Legal

Privacy Policy

Effective Date: 26 May 2026  ·  Version 2.0

Wellington Web Co. is committed to protecting your personal data and being transparent about how we use it. This Privacy Policy explains what data we collect, why we collect it, how we use it and what rights you have. It applies to all personal data processed by Wellington Web Co. in connection with our website and services.

In plain English: We collect only what we need to do our job. We never sell your data. We use Google Analytics and Microsoft Clarity to understand how our site is used. You can ask us to delete your data at any time. The full detail is below.

1. Who We Are

Wellington Web Co. is a web design and digital services agency based in Edinburgh, Scotland, United Kingdom.

For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, Wellington Web Co. is the data controller in respect of personal data collected through this website and in the course of providing our services.

2. What Data We Collect

We collect and process the following categories of personal data:

Data you provide directly:

  • Full name and business name
  • Email address and phone number
  • Business address or location
  • Project requirements, briefs and notes you share with us
  • Payment details (processed securely via third party payment processors, we do not store card details ourselves)
  • Any other information you choose to share via email, contact form or in meetings

Data collected automatically when you use our website:

  • IP address (anonymised where possible)
  • Browser type and version
  • Device type and operating system
  • Pages visited, time on page and navigation paths
  • Referring website or search query
  • Approximate geographic location (country or city level)
  • Cookie identifiers (see Section 7 for full details)

We do not collect special category data (such as health information, racial or ethnic origin, political opinions or biometric data) and we do not knowingly collect data from anyone under the age of 16.

3. How We Collect Your Data

We collect personal data through the following channels:

  • Contact form on our website
  • Email correspondence
  • Phone or video calls
  • In person meetings
  • Project Estimator tool on our website
  • Social media direct messages or comments (Instagram, LinkedIn)
  • Referrals from existing clients or partners
  • Cookies and analytics tools when you visit our website (see Section 7)

4. Why We Use Your Data and Our Lawful Basis

UK GDPR requires us to have a lawful basis for processing personal data. We process your data under the following bases:

Contract performance (Article 6(1)(b)): Where you are a client or prospective client, we process your data to provide quotes, enter into and perform our contract with you, issue invoices, deliver project work and manage the client relationship. This is the primary basis for processing client data.

Legitimate interests (Article 6(1)(f)): We process certain data on the basis of our legitimate business interests, including:

  • Responding to enquiries from prospective clients
  • Maintaining records of past projects and client communications
  • Analysing website traffic to improve our site and services
  • Protecting our business from fraud or misuse
  • Sending occasional follow up communications to past clients about relevant services

We always balance our legitimate interests against your rights and interests before relying on this basis.

Legal obligation (Article 6(1)(c)): We may process data to comply with legal obligations, such as retaining financial records for HMRC purposes.

Consent (Article 6(1)(a)): Where we send marketing communications or use non-essential cookies, we rely on your consent. You can withdraw consent at any time (see Section 9).

5. How We Use Your Data

We use your personal data for the following purposes:

  • Responding to enquiries and providing quotes and proposals
  • Delivering web design, development and related services
  • Communicating project updates, feedback requests and approvals
  • Issuing invoices and processing payments
  • Managing ongoing client and maintenance relationships
  • Complying with our legal and financial obligations (including tax record keeping)
  • Improving our website and understanding how visitors use it
  • Sending relevant service updates or occasional marketing to past clients (you can opt out at any time)
  • Protecting the security and integrity of our systems and services

We will never sell, rent or share your personal data with third parties for their own marketing purposes.

6. Who We Share Your Data With

We share personal data only where necessary and only with the following categories of recipients:

Service providers and processors: We use trusted third party tools to run our business. These providers act as data processors and may handle your data only on our instructions:

  • Google (Analytics, Search Console, Workspace): Website analytics and business email. Google is subject to the UK adequacy framework and its own privacy commitments.
  • Microsoft Clarity: Heatmap and session replay analytics that show how visitors navigate the site. Clarity sets cookies and records on page interactions to build aggregated behaviour insights, and it automatically masks text and sensitive input by default. Microsoft acts as a data processor under its own privacy and security commitments.
  • Meta Pixel (Facebook and Instagram): We use the Meta Pixel to measure and improve our advertising on Facebook and Instagram. It sets cookies and shares limited activity (such as pages viewed and enquiries submitted) with Meta so we can see which ads lead to enquiries and reach similar people. Meta processes this data under its own terms and data policy.
  • Netlify / hosting providers: Our website is hosted on platforms that may process server logs including IP addresses.
  • Payment processors (e.g. Stripe, PayPal, bank transfer): For processing invoices and payments. We do not store card details, these are handled directly by the payment processor under their own security standards.
  • Email providers: For sending and receiving client communications.
  • Project management tools: We may use tools such as Notion, Trello or similar to organise project information. We ensure these are configured appropriately for data protection.
  • Subcontractors: On certain projects we may engage specialist subcontractors. We share only the data they strictly need to perform their role and they are bound by confidentiality obligations.

