Privacy policy

Nothing is collected unless you send it. Browsing the site does not require you to give any personal details.

When you submit the contact, quote or booking form, the following is collected: your name, your email address, and — if you choose to give them — your phone number, the type of work you are enquiring about, your budget, your timeline, and whatever you write in the message field.

Enquiries are stored in a database as well as emailed, so that nothing is lost if an email fails to arrive, and so there is a record of what was discussed.

If you go on to become a client, records of your project are also kept: your business details, the brief you provide, project status, invoices, and any messages sent through the client portal.

Your IP address is briefly held in memory to limit how many submissions can be made in a short period. This is a spam protection measure. It is not stored, not logged to a database, and is discarded when the server instance recycles.

To reply to your enquiry and, if you go ahead, to carry out and administer the work — quoting, keeping track of the project, invoicing, and answering your questions. Your details are not used for marketing, not added to a mailing list, and not sold or shared with anyone for their own purposes.

The lawful basis is legitimate interests — you have contacted a business asking for a service, and replying to you is the obvious and expected outcome. Where an enquiry becomes a project, the basis is performance of a contract.

Two services are involved in running this site, and both are bound by their own data protection obligations:

Resend delivers the emails generated by the forms. Your submission passes through their systems so that it can reach my inbox and so that your confirmation email can reach you. Resend is based in the United States, and this transfer is covered by standard contractual clauses.

Vercel hosts the site and provides its analytics. The analytics are aggregate and cookie-free: they count page views and measure loading performance. They do not use cookies, do not fingerprint your device, and cannot identify you.

Supabase provides the database where enquiries and client records are stored, and the sign-in system behind the client portal. Data is held in their European infrastructure.

The public site sets no cookies. There is no tracking, no advertising pixel and no third-party script following you between sites, which is why you have not been asked to accept anything.

Signing in to the client portal sets one cookie, which keeps you signed in. It is strictly necessary for the portal to work and is not used for tracking, so no consent banner is required for it. Signing out removes it.

Clients can be given access to a portal showing their project, invoices and messages. Sign-in is by a link emailed to you — no password is set or stored.

Access is restricted at the database level, so an account can only ever read records belonging to that client. Access can be revoked at any time, and takes effect immediately.

Enquiry emails are kept for as long as there is a reasonable prospect of doing business, and are then deleted. Where an enquiry becomes a paid project, records are kept for six years after the work finishes, which is the period HMRC requires for business records.

You can ask for your details to be deleted sooner, and unless there is a legal obligation to keep them, they will be.

Under UK GDPR you can ask for a copy of the personal data held about you, ask for it to be corrected or deleted, object to it being processed, or ask for processing to be restricted. There is no charge, and a response will be given within one month.

To exercise any of these, email tradewebco@gmail.com.

If you are not satisfied with how a request has been handled, you can complain to the Information Commissioner's Office at ico.org.uk, which regulates data protection in the UK.

If how data is handled changes, this page changes with it, and the date at the top is updated.