Privacy Policy

Last updated: 25 October 2026.

This policy explains how I collect, use and protect your personal information when you visit bennettsdesign.co.uk, get in touch with me or work with me, and what your rights are under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Who I am

I am Chris Bennett, a freelance web designer trading as Bennetts Design, based in Southend-on-Sea, Essex. I am the data controller for the personal information described in this policy, which means I decide how and why it is used.

• Email: teams@bennettsdesign.co.uk
• Phone: 01702 655887 (9am to 5pm, Monday to Friday)
• Location: Southend-on-Sea, Essex, United Kingdom

If you have any question about this policy or how I handle your information, email me and I will be happy to help.

What information I collect and why

When you use the contact form

The contact form on the Contact page collects your name, your email address, the service you are interested in and your message, plus anything else you choose to tell me. The form is built with Contact Form 7. When you send it, the details are emailed to me at teams@bennettsdesign.co.uk. The form plugin does not keep a database copy of your message, so your enquiry is held in my email account.

I use this information only to reply to your enquiry, to give you a quote and to talk with you about a possible project. My lawful basis is legitimate interests (answering the question you asked me), or taking steps at your request before entering into a contract.

When you email or phone me

I keep the emails you send me and any notes I make about our conversation, so I can reply and carry on a discussion. The lawful basis is the same as above.

When you become a client

If we work together I will hold the contact and business details you give me, the content and files you supply for your project, our correspondence, and invoices and payment records. I use these to carry out the work, to look after your website, to invoice you and to keep the financial records that the law requires. My lawful bases are performing our contract and complying with legal obligations, such as tax and accounting rules.

Blog comments

Where comments are switched on for a blog post and you leave one, WordPress stores the name, email address and website you enter, your comment, and your IP address and browser details to help spot spam. Your comment, name and website are shown publicly, but your email address is not. The lawful basis is legitimate interests (running a blog and keeping it free of spam). If WordPress shows profile pictures, it may send an anonymised version of your email address to the Gravatar service to check whether you have one.

Information collected automatically

When you visit the website, my hosting provider’s servers automatically record technical information such as your IP address, the pages you request, the date and time, and your browser and device type. This is needed to deliver the website, keep it secure and fix faults. The lawful basis is legitimate interests.

Google Analytics

This website uses Google Analytics 4 (measurement ID G-RVCB4C9DXP) to give me summary information about how people find and use the site, such as the pages viewed, roughly where visitors are, the type of device used and how long they stay. Google Analytics sets cookies in your browser and collects information such as your IP address and browser details. I use the reports to see what is working and to improve the website. I do not use it to identify you personally, and I do not combine it with other information about you.

Google acts as a service provider for this. Its use of data is described in How Google uses information from sites or apps that use its services. You can stop Google Analytics collecting data about your visits by installing the Google Analytics opt-out browser add-on, by blocking cookies in your browser, or by emailing me if you have a concern.

Google reCAPTCHA

To protect the contact form from spam and abuse, the website uses Google reCAPTCHA v3. It runs in the background and checks how you interact with the page. To do this it may collect your IP address, information about your browser and device, how you move around the page, and cookies, and it sends this to Google. Your use of reCAPTCHA is subject to the Google Privacy Policy and Terms of Service. The lawful basis is legitimate interests (keeping the website and my inbox secure).

Google Fonts

The website loads its typefaces (Sora and Unbounded) from Google Fonts. When a page loads, your browser requests the font files from Google, which means Google receives your IP address and basic browser information.

Cookies

The website uses a small number of cookies and similar technologies, including cookies set by Google Analytics and Google reCAPTCHA. They are described on my Cookies page. You can delete or block cookies in your browser settings at any time, although parts of the website may not work as well if you do.

Hosting and where your information is stored

The website is hosted by a third-party web hosting provider, which also supplies a content delivery network (CDN) so pages load quickly. Website files, server logs and the website’s database are stored on its servers. My email is held by my email provider. These providers process information on my behalf and only under my instructions.

Who I share your information with

I do not sell your personal information and I do not use it for third-party marketing. I only share it with the people and services I need to run the website and my business:

• my hosting provider and CDN, to run and secure the website;
• Google, for Analytics, reCAPTCHA and Google Fonts, as described above;
• my email provider, to receive and send email;
• professional advisers and accounting providers, where needed to meet my legal and tax obligations;
• the police, courts, regulators or other authorities, if the law requires me to.

Transfers outside the UK

Some of the services above, in particular Google, may process information outside the UK, including in the United States. Where that happens I rely on the safeguards that UK law requires, such as the UK-US data bridge, an adequacy decision or standard contractual clauses with the UK addendum, as put in place by the service provider.

How long I keep your information

• Enquiries that do not lead to work: I delete them within 12 months of our last contact.
• Client records and project correspondence: I keep them while we work together and for up to 6 years afterwards, so I can support your website and meet my legal, tax and accounting duties.
• Invoices and financial records: I keep them for at least 6 years, as the law requires.
• Blog comments: I keep them for as long as the post they belong to is published, unless you ask me to remove them.
• Analytics data: Google Analytics keeps data for a limited period, set in my account and never longer than 14 months.

Your rights

Under UK data protection law you have the right to:

• be told how your information is used (this policy does that);
• ask for a copy of the personal information I hold about you;
• ask me to correct anything that is wrong or incomplete;
• ask me to delete your information, in some circumstances;
• ask me to restrict how I use your information, in some circumstances;
• ask me to give you your information in a portable format, in some circumstances;
• object to me using your information where I rely on legitimate interests;
• withdraw your consent at any time, where I rely on consent;
• not be subject to a decision based only on automated processing. I do not make decisions like this.

To use any of these rights, email teams@bennettsdesign.co.uk. I will reply within one month and there is normally no charge. I may need to check your identity first, to make sure I do not share your information with the wrong person.

Keeping your information safe

The website is served over HTTPS, I keep WordPress, its plugins and the theme up to date, and I limit access to your information to what is needed. No method of sending information over the internet is completely secure, so please do not send sensitive information such as card numbers or passwords by email or through the contact form.

Children

This website is for businesses and adults. It is not aimed at children and I do not knowingly collect their personal information.

Links to other websites

The website may link to other sites, such as my clients’ websites. I am not responsible for their content or privacy practices, so please read their policies.

Changes to this policy

I may update this policy from time to time. The date at the top shows when it was last changed.

Complaints

If you are unhappy with how I have handled your information, please contact me first so I can put it right. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK data protection regulator:

• Website: ico.org.uk/make-a-complaint
• Helpline: 0303 123 1113
• Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF