Privacy policy.

1. Who we are

Coullweb is a fully managed website service run by Coullweb Ltd, registered in England (company number 09914691, VAT number 229 426 596). Our studio is at 16/16a Hart House, Priestley Road, Basingstoke, Hampshire, RG24 9PU, United Kingdom.

For the personal data described here, Coullweb Ltd is the data controller. In this policy, "we", "us" and "our" mean Coullweb Ltd. "You" and "your" mean whoever the information is about: a visitor to this site, someone who gets in touch, or a client.

2. About this policy

This policy covers the personal data we collect through coullweb.com and through running our managed website service. We have written it in plain English rather than legalese, because that is how we would rather explain it.

It does not cover the websites we build and host for our clients. On those sites our client is the data controller and their own privacy policy applies; we act as their processor.

We handle personal data in line with the UK GDPR and the Data Protection Act 2018. Section 18 of our terms and conditions covers the same ground from the contract side.

3. When you visit the site

This site is a set of static pages. We do not ask you to create an account, and simply reading a page does not tell us who you are.

• Our hosting provider, Cloudflare, processes the technical details every web request carries: your IP address, the page requested, your browser and device type, and the time of the request. That happens for every website and is what keeps the site online, fast and protected from attacks.
• We use Google Analytics to see, in aggregate, which pages people find useful. See section 10 for what that involves and how to opt out.
• Our fonts are served from our own site, not from a font network, so visiting a page does not hand your details to a third-party font provider.

4. When you get in touch

If you ask for a free homepage, or contact us through the site, we collect what you tell us: your name, your business name, your email address, your phone number, your current website address if you have one, and whatever you write about what you need.

Form submissions are sent to our own forms service at forms.cwb.is, which is run by us on Cloudflare. From there they reach us by email so we can reply. We use these details to answer your enquiry, prepare your free homepage and, if you go ahead, set your service up.

If you email, phone or write to us instead, we keep that correspondence for the same reasons.

5. When you join the newsletter

Our newsletter asks for one thing: your email address. We use it to send occasional plain-English tips about small business websites, and nothing else.

We do not sell or rent our list, and we do not pass your address to other companies to market to you. Every newsletter includes an unsubscribe link, and you can ask us to remove you at any time by emailing support@coullweb.com.

6. When you become a client

Running your service means holding a bit more: your contact details, your business details, billing and payment records, the domain and hosting accounts we manage for you, and our correspondence about your site.

Card details are handled by our payment provider, not by us. We see a record of what was paid and when; we do not store your full card number.

We may also hold details you give us about your own customers or staff, for example if you ask us to publish a team page or set up a form. Where that happens we are acting on your instructions as your processor, and section 18 of our terms and conditions applies.

7. The onboarding form

New clients are sent a private link to an onboarding form so we can gather everything we need to build the site in one go. The link carries a unique token. Treat it like a password: anyone who has the link can see and edit that form, so please do not share it more widely than you mean to.

The form asks for:

• Your contact details: name, email address, phone or WhatsApp number, your role, and how you would prefer we reach you.
• Your business details: trading name, address, phone, email, current website, social profiles, the services you offer and the areas you cover.
• Domain details: the domain you want, your registrar, and how we should get access to it if you already own one.
• What you want on the site: pages, notes on the concept, reviews you would like shown, and anything else you want to tell us.

The form saves as you go so you do not lose your place, and drafts are held on our forms service rather than on your device. If you ask us to send you a link to come back later, we email that link to the address you entered in the form. Some fields may arrive pre-filled from information we already hold about your business or that is published publicly, such as a business listing; you can correct or clear anything that is wrong before you submit.

8. Files you send us

The onboarding form lets you upload your logo and photos. Files are stored in Cloudflare R2, our file storage, under your onboarding token, and are used only to build and run your site.

• Please only upload material you own or have permission to use.
• If a photograph shows identifiable people, you are responsible for having their permission before you send it to us.
• You can remove a file from the form yourself, and you can ask us to delete any file at any time.

9. Our lawful bases

Data protection law asks us to have a reason for using your data. Ours are:

• Contract — answering your enquiry, preparing your free homepage, and running your service, billing and support.
• Legitimate interests — keeping the site secure, blocking spam, understanding in aggregate how the site is used, and keeping records of what we agreed. We only rely on this where it does not override your own rights.
• Consent — the newsletter, and any optional analytics or marketing cookies. You can withdraw consent at any time.
• Legal obligation — keeping accounting and tax records for as long as the law requires.

