Privacy Policy

This Privacy Policy explains how Henderson Web Co Ltd trading as Henderson Web ("we", "us", "our") collects and uses personal data when you visit our website, contact us, request a mock-up, enquire about services, become a client, or otherwise interact with us.

Who we are

Legal identity: Henderson Web Co Ltd, registered in England and Wales
Trading name: Henderson Web
Registered office: 28 Henley Drive, Timperley, Altrincham, WA15 6RY
Email: privacy@hendersonweb.co.uk
Telephone: +44 7943 393502
Company number: 17307808
VAT: Not VAT registered, no VAT is charged

For the personal data covered by this Privacy Policy, we are the controller.

If we host, support or technically manage a website for a client and process that client's website-user data on the client's instructions, we usually act as that client's processor, and the client is the controller for that processing. That processing is governed by our contract with the client, not primarily by this Privacy Policy.

The categories of personal data we collect

We may collect and use the following categories of personal data:
• identity and contact data, such as your name, business name, email address, telephone number, postal address and job title;
• enquiry and project data, such as your trade, service area, existing website, goals, preferences, project brief, quoted scope and communications with us;
• account, billing and transaction data, such as invoices, payment status, subscription details, mandate references and correspondence about payment;
• technical and usage data, such as IP address, browser type, device information, page views, referring URLs, form events and general analytics data;
• support and service data, including tickets, requests, revision notes, credentials supplied to us and operational communications;
• marketing preferences, consent records and suppression-list data;
• portfolio/publicity permissions and confidentiality flags; and
• any other personal data you choose to send us.

We do not intentionally seek special category personal data. Please do not send it unless it is strictly necessary and we have agreed a lawful basis and handling method in advance.

How we collect personal data

We collect personal data:
• directly from you when you fill in forms, request a mock-up, submit a project brief, email, call, message or contract with us;
• automatically through cookies and similar tools where these are permitted or consented to;
• from payment processors and service platforms where necessary for billing, fraud prevention or service administration;
• from publicly available business sources, such as your business website or social profiles, where relevant to preparing a mock-up or quote; and
• from our clients where they provide us with contact details for authorised project contacts.

Purposes and lawful bases

We use personal data for the following purposes and lawful bases:
• To respond to enquiries, assess projects, provide mock-ups and take steps before contract. Lawful basis: contract, where the enquiry relates to entering into a contract with you, or legitimate interests where the contact is a business enquiry.
• To provide contracted services and administer client accounts. Lawful basis: contract. This includes project delivery, implementation, hosting, support, billing and account management.
• To maintain accounting, tax and legal records, deal with disputes and defend claims. Lawful basis: legal obligation and legitimate interests.
• To operate, secure and improve our website and services. Lawful basis: legitimate interests, except where consent is required for non-essential cookies or similar technologies.
• To send direct marketing. For email or text marketing to individuals, we rely on consent or soft opt-in where lawfully available. For corporate subscribers and some business contacts, we may rely on legitimate interests where PECR permits, while always providing an opt-out.
• To publish client names, logos or screenshots in our portfolio. Lawful basis: legitimate interests, unless we agree confidentiality restrictions or you object on overriding grounds.

Who we share personal data with

We may share personal data, where necessary, with:
• hosting and infrastructure providers;
• registrar, DNS, email and communications providers;
• cloud storage, backup and monitoring providers;
• payment processors and billing platforms;
• subcontractors and professional advisers;
• analytics, advertising and consent-management providers, where enabled; and
• courts, regulators, law enforcement or tax authorities where required by law or reasonably necessary to protect our rights.

We require processors acting for us to provide sufficient guarantees of compliance and security, and we put contractual protections in place where required.

International transfers

Some of our providers may process personal data outside the UK. Where that happens, we assess the transfer position and use lawful transfer mechanisms under UK data protection law, such as adequacy regulations or approved contractual safeguards where required.

Security

We take appropriate technical and organisational measures to protect personal data, taking into account the nature, scope, context and purpose of processing and the risks to individuals. Measures may include access controls, role-based permissions, strong passwords, encryption where appropriate, patching, backups, secure transmission, provider due diligence and incident response procedures.

Retention

We keep personal data only for as long as reasonably necessary for the relevant purpose, including to satisfy legal, accounting and dispute requirements. Our default retention approach is:
• website enquiries and mock-up enquiries: up to 24 months after last meaningful contact;
• active client records: for the duration of the relationship and 6 years thereafter;
• invoices, payment records and tax records: 6 years (or as required by HMRC for our business structure);
• support requests and operational logs: between 12 months and 6 years depending on purpose;
• analytics data: the retention period set in the relevant analytics tool;
• suppression-list / opt-out records: for as long as necessary to honour the opt-out.

After these periods, data is securely deleted or anonymised, unless we are required to keep it longer for legal, tax or dispute reasons.

Cookies and similar technologies

We use cookies