Privacy Notice

1. Who is responsible

East Anglia Webworks is operated by a sole trader based in Norfolk, England. The sole trader is responsible as the controller for deciding how personal information received by the business is used. For privacy matters, contact [email protected].

This notice is prepared with reference to the UK GDPR, the Data Protection Act 2018, and the changes introduced by the Data (Use and Access) Act 2025. It describes this website and its enquiry service. Personal information processed on behalf of a client as part of a commissioned website or hosting service would be covered by the relevant contract and data processing arrangements.

2. Your information & project brief

The form asks for your name and email address. Your message, business name, telephone number, existing website, guided project choices and support or timing preferences are optional. This information comes directly from what you enter. We do not ask for payment details or special category information such as health information.

Draft answers stay in the page’s temporary memory while you complete it. They are not saved in a website database, a cookie or browser local storage. A full page reload or closing the page discards the website’s in-memory draft; your browser may separately remember autofill information using its own settings.

“Save a copy of my brief” creates a text file on your device. It does not email the business or upload the file. You control where the file is kept and whether to share it. Delete it from your device when you no longer need it.

Choosing “Send Enquiry” sends your contact details, project answers and any optional message through the website server’s mail system to [email protected]. The form reports an error if the server cannot accept the email. Required fields allow us to respond; other details help us prepare for the conversation. If you omit those required fields, the form cannot send an enquiry.

Please avoid including passwords, confidential client records, payment card details or information about another person that you do not have authority to share.

3. Purposes & lawful bases

The enquiry service is intended for responding to your request, discussing suitable services and preparing a quotation. The appropriate lawful basis depends on the purpose and who the potential contract is with:

Requested steps towards a contract — UK GDPR Article 6(1)(b): necessary information for a quote or service requested by an individual who would personally be the contracting customer, including a sole trader.
Legitimate interests — Article 6(1)(f): responding to general queries or a representative of a business, maintaining relevant correspondence, and proportionate measures to keep the website secure. The interests are handling genuine enquiries and protecting the service, balanced against your rights.
Legal obligation — Article 6(1)(c): where received information must be retained or disclosed to meet a specific legal duty, such as relevant tax record requirements or responding to data rights requests.

We do not treat sending an enquiry as consent to a marketing mailing list. The site has no newsletter registration or advertising audience uploads. Any future optional marketing or tracking would need its own clear information and the appropriate permission.

4. Traffic, security & tracking

Loading a page sends a technical request to the server. A request can include a network address, requested URL, time, browser or device information and referrer information. Hosting logs can record requested paths, response status and errors. These are technical records, not an installed visitor analytics service.

The website currently has no advertising pixels, visitor analytics, session recordings or cross-site tracking scripts. Its images and fonts are served with the website. The cookies and traffic notice lists the current browser technologies and explains what would change if additional tools were introduced.

The enquiry service uses validation, a hidden anti-spam field and a server-side submission counter. Its ten-minute counting window limits repeated submissions. Temporary records contain a hash of the network address and submission hashes, rather than message contents; inactive records are periodically removed. This enquiry service does not load Cloudflare Turnstile or send enquiries through Resend.

There is no automated decision-making that determines eligibility for our services or produces legal or similarly significant effects. A security check may reject or delay an attempted submission; this does not decide whether we will take on a project.

Saving a brief sends no form contents to an email provider. Sending an enquiry uses the following services:

Website hosting and mail system: receives and checks the form submission, then passes the enquiry to the business mailbox.
Business mailbox service: receives and stores enquiry emails and the correspondence needed to respond to you.

Access is limited to the business owner and providers or professional advisers who need the information for the relevant task. Disclosure to an authority may be required by law. We do not sell enquiry information.

Providers may process information outside the UK, including in the United States. The actual destinations, provider roles and applicable transfer safeguards have not yet been finalised for launch. Before enabling those services, we will identify the arrangements and update this notice with the relevant UK adequacy provision or appropriate safeguard, and how you can obtain information about it.

6. How long information is kept

Unsent drafts: only for the life of the page’s in-memory form state. Downloaded copies remain on your device until you delete them.
Technical logs: are retained for a justified operational or security need. Temporary enquiry counters have a ten-minute counting window and inactive records are periodically removed.
Enquiry correspondence: correspondence will be kept while the enquiry is active and for any justified follow-up, then reviewed for deletion. If a project follows, relevant records may be needed for the service, tax obligations or establishing or defending legal claims. The criteria are the continuing purpose, applicable legal periods and any live dispute, not indefinite retention for possible marketing.

Enquiry correspondence is reviewed for deletion once the enquiry and any justified follow-up are complete. Provider-held information and backup expiry must also be considered.

We will use access controls and proportionate safeguards for received information. No internet service can promise absolute security. Any personal data breach will be assessed and reported to the ICO and affected people where the law requires.

7. Your data protection rights

Depending on the circumstances and lawful basis, you can ask for access to your information, correction of inaccuracies, erasure, restriction of use, or a portable copy of information you supplied where the portability right applies. Where processing relies on consent, you can withdraw it without affecting earlier lawful processing. These rights have legal conditions and exceptions.

To make a privacy rights request, email [email protected]. Explain the information or request involved and how you would like us to reply. You can use this email address directly for a privacy request.

Rights requests will normally be answered within one month, subject to lawful extensions or adjustments. We may need proportionate information to confirm identity or clarify a request. Requests are normally free; any lawful refusal, fee or extension will be explained.

Read more about data protection rights from the ICO.

8. Privacy questions & complaints

If you are concerned about how the business handles your information, email [email protected] and say you are raising a data protection complaint. Explain the concern and how you would like us to reply. You do not need to use a specific subject line or format. You can contact this email address directly for a complaint.

When a complaint is received, we will acknowledge it within 30 days, investigate appropriately, keep you informed and communicate the outcome without undue delay. This is distinct from the usual one-month deadline for responding to a data rights request.

You can also raise a concern with the UK regulator, the Information Commissioner’s Office. Its complaints page explains how to contact it and what information to provide. Your right to complain to the ICO and any other available legal remedy is unaffected.

9. Changes to this notice

We will review this notice when the website, providers, processing purposes or legal requirements change. The date at the top identifies the current version. Any new use of information will be explained before it starts, and a new permission will be sought where required.

Further reading: ICO privacy notice guidance and ICO complaints guidance.