10. Cookies and analytics

This site sets no cookies of its own. It does not track you between visits for advertising, and there are no advertising or social media pixels on it.

We do use Google Analytics 4 to see which pages people read and how they got to them. It records the page viewed, the page title, roughly where in the world the visit came from, and the type of browser and device, and it sets its own cookies to tell one visit from another. We use it in aggregate to improve the site; we do not use it to identify individuals or to build advertising profiles.

Cloudflare Turnstile, described in the next section, also sets its own cookies when a form is shown, purely to tell people from bots.

11. Spam protection

Our forms are protected by Cloudflare Turnstile, a privacy-focused alternative to the usual "prove you are human" puzzles. It checks the request rather than asking you to identify traffic lights, and it processes technical signals from your browser to do so.

Our forms also carry a hidden field that people never see and never fill in. If it comes back completed, we know the submission was made by a bot and we discard it.

12. Who we share it with

We do not sell your personal data, and we never pass it to a third party for their own marketing. We do rely on a small number of suppliers to run the service, and they process data on our instructions under a contract:

• Cloudflare — hosting for this site, our forms service, file storage and Turnstile spam protection.
• Google — Google Analytics, as described in section 10.
• Our email, accounting and payment providers — for correspondence, invoicing and taking payment.
• Any hosting, domain or third-party service we set up for you — only where you have asked us to, and only to the extent needed to run it.

As our terms say, we may sub-contract work on your site. Where we do, the sub-contractor is bound by the same duties of confidentiality and we stay responsible to you.

We will also disclose information if the law requires it, or to establish or defend a legal claim.

13. Where your data is held

We are a UK business and we work in the UK. Some of our suppliers, including Cloudflare and Google, operate global networks, so your data may be processed outside the UK.

Where that happens, we rely on the safeguards UK data protection law recognises, such as an adequacy decision or the International Data Transfer Agreement, so your data keeps the same protection it has here.

14. How long we keep it

We keep personal data only for as long as we have a reason to, then delete it.

• Enquiries that do not go anywhere — kept for up to two years, in case you come back to us, then deleted.
• Onboarding drafts and uploads — kept while we build your site and for the life of your service. Unfinished drafts from people who do not go ahead are deleted within twelve months.
• Client records — kept for the life of your service and for six years afterwards, so we can deal with any query or claim.
• Accounting records — kept for six years after the end of the relevant financial year, as tax law requires.
• Newsletter subscribers — kept until you unsubscribe.
• Analytics — retained by Google for the period set on our account, in aggregate rather than as a named record of you.

15. How we keep it safe

Everything on this site is served over an encrypted connection, and form submissions are encrypted in transit. Passwords and account details we hold for you live in a secure password manager, and are shared with you securely on request, never by plain email.

Access is limited to the people in our team who need it to do the work. No system is ever completely secure, but if a breach ever put your rights at risk we would tell you and the regulator promptly, as the law requires.

16. Your rights

Under UK data protection law you can ask us to:

• Tell you what personal data we hold about you, and give you a copy.
• Correct anything that is wrong or incomplete.
• Delete data we no longer have a reason to keep.
• Restrict or object to how we use it, including any use based on our legitimate interests.
• Send data you gave us to another provider, where that applies.
• Withdraw consent, for the newsletter or analytics, at any time.

Email support@coullweb.com and we will deal with it. We will respond within one month, and we will not charge you for it. We may need to check who you are first, so that we do not hand your data to someone else.

17. Changes to this policy

We update this policy when what we do changes: a new tool, a new supplier, a new part of the service. The date at the top of the page always shows when it was last revised.

If a change materially affects how we use your data, we will tell our clients and subscribers directly rather than relying on you to spot it here.

18. Complaints

If you are unhappy with how we have handled your personal data, please tell us first. We would far rather hear about it and put it right.

You also have the right to complain to the UK regulator, the Information Commissioner's Office, at ico.org.uk or on 0303 123 1113. You do not have to come to us first, but it usually gets to an answer faster.

19. Contact us

Questions about your data, or about this policy? We are happy to talk them through in plain English.