Legal and regulatory: We may disclose personal data to law enforcement, regulatory bodies or courts where required by law or to protect our legal rights.

We do not transfer personal data outside the UK or EEA unless appropriate safeguards are in place (such as adequacy decisions or standard contractual clauses).

7. Cookies and Tracking

Our website uses cookies, small text files placed on your device, to make the site work properly and to help us understand how it is used.

Essential cookies: These are necessary for the website to function and cannot be switched off. They do not collect personal data for marketing purposes.

  • Session and preference cookies (e.g. dark mode setting)
  • Cookie consent preference storage

Analytics cookies: With your consent, we use Google Analytics to collect anonymised data about how visitors use our site (pages visited, time on site, traffic sources). This helps us improve the site. Google Analytics uses cookies to distinguish users. The data is aggregated and does not identify you personally. You can opt out of Google Analytics tracking at any time via tools.google.com/dlpage/gaoptout.

Heatmaps and session recordings: We also use Microsoft Clarity to record anonymised heatmaps and session replays (mouse movement, clicks and scrolling) that help us see how the site is used and where it can be improved. Clarity masks text and form inputs by default, so it does not capture what you type. You can control or block these cookies through your browser settings (see Managing cookies below).

Managing cookies: You can control and delete cookies through your browser settings. Disabling cookies may affect how certain parts of the website function. Our cookie banner lets you accept or decline non-essential cookies when you first visit the site.

8. How Long We Keep Your Data

We retain personal data only for as long as necessary for the purposes described in this policy. Our standard retention periods are:

  • Client project files and communications: 6 years from project completion (to comply with the Limitation Act 1980 and for potential dispute resolution)
  • Financial records and invoices: 6 years from the end of the relevant financial year (HMRC requirement)
  • Enquiries that did not result in a project: 12 months from last contact
  • Website analytics data: 14 months (Google Analytics default retention)
  • Marketing contact preferences: Until you opt out or withdraw consent
  • Cookie consent records: 12 months

When data is no longer needed, we securely delete or anonymise it.

9. Your Rights Under UK GDPR

You have the following rights in relation to your personal data. To exercise any of them, please contact us at contact@wellingtonwebco.com. We will respond within one calendar month.

  • Right of access: You can request a copy of the personal data we hold about you (a Subject Access Request).
  • Right to rectification: You can ask us to correct any inaccurate or incomplete data we hold.
  • Right to erasure: You can ask us to delete your data where there is no compelling reason for us to continue processing it. Note that we may need to retain some data to comply with legal obligations.
  • Right to restrict processing: You can ask us to pause processing your data in certain circumstances, for example while a dispute is resolved.
  • Right to data portability: Where processing is based on consent or contract and carried out by automated means, you can ask us to provide your data in a structured, machine readable format.
  • Right to object: You can object to processing based on legitimate interests or for direct marketing purposes. Where you object to direct marketing, we will stop immediately.
  • Right to withdraw consent: Where processing is based on consent, you can withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
  • Rights related to automated decision making: We do not use automated decision making or profiling in a way that produces legal or similarly significant effects on you.

10. Security

We take the security of your personal data seriously and implement appropriate technical and organisational measures to protect it against unauthorised access, loss, destruction or alteration. These include:

  • Password protected and encrypted storage systems
  • Restricted access to client data on a need to know basis
  • Secure, encrypted email communications where possible
  • Regular review of our data handling practices
  • Use of reputable, security certified third party service providers

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office (ICO) within 72 hours and, where required, notify you directly without undue delay.

11. Children's Data

Our services are directed at businesses and adults. We do not knowingly collect personal data from anyone under the age of 16. If you believe a child has provided us with personal data without appropriate consent, please contact us and we will delete it promptly.

12. Links to Other Websites

Our website may contain links to third party websites (for example social media platforms, hosting providers or tools we recommend). We are not responsible for the privacy practices of those websites and encourage you to review their privacy policies before providing any personal data.

13. Complaints

If you are unhappy with how we have handled your personal data, please contact us first at contact@wellingtonwebco.com and we will do our best to resolve it.

If you remain dissatisfied, you have the right to lodge a complaint with the UK's supervisory authority:

  • Information Commissioner's Office (ICO)
  • Website: ico.org.uk
  • Helpline: 0303 123 1113

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or in applicable law. When we make significant changes, we will update the effective date at the top of this page. We encourage you to review this policy periodically. Continued use of our website or services after changes are posted constitutes acceptance of the updated policy.

15. Contact Us

For any questions, requests or concerns about this Privacy Policy or the way we handle your personal data, please contact us:

This Privacy Policy was last updated on 26 May 2026 and applies to all data processed by Wellington Web Co. from that date. It is governed by and construed in accordance with the laws of Scotland and the United Kingdom.