Home › Privacy policy
Privacy policy
What we collect, why we collect it, and what you can ask us to do with it.
Last updated: 22 October 2026. If we make a material change to this policy we will update this date, and we will email clients directly if the change affects them.
Who we are
Greensand Web Services builds and maintains websites for small businesses across the UK. Greensand Web Services Ltd is a private limited company registered in England and Wales, company number 17106182. Registered office: 22 South Road, Sandy, England, SG19 1HE. We are the data controller for the information described in this policy, and we are registered with the Information Commissioner's Office under registration number ZC255204.
You can reach us at hello@greensandweb.co.uk or via our contact form, and that is also the route to use for any request about your data.
Two different roles, and why it matters
We handle personal information in two separate ways, and the rules that apply are not the same for both.
As a controller. When you send us an enquiry, become a client, or email us, we decide what happens to that information. This policy covers that.
As a processor. When we host a client's website, that website may collect information about its own visitors, through a contact form or similar. We hold that data on our client's behalf and act on their instructions. We do not decide what it is used for and we do not use it for our own purposes. If you filled in a form on a site we host and want to know what happens to your details, the business that owns that site is the right people to ask, and their own privacy policy applies.
What we collect and why
| Information | Where it comes from | Why we have it | Lawful basis |
|---|---|---|---|
| Name, business name, email address, whatever you write in the message box, and the date, time, IP address and browser it was sent from, which helps us spot spam | Our contact form, or you emailing or messaging us | To answer you, work out whether we can help and quote a price | Legitimate interests: responding to someone who has asked us to |
| Contact details, billing details, the content you send us for your website, and publicly available information about your business that we use to write your website text, plus a record of when you accepted our terms, including the IP address and browser you used | Clients, during a build and afterwards, and public sources such as your existing website, Google Business Profile or social media pages | To build and maintain your site, take payment, and provide support | Performance of a contract |
| Payment records and invoices | Our payment provider, and our own records | Accounting, tax and dealing with any dispute | Legal obligation, and legitimate interests |
| Server logs, including IP addresses and pages requested | Automatically, when anyone visits our site | Keeping the site running, investigating problems, and blocking abuse | Legitimate interests: security and reliability |
| Analytics and advertising conversion data | Cookies, only after you accept them via our cookie banner | Seeing which pages are useful and whether our advertising is working | Consent |
We do not collect special category data, we do not knowingly collect information about children, and we do not buy contact lists.
You do not have to give us any information. Without your name and email address we cannot reply to an enquiry, and without the details we ask clients for we cannot build a website or take the subscription. We do not make decisions about anyone using purely automated means, and we do not profile people.
Cookies and tracking
Our website uses a small number of strictly necessary cookies to function, which do not require consent. Beyond that, we use Google Analytics to see which pages are useful, and Google Ads conversion tracking to see whether an advert led to an enquiry. Both are provided by Google.
These non-essential cookies only load after you accept them through the cookie banner shown when you first visit. If you choose "necessary only," no analytics or advertising cookies are set, and the site works exactly the same either way. You can change your choice at any time using the cookie settings link, or by clearing your browser's storage for this site, which will show the banner again.
We do not run cookies that track you across other, unrelated websites, and we do not sell or share cookie data with anyone beyond Google itself for the analytics and advertising described above, and the reports we see are aggregated rather than about you as an individual. If you have accepted cookies and you send us an enquiry after clicking one of our adverts, we also give Google a scrambled (hashed) version of your email address, so that Google can confirm the advert led to an enquiry. The scrambling is one-way, so the address cannot be read from it, and Google uses it only for measuring our adverts. This is known as enhanced conversions, and it never happens if you choose "necessary only". You can read how Google uses this data at policies.google.com/technologies/partner-sites.
Websites we build for clients may use different cookies depending on what the client has asked for. That is covered by their own policy, not this one.
Who we share information with
We do not sell personal data, and we do not share it for anyone else's marketing.
We do use a small number of suppliers to run the business, and information passes through them:
- Hosting providers, who store the websites and any data on them
- Email providers, who carry our correspondence with you
- A payment provider, who handles subscriptions. We do not see or store your full bank or card details
- Domain registrars, where we register a domain on your behalf
- Software and online service providers we use to design, build and write websites, which may process the information you give us about your business
- An accountant, for our own bookkeeping and tax
- Google, for Google Analytics and Google Ads, only where you have accepted non-essential cookies
- Google Fonts, which supplies the typeface our pages use. Your browser fetches it from Google, which means Google receives your IP address. It does not set cookies, and we rely on legitimate interests: displaying the site properly
Each of these is bound to keep the information confidential and to use it only for the purpose we engaged them for. We will also disclose information where the law requires it, for example to HMRC or in response to a valid court order.
Information leaving the UK
Some of our suppliers operate outside the United Kingdom. Where personal data is transferred abroad, we rely on either an adequacy decision covering the destination country, or on contractual safeguards approved for use under UK data protection law. Google may process analytics and advertising data in the United States, under the UK Extension to the EU-US Data Privacy Framework and Google's own contractual safeguards. We prefer UK or EU hosting for client websites and will use it wherever it is available.
How long we keep things
- Enquiries that do not become clients: up to 12 months, then deleted
- Client records and correspondence: for the life of the contract and 6 years afterwards, which is how long we may need them if a dispute arises
- Invoices and accounting records: 6 years after the end of the relevant financial year, as tax law requires
- Website backups: on a rolling basis, typically 30 days, after which older copies are overwritten
- Server logs: normally 30 to 90 days
- Cookie consent choices: stored in your browser until you clear it, not on our servers
Keeping it safe
We use encrypted connections, keep software patched, restrict access to the two of us, use multi-factor authentication on the accounts that support it, and take regular backups. No system is completely secure, and we will not pretend otherwise, but if a breach occurred that was likely to put your rights at risk we would tell you and report it to the Information Commissioner's Office within 72 hours as required.
Your rights
Under UK data protection law you can ask us to:
- Give you a copy of the personal data we hold about you
- Correct anything that is wrong or incomplete
- Delete data, where we do not have a legal reason to keep it
- Restrict what we do with it while a query is sorted out
- Provide it in a portable format, where it was given to us and is held electronically
- Stop processing based on legitimate interests, where you object
- Withdraw consent at any time, where consent was the basis we relied on, including for cookies
Email hello@greensandweb.co.uk and we will deal with it within one month. There is no charge. We may ask you to confirm who you are first, so that we are not handing someone's data to the wrong person.
If you are unhappy with how we have handled something, please tell us and we will try to put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113, and you do not have to raise it with us first.
Marketing
We do not run a mailing list and we do not send marketing emails to people who have enquired. If that ever changes, we will ask you to opt in rather than assume, and every message will have a working unsubscribe link.
Changes to this policy
We will update this page if our practices change. Continuing to use the site after a change means the current version applies, but if the change materially affects clients we will email them rather than rely on them noticing.