you have the right to:

• access the personal data I hold about you;
• have it corrected if it's wrong or incomplete;
• have it deleted;
• restrict how I use it;
• object to me using it on the basis of legitimate interests;
• get a copy in a portable format.

Some rights have limits. For example, I may need to keep invoices even if you ask me to delete them. To use any of these rights, email [email protected]. It's free, and I'll reply within one month.

7. Complaints

If you're unhappy with how I've handled your data, please tell me first so I can put it right. You also have the right to complain to the UK regulator, the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint or 0303 123 1113.

8. Links to other websites

This site links to websites I've built for clients. Those sites are run by their owners and have their own privacy policies. This policy doesn't cover them.

9. Changes to this policy

If anything changes, for example if I add a contact form or analytics, I'll update this page and the date at the top.