Privacy Policy

Last updated: 9 July 2026

This policy explains how Beloved Websites collects, uses and protects personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We keep it plain and we keep it honest: we don't sell your data, and we only collect what we need to build your website and reply to you.

1. Who we are

Beloved Websites ("we", "us", "our") is a web design and static-hosting service for small businesses, based in the United Kingdom. For anything to do with your data — including any request or question — contact us at info.belovedwebsites@gmail.com or on +44 7378 378430.

For the personal data of our own customers and enquirers (described below), we are the data controller. Where we host a contact form on a customer's website, we handle their visitors' enquiries as the customer's data processor — see section 10.

2. What personal data we collect & why

a) When you contact us or order a website

Our site has two forms — a quick contact form and an "order my free website" form. Depending on which you use, and on what you message us, we may collect:

• your name;
• email address;
• phone or WhatsApp number;
• your message, and the brief you give us (business name, what your business does, the area you serve, and whether you have a logo, photos or text ready);
• your preferred option (free subdomain or £9.99/mo on your own domain);
• a record of the consent you gave, and whether you opted in to occasional marketing emails.

Why: to reply to you, prepare your website, provide a quote and next steps, and — only if you opted in — send occasional tips and offers.

b) When you become a paying customer

We collect the information needed to provide, support and bill the service — including your site content and brief, your domain/hosting details, our messages with you, and billing information. Direct Debit and payment details are handled by our payment and bookkeeping provider; we don't store your full bank details ourselves.

c) Technical & security data

Our servers and our security/content-delivery provider keep limited technical logs (which can include IP addresses) to keep the service secure, available and free of abuse.

3. Our lawful bases for using your data

• Consent — when you tick the box and submit a form, you consent to us using your details to reply to your enquiry. If you also tick the optional marketing box, that's a separate consent for occasional emails, which is never required to get a reply and which you can withdraw at any time.
• Performance of a contract — to provide, support and bill the service once you're a customer.
• Legitimate interests — to run, secure and improve the service and communicate with you, in a way that doesn't override your rights.
• Legal obligation — for example, keeping accounting records.

4. Who we share your data with

We share personal data only as needed to run the service, with providers acting for us under contract. We never sell your data and we never share it for anyone else's marketing.

We may also disclose data where the law requires it, or to protect our rights, users or the service.

5. International transfers

Some of our providers are based outside the UK. Where personal data is transferred internationally, we rely on an appropriate safeguard recognised under UK data-protection law — for example a UK "adequacy" decision, the UK International Data Transfer Agreement (or the UK Addendum to the EU Standard Contractual Clauses), or the UK Extension to the EU–US Data Privacy Framework.

6. How long we keep your data

• Enquiry / form data: up to 24 months after you submit a form, then permanently deleted. If you ask us to delete it sooner, we will.
• Customer records: for as long as you're a customer, and a reasonable period afterwards.
• Accounting & tax records: for 6 years, as UK tax law requires.
• Day-to-day support messages (such as WhatsApp support chats): a rolling window of around 90 days. Correspondence that forms part of your project or account is kept for as long as you're a customer (see "Customer records" above).
• Backups: cycled and overwritten on our standard backup schedule.

7. Cookies & analytics

We keep cookies to a minimum. We do not use advertising cookies or cross-site trackers. For basic visitor statistics we use Cloudflare Web Analytics, which is privacy-friendly and cookieless — it records anonymous, aggregated information (such as page views, referrers and approximate country) and can't be used to identify you or follow you across other websites. Our security/content-delivery provider may set essential cookies needed for security and performance. Our pages also load web fonts from Google Fonts; when they do, Google receives your device's IP address in order to serve the fonts (no cookies are set for this).

8. Your rights under UK GDPR

You have the right to:

• Access (Art. 15) — get a copy of the data we hold about you;
• Rectification (Art. 16) — correct anything inaccurate;
• Erasure (Art. 17) — ask us to delete your data (the "right to be forgotten");
• Restriction (Art. 18) — ask us to limit how we use it;
• Portability (Art. 20) — receive your data in a portable format;
• Object (Art. 21) — object to certain processing;
• Withdraw consent — at any time, where we rely on consent.

To exercise any of these, email info.belovedwebsites@gmail.com. We'll respond within one month. If you believe we've mishandled your data you can complain to the UK Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113 — though we'd appreciate the chance to put things right first.

9. Security

We protect data with HTTPS/TLS across every site, access controls, least-privilege system access and regular backups. No system is ever perfectly secure, but we take technical and organisational measures appropriate to the risk.

10. Your website's visitors (when we're your processor)

If you're a customer and your site has a contact or enquiry form, the personal data your visitors submit (typically their name, email, phone and message) is processed by us on your behalf and on your instructions. In that role you are the controller and we are your processor under UK GDPR Article 28. We:

• process that data only to receive, briefly store and deliver enquiries to you, and to keep the form secure;
• keep it confidential and apply appropriate security;
• retain form submissions only as long as needed to deliver them and for a short operational window (around 90 days), unless you tell us otherwise;
• notify you without undue delay if we become aware of a personal-data breach affecting your visitors' data;
• delete or return the data at the end of the service, unless the law requires us to keep it.

11. Children

Our service is aimed at businesses, not children, and is not directed at anyone under 18.

12. Changes to this policy & how to contact us

We may update this policy from time to time; if we make material changes we'll update the "last updated" date above. For anything to do with your data, contact info.belovedwebsites@gmail.com or message us on WhatsApp. See also our Terms & Conditions.

Beloved Websites — a quality touch. We build beautiful, fast websites for small businesses, and we treat your data the way we'd want ours treated.