Privacy Policy

1. The data we collect

When you submit our enquiry form, we collect the personal information you choose to provide:

• Full name
• Email address
• Company name (optional)
• Primary goal — the service tier or area of interest you select
• Your consent record — the fact that you ticked the consent checkbox, the date and time of submission, and the exact wording of the consent statement and privacy policy version in force at that moment. We retain this as evidence of valid consent under UK GDPR.
• Founding Client enquiry flag (optional) — if you tick the Founding Client checkbox, we record this as a marketing-intent signal so we can confirm the programme benefits when we follow up.
• Limited technical data— a one-way cryptographic hash of your IP address (never the address itself) and your browser's user-agent string, used solely to stop automated abuse of the form. See section 5.

We do not use cookies, third-party analytics, advertising pixels, or any other tracking technology on this site. Your browser does store a small preference in localStorage to remember your light/dark theme choice and to preserve the state of the embedded chat widget if you use it — neither leaves your device, neither identifies you, and both are exempt from PECR consent requirements as strictly-necessary functional storage.

2. How we use your data (lawful basis)

Under UK GDPR, our lawful basis for processing this information is Article 6(1)(a) — Consent, given by you when you tick the consent checkboxes on our form before submission. Each checkbox covers a separate purpose:

• Privacy Policy checkbox (required): we use your details to respond to your specific service enquiry.
• Email updates checkbox (optional): only if you tick it, we also send you occasional marketing emails about AI-ready web strategy, new services and offers. Leaving it unticked does not affect your enquiry in any way.

You can withdraw your consent at any time by emailing grl.webweaver@gmail.com with the subject "Withdraw consent", or by clicking the "unsubscribe" link in any marketing email we send. Withdrawal does not affect the lawfulness of any processing we carried out before withdrawal.

3. Who processes your data on our behalf (sub-processors)

We do not sell, rent, or share your personal data with third parties for their own marketing purposes. We do use the following trusted service providers to operate our website and contact infrastructure. Each acts as a data processor on our behalf under a Data Processing Agreement (DPA):

Because these providers are based outside the UK, your personal data is subject to an international data transfer. We rely on the UK International Data Transfer Addendum (IDTA) and/or the EU Standard Contractual Clauses (SCCs), both of which are incorporated into each provider's DPA, as the lawful safeguard for those transfers under UK GDPR Article 46.

4. How long we keep your data

We retain personal data submitted through the form for up to 18 months from your last interaction with us (for example, your last form submission, your last email reply, or your last engagement with a marketing email). After this period, your data is deleted from our active records and a deletion request is sent to the sub-processors listed in section 3.

Exceptions: where we are legally required to retain data longer — for example, completed-contract records required by HMRC for tax purposes (typically six years) — we will keep only the minimum necessary, separately from our marketing records.

You can ask us to delete your data sooner at any time by emailing grl.webweaver@gmail.com.

5. How we store and secure your data

Your data is transmitted over encrypted (HTTPS/TLS) connections and processed by the sub-processors listed in section 3. When you submit the contact form, it is received by our own application running on Vercel, stored as a structured record in our Supabase (PostgreSQL) database hosted in the United Kingdom, and used to trigger transactional notification emails sent via Resend. Each of these providers offers industry-standard encryption at rest and in transit, role-based access controls, and recognised security certifications (such as SOC 2 Type II or ISO 27001-equivalent).

Access to the submissions database is restricted to the contact form itself. Our website assistant, which answers questions using a separate knowledge base in the same database, holds credentials that cannot read enquiry records.

Alongside your submission we store a one-way cryptographic hash of your IP address and your browser's user-agent string. We do not store the IP address itself. These are kept under our legitimate interests in preventing automated abuse of the form, and cannot be used to identify you.

Retention.We keep enquiry records for up to 24 months from your last contact with us, after which they are deleted. If your enquiry becomes a client engagement, the relevant records are retained for as long as required for that engagement and any subsequent legal or accounting obligations. You can ask us to delete your record sooner at any time — see section 7.

6. Your data protection rights

Under UK data protection law, you have the following rights:

• Right of access — request a copy of the personal information we hold about you.
• Right to rectification — ask us to correct inaccurate or incomplete data.
• Right to erasure("right to be forgotten") — ask us to delete your personal data.
• Right to restrict processing — ask us to pause processing while we consider a dispute.
• Right to data portability — receive your data in a structured, machine-readable format.
• Right to object — object to processing based on consent or legitimate interests.
• Right to withdraw consent — at any time, with no penalty.

To exercise any of these rights, email grl.webweaver@gmail.com. We will respond within one calendar month of your request, in line with UK GDPR Article 12(3). The first request is free; we may charge a reasonable fee, or refuse to act, only where requests are manifestly unfounded or excessive.

7. Your right to complain to the ICO

If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Helpline: 0303 123 1113

We would, however, appreciate the chance to address your concerns first — please contact us before escalating.

8. Regulatory status

WebWeaver Nexus is currently a pre-launch entity and, at the date of this policy, has not yet received or processed any personal data through this form. On that basis we are currently relying on the Information Commissioner's Office (ICO) data protection fee exemption for organisations that do not process personal data.

We will register with the ICO and pay the applicable data protection fee, under the Data Protection (Charges and Information) Regulations 2018, as soon as we receive our first form submission and begin processing personal data. This policy will be updated at that point with our ICO registration number.

9. Changes to this policy

We may update this policy from time to time as our service evolves or as legal requirements change. The "Last Updated" date at the top of this page will always reflect the current version. Material changes will be communicated by email to anyone who has submitted an enquiry before they take effect.

10. Contact us