Privacy Policy & General Data Protection Regulation (GDPR)

This policy explains what personal information we collect when you use www.webup.co.uk or work with us, why we collect it, who else sees it, how long we keep it and what rights you have over it. It is written to meet the UK General Data Protection Regulation and the Data Protection Act 2018.

We have tried to write it in plain English rather than legal boilerplate. If anything is unclear, ask us and we will explain it — our details are in section 1.

WebUp® Media is the trading name of Gareth Williams, a sole trader based in Prestatyn, North Wales. We are the data controller for the information described in this policy, which means we decide what is collected and what it is used for.

• By email at hello@webup.co.uk
• By phone on 0800 246 1142
• By post to WebUp® Media, 8 Ffordd Pendyffryn, Prestatyn, LL19 9RY

We are a sole trader, so we are not registered at Companies House and have no company registration number. We are small enough that we are not required to appoint a Data Protection Officer; Gareth Williams deals with data protection questions personally.

Nearly everything we hold comes from you directly. We collect:

• Enquiries. When you use the form on our contact page we collect your name, email address, phone number and your message. Anything else you choose to put in the message is collected too.
• Newsletter signups. Your email address, and your name if you give it, through our newsletter page.
• Client onboarding. If you become a client, the business, project and contact details you enter on our onboarding form, plus anything you send us so we can do the work.
• Correspondence. What you tell us by phone, email, social media or in person, and our record of that conversation.
• Client and billing records. Contact details, invoices, payment records and project files for the work we do for you.
• Website usage. If you accept analytics cookies: which pages you looked at, how you found us, roughly where you are based, and what browser and device you used. Hotjar also builds anonymised heatmaps and session recordings, with typed input masked so form contents are not captured.
• Advertising. If you accept marketing cookies, Meta and Mailchimp receive information about your visit for advertising purposes.
• Server logs. Our hosting provider keeps standard web server logs, which include IP addresses, for security and fault-finding.

We do not deliberately collect special category information such as health, ethnicity, religious or political views, and we ask that you do not send us any in a message or form.

The law requires us to have a specific reason, called a lawful basis, for each thing we do with your information. Ours are set out below.

Where we rely on legitimate interests we have weighed our interest against your privacy and are satisfied it is fair and expected. You can object to any of it — see section 9.

A cookie is a small file a website asks your browser to store, so it can recognise your browser later. We set the cookies we need to run the site, and nothing else unless you tell us it is alright.

The first time you visit you are asked what you are happy with, and you can say no as easily as yes. Analytics, marketing and embedded third-party content are all switched off until you turn them on, and you can change your answer at any time using the Cookie Settings link at the bottom of every page.

Every cookie we use, who sets it, what it does and how long it lasts is listed in our Cookie Policy.

Change your cookie settings

We do not sell your information, and we do not hand your contact details to other companies for their own marketing. We do use the suppliers below to run our business, and they handle personal information on our behalf under a contract that limits what they may do with it.

Be aware that if you accept marketing cookies, Meta and Mailchimp also use what they learn about your visit for their own purposes, as set out in their own privacy policies. That is why those cookies are off by default. If you never accept them, no information about your visit reaches those companies.

We will also share information if we are legally required to — for example in response to a court order — or if we ever sell the business, in which case whoever takes it on would be bound by this policy.

Several of the suppliers in section 5 are based in the United States or use suppliers there, so some information is transferred outside the UK.

Where that happens we rely on one of the safeguards UK law provides: either the company is certified under the UK Extension to the EU–US Data Privacy Framework, or the transfer is covered by the UK International Data Transfer Addendum to the European Commission's standard contractual clauses. Ask us and we will tell you which applies to a particular supplier.

We do not keep anything longer than we need it.

This website is served over an encrypted connection. Enquiries arrive in a password-protected mailbox that only Gareth Williams has access to, and we turn on two-factor authentication wherever a supplier offers it. Access to client systems is limited to what is needed to do the work, and removed when the work ends.

No system is perfectly secure. If there is ever a breach that is likely to put your rights at risk we will report it to the Information Commissioner's Office within 72 hours of becoming aware of it, and tell you directly if the risk to you is high.

You have the following rights over the information we hold about you:

• To be told what we hold and what we do with it — which is what this policy is for.
• To see a copy of the information we hold about you.
• To have it corrected if it is wrong or incomplete.
• To have it deleted, where we have no continuing reason to keep it.
• To restrict what we do with it while a query about it is sorted out.
• To take it elsewhere, in a common electronic format, where we hold it on the basis of consent or a contract.
• To object to us using it where we rely on legitimate interests, and to object to direct marketing at any time.
• To withdraw consent at any time where consent is what we relied on. This does not undo anything done before you withdrew it.
• Not to be subject to a decision made purely by a machine that has a legal or similarly significant effect on you. We do not make decisions that way — see section 11.

To use any of these, email hello@webup.co.uk or write to us at the address in section 1. It costs nothing, and we will reply within one month. If a request is unusually complicated we may need up to two months, and we will tell you if that is the case. We may ask you to confirm who you are first, so that we do not hand your information to somebody else.

To stop marketing emails you can also just use the unsubscribe link at the bottom of any of them.

If you are unhappy with how we have handled your information, please tell us first so we have the chance to put it right. You also have the right to complain to the UK's data protection regulator, and you do not have to come to us first.

• Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
• Helpline: 0303 123 1113
• Website: ico.org.uk/make-a-complaint

Our services are aimed at businesses and we do not direct this website at children. We do not knowingly collect information about anyone under 18. If you believe a child has given us their details, tell us and we will delete them.

We do not make any decision about you purely by automated means that has a legal effect or a similarly significant one. The analytics and advertising services in section 5 do profile visitors, but the only consequence is which adverts you are shown, and that only happens if you accept marketing cookies.

We review this policy regularly and whenever we change how we handle information. Any change is posted on this page with a new date below. If we start using something new that sets cookies we will ask for your consent again rather than assume your previous answer still applies. Where a change materially affects you and we hold your email address, we will tell you.