First Web Design Ltd
Privacy Policy
Last updated: 17 September 2026
This policy explains how First Web Design Ltd collects, uses and protects personal information when you visit firstwebdesign.co.uk, contact us, subscribe to updates or work with us as a client.
1. Who we are
First Web Design Ltd (“we”, “us”, “our”) is the controller of the personal information described in this policy.
- Registered in England and Wales, company number 14964940
- Registered office: 167-169 Great Portland Street, 5th Floor, London W1W 5PF
- Email: hello@firstwebdesign.co.uk
- Phone: 01480 262123
We are not required to appoint a Data Protection Officer. Please contact us using the details above with any privacy question.
2. Information we collect
When you contact us. If you use our enquiry form, email or phone us, we collect the details you give us. Through our form this is your name, email address, phone number (optional), enquiry type, message, the services you are interested in, your current website, project details, timescale, budget range and any files you choose to upload. Please do not include sensitive personal information (such as health details) in your message or uploads.
When you become a client. We collect contact details for you and your colleagues, billing and invoicing information, project correspondence, and the access details and content you share with us to deliver our services.
When you subscribe to updates. Your email address (and name, if you provide it), a record of when you subscribed and confirmed, and basic engagement information such as whether our emails are opened or links clicked.
When you browse our website. Our servers and security tools record technical information such as your IP address, browser type, pages requested and the date and time of your visit. We also record your cookie consent choice. See our Cookie Policy for details of the cookies we use.
We do not currently use analytics or advertising tracking on this website. If that changes, we will ask for your consent first and update this policy.
3. How we use your information and our lawful basis
| Purpose | Lawful basis under UK GDPR |
|---|---|
| Responding to your enquiry and preparing quotes or proposals | Legitimate interests (responding to people who contact us), or steps at your request before entering into a contract |
| Delivering services, managing projects, hosting, support and maintenance | Performance of a contract |
| Invoicing, accounting and tax records | Legal obligation |
| Sending updates you have subscribed to | Consent, which you can withdraw at any time |
| Keeping our website secure, preventing misuse and making backups | Legitimate interests (protecting our website and data) |
| Setting non-essential cookies | Consent, managed through our cookie banner |
| Establishing, exercising or defending legal claims | Legitimate interests |
Where we rely on legitimate interests, we have balanced our interests against your rights. You can ask us for more information about this assessment.
We do not make decisions about you based solely on automated processing, and we never sell your personal information.
4. Who we share your information with
We only share personal information where necessary, with:
- Hosting and email providers, who store our website, form submissions and email
- Dropbox, where website backups are stored
- MailPoet (Automattic), which sends our email updates to subscribers
- Professional advisers such as our accountant, insurers and legal advisers
- Trusted subcontractors who help deliver client projects, under confidentiality obligations
- Authorities, such as HMRC, where the law requires it
Our service providers act on our instructions and must keep your information secure.
5. International transfers
Some providers, including Dropbox and Automattic (MailPoet), may process data outside the UK, including in the United States. Where this happens, we rely on UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework) or appropriate safeguards such as the ICO’s International Data Transfer Agreement or Addendum.
6. How long we keep your information
- Enquiries that do not lead to work: 2 years from our last contact, after which enquiry form entries are removed automatically and related emails are deleted
- Client and financial records: 6 years from the end of the financial year they relate to, as required by HMRC, or longer where the law requires
- Update subscribers: until you unsubscribe; we keep a minimal record so we do not contact you again
- Cookie consent choices: as set out in our Cookie Policy
- Server and security logs: in line with our hosting provider’s retention settings
- Website backups: overwritten on a rolling basis and removed within 30 days
We securely delete or anonymise information when it is no longer needed.
7. When we act on behalf of our clients
When we build, host or maintain websites and systems for clients, we may process personal information on their behalf, for example form entries submitted on their website. In that case our client is the controller, their own privacy notice applies, and we act as their processor under our contract with them. Please contact the relevant organisation about that information.
8. Your rights
Under UK data protection law you have the right to:
- Access a copy of your personal information
- Have inaccurate information corrected
- Have your information erased
- Restrict how we use your information
- Object to processing based on legitimate interests, and to direct marketing at any time
- Data portability, where processing is based on consent or contract
- Withdraw consent at any time, without affecting processing already carried out
To use any of these rights, contact us at hello@firstwebdesign.co.uk. We will respond within 1 month, which may be extended in limited circumstances. There is usually no charge.
9. Complaints
If you are unhappy with how we have handled your personal information, please tell us first so we can put it right. You can complain by email to hello@firstwebdesign.co.uk, through our contact form, by phone or by post to our registered office. We will acknowledge your complaint within 30 days, look into it without undue delay and tell you the outcome.
If you are not satisfied with our response, you have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk/make-a-complaint.
10. Security
We use appropriate technical and organisational measures to protect your information, including encrypted (HTTPS) connections, access controls, security software and regular backups. No method of transmission over the internet is completely secure, but we work hard to protect your data.
11. Links and embedded content
Our website may link to or embed content from other websites. Those websites have their own privacy policies and we are not responsible for how they handle your information.
12. Children
Our website and services are intended for businesses and organisations and are not aimed at children.
13. Changes to this policy
We may update this policy from time to time. The latest version will always be on this page, with the date it was last updated shown at the top.
