Privacy policy

Last updated: 14 September 2026. If we make a material change to this policy we will update this date, and we will email clients directly if the change affects them.

Who we are

Greensand Web Services builds and maintains websites for small businesses across the UK. We are the data controller for the information described in this policy.

You can reach us at hello@greensandweb.co.uk or via our contact form, and that is also the route to use for any request about your data.

Two different roles, and why it matters

We handle personal information in two separate ways, and the rules that apply are not the same for both.

As a controller. When you send us an enquiry, become a client, or email us, we decide what happens to that information. This policy covers that.

As a processor. When we host a client's website, that website may collect information about its own visitors, through a contact form or similar. We hold that data on our client's behalf and act on their instructions. We do not decide what it is used for and we do not use it for our own purposes. If you filled in a form on a site we host and want to know what happens to your details, the business that owns that site is the right people to ask, and their own privacy policy applies.

What we collect and why

Information	Where it comes from	Why we have it	Lawful basis
Name, business name, email address, and whatever you write in the message box	Our contact form, or you emailing or messaging us	To answer you, work out whether we can help and quote a price	Legitimate interests: responding to someone who has asked us to
Contact details, billing details, and the content you send us for your website	Clients, during a build and afterwards	To build and maintain your site, take payment, and provide support	Performance of a contract
Payment records and invoices	Our payment provider, and our own records	Accounting, tax and dealing with any dispute	Legal obligation, and legitimate interests
Server logs, including IP addresses and pages requested	Automatically, when anyone visits our site	Keeping the site running, investigating problems, and blocking abuse	Legitimate interests: security and reliability
Analytics and advertising conversion data	Cookies, only after you accept them via our cookie banner	Seeing which pages are useful and whether our advertising is working	Consent

We do not collect special category data, we do not knowingly collect information about children, and we do not buy contact lists.

Cookies and tracking

Our website uses a small number of strictly necessary cookies to function, which do not require consent. Beyond that, we may use analytics and advertising conversion cookies, for example to see whether a Google Ads campaign led to an enquiry.

These non-essential cookies only load after you accept them through the cookie banner shown when you first visit. If you choose "necessary only," no analytics or advertising cookies are set, and the site works exactly the same either way. You can change your choice at any time by clearing your browser's cookies for this site, which will show the banner again.

We do not run cookies that track you across other, unrelated websites, and we do not sell or share cookie data with anyone beyond the analytics or advertising platform itself, and then only in aggregate, anonymised form.

Websites we build for clients may use different cookies depending on what the client has asked for. That is covered by their own policy, not this one.

Who we share information with

We do not sell personal data, and we do not share it for anyone else's marketing.

We do use a small number of suppliers to run the business, and information passes through them:

• Hosting providers, who store the websites and any data on them
• Email providers, who carry our correspondence with you
• A payment provider, who handles subscriptions. We do not see or store your full bank or card details
• Domain registrars, where we register a domain on your behalf
• An accountant, for our own bookkeeping and tax
• An analytics or advertising platform, only where you have accepted non-essential cookies

Each of these is bound to keep the information confidential and to use it only for the purpose we engaged them for. We will also disclose information where the law requires it, for example to HMRC or in response to a valid court order.

Information leaving the UK

Some of our suppliers operate outside the United Kingdom. Where personal data is transferred abroad, we rely on either an adequacy decision covering the destination country, or on contractual safeguards approved for use under UK data protection law. We prefer UK or EU hosting for client websites and will use it wherever it is available.

How long we keep things

• Enquiries that do not become clients: up to 12 months, then deleted
• Client records and correspondence: for the life of the contract and 6 years afterwards, which is how long we may need them if a dispute arises
• Invoices and accounting records: 6 years after the end of the relevant financial year, as tax law requires
• Website backups: on a rolling basis, typically 30 days, after which older copies are overwritten
• Server logs: normally 30 to 90 days
• Cookie consent choices: stored in your browser until you clear it, not on our servers

Keeping it safe

We use encrypted connections, keep software patched, restrict access to the two of us, use multi-factor authentication on the accounts that support it, and take regular backups. No system is completely secure, and we will not pretend otherwise, but if a breach occurred that was likely to put your rights at risk we would tell you and report it to the Information Commissioner's Office within 72 hours as required.

Your rights

Under UK data protection law you can ask us to:

• Give you a copy of the personal data we hold about you
• Correct anything that is wrong or incomplete
• Delete data, where we do not have a legal reason to keep it
• Restrict what we do with it while a query is sorted out
• Provide it in a portable format, where it was given to us and is held electronically
• Stop processing based on legitimate interests, where you object
• Withdraw consent at any time, where consent was the basis we relied on, including for cookies

Email hello@greensandweb.co.uk and we will deal with it within one month. There is no charge. We may ask you to confirm who you are first, so that we are not handing someone's data to the wrong person.

If you are unhappy with how we have handled something, please tell us and we will try to put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113, and you do not have to raise it with us first.

Marketing

We do not run a mailing list and we do not send marketing emails to people who have enquired. If that ever changes, we will ask you to opt in rather than assume, and every message will have a working unsubscribe link.

Changes to this policy

We will update this page if our practices change. Continuing to use the site after a change means the current version applies, but if the change materially affects clients we will email them rather than rely on them noticing.