Privacy Policy

Last updated: 31 August 2026

1. Who we are

West Cumbria Websites provides website design, development, hosting and support services. West Cumbria Websites is the controller responsible for the personal information described in this policy.

You can contact us at:

• Email: hello@westcumbriawebsites.co.uk
• Telephone: +44 7598 478868
• Location: Workington, Cumbria, United Kingdom

2. Information we collect

We may collect personal information when you contact us, request a quote, submit a website form, complete a Facebook or Instagram lead form, use a Google Form provided by us, become a customer or otherwise communicate with us.

This information may include:

• Your name, email address and telephone number.
• Your business name, business type and website or social media address.
• The name or business name of a customer who referred you, where you choose to provide it.
• Information about the website or service you require, your preferred timescale and your plan preference.
• The content of messages, enquiries and other correspondence.
• Customer, project, payment and transaction records where you purchase services from us.
• Direct Debit information such as payer details, mandate reference and status, collection status, payment history and limited bank-account identifiers supplied by our payment provider.
• Technical and security information such as your IP address, browser information, request time and reCAPTCHA verification data.

3. Where we obtain information

Most personal information is provided directly by you. We may also receive information from:

• Meta when you submit a lead form through Facebook or Instagram.
• Google when you submit a Google Form provided by us.
• Our website hosting, email and security providers.
• Our payment provider and the banks involved in setting up or operating a Direct Debit.
• Public business websites or directories where it is lawful and relevant to a business enquiry.

4. How we use your information

We use personal information to:

• Respond to enquiries and provide quotations.
• Discuss, prepare and enter into a contract with you.
• Design, deliver, host, maintain and support customer websites.
• Manage customer accounts, payments and business records.
• Set up and administer Direct Debit mandates, collect recurring charges, process refunds and deal with failed or disputed payments.
• Record and administer referral discounts.
• Provide customer service and communicate about active or previous projects.
• Prevent spam, fraud, misuse and security incidents.
• Meet legal, tax, accounting and regulatory obligations.
• Send marketing communications only where we have the necessary permission or are otherwise permitted by law.

Information submitted through a Facebook or Instagram lead form will be used to respond to the website-service enquiry described in the advert. We will not sell this information or use it for an unrelated purpose without an appropriate lawful basis.

5. Our lawful bases

Depending on the circumstances, we rely on one or more of the following lawful bases under UK data protection law:

• Contract: to take steps at your request before entering into a contract and to provide services under a contract.
• Legitimate interests: to respond to business enquiries, operate and improve our services, support customers, maintain appropriate records and protect our website and business. We consider and balance these interests against your rights.
• Legal obligation: to meet tax, accounting, legal and regulatory requirements.
• Consent: where consent is required, including certain marketing communications and non-essential online tracking. You may withdraw consent at any time.

6. Direct Debit and payment information

Where you choose or are required under your service agreement to pay by Direct Debit, our payment provider and the banks involved process the information needed to create and operate the mandate. This may include the payer's name and contact details, bank-account and sort-code information, mandate details, payment amounts and dates, and information about successful, failed, cancelled or refunded collections.

Bank details are normally entered into the payment provider's secure service rather than sent through our general website contact form. We generally receive the information needed to manage your customer account, such as a mandate reference and status, payment events, payer details and limited account identifiers. We do not receive your online-banking password or security credentials.

We use this information because it is necessary to take payment and perform our contract with you, to maintain accounting and tax records, and where necessary for our legitimate interests in preventing fraud and recovering amounts due. The payment provider may act as our processor and may also process some information as a controller under its own privacy notice.

Providing the information required for a Direct Debit is necessary if Direct Debit is the agreed payment method. If it is not provided or the mandate is cancelled, we may be unable to start or continue the relevant service unless another payment method is agreed.

7. Facebook and Instagram lead forms

If you submit an enquiry through a Facebook or Instagram lead form, Meta initially collects the information and makes it available to us. Meta also processes information under its own privacy policy. We use the lead information only for the purposes explained when the form is presented, such as contacting you about a website quotation or consultation.

For more information about Meta's processing, read the Meta Privacy Policy.

8. Google services and reCAPTCHA

Our contact page uses Google reCAPTCHA v3 to help distinguish genuine enquiries from automated spam. reCAPTCHA may collect technical information and analyse how a visitor interacts with the page. Google's processing is governed by the Google Privacy Policy and Google Terms of Service.

If we provide a Google Form for an enquiry, Google processes the information used to provide that form. We receive the answers you choose to submit and use them as described in this policy.

9. Cookies and similar technologies

We do not currently use Meta Pixel, Google Analytics or similar advertising analytics tools on this website. Our contact page uses reCAPTCHA v3, which may use cookies or similar technologies for security and fraud prevention.

If we introduce non-essential analytics or advertising technologies in the future, we will update this policy and request consent where required by law.

10. Who we share information with

We may share personal information only where necessary with:

• Website hosting, email, cloud storage, form and security providers.
• Meta where its lead advertising services are used.
• Google where reCAPTCHA or Google Forms are used.
• Direct Debit and payment providers, banks, accounting services and professional advisers where required.
• Contractors or service providers working for us under appropriate confidentiality and data protection obligations.
• Regulators, courts, law-enforcement bodies or other parties where disclosure is required by law or necessary to protect legal rights.

We do not sell personal information.

11. International data transfers

Some service providers, including Meta, Google and a payment provider, may process information outside the United Kingdom. Where UK data protection law applies to a restricted transfer, we take reasonable steps to ensure that an appropriate safeguard or other lawful transfer mechanism is used. Information about the safeguards used by those providers is available in their respective privacy documentation.

12. How long we retain information

We retain information only for as long as reasonably necessary for the purpose for which it was collected:

• General enquiries and unconverted leads: normally up to 24 months after the last meaningful contact.
• Customer and project records: for the duration of the relationship and normally up to six years afterwards where needed for tax, accounting, contract or legal purposes.
• Direct Debit mandate and payment records: for the duration of the customer relationship and normally up to six years afterwards where needed for payment, accounting, tax, dispute or legal purposes. A payment provider or bank may apply its own retention period.
• Security and server logs: normally up to 90 days, unless they are required for investigating an incident or meeting a legal obligation.
• Marketing information based on consent: until you withdraw consent or the information is no longer needed.

We may retain limited information for longer where the law requires it or where it is necessary to establish, exercise or defend legal claims.

13. How we protect information

We use reasonable technical and organisational measures designed to protect personal information against unauthorised access, alteration, disclosure, accidental loss or destruction. Access is restricted to people and service providers who need the information for a legitimate business purpose.

14. Your rights

Depending on the circumstances, you may have the right to:

• Request access to your personal information.
• Ask us to correct inaccurate or incomplete information.
• Ask us to erase information.
• Ask us to restrict how information is used.
• Receive certain information in a portable format.
• Withdraw consent at any time where processing is based on consent.

To exercise a right, email hello@westcumbriawebsites.co.uk. We may need to confirm your identity before completing a request.

15. Complaints

Please contact us first if you have a concern so we can try to resolve it. You also have the right to complain to the Information Commissioner's Office, the United Kingdom's data protection regulator.

Visit the ICO complaints page or telephone 0303 123 1113.

16. Automated decision-making

We do not make decisions that produce legal or similarly significant effects solely by automated means. Google reCAPTCHA may automatically assess whether a website interaction appears to be spam, but it is used only to protect the contact form.

17. Changes to this policy

We may update this policy when our services, providers or legal obligations change. The latest version will be published on this page and identified by the date shown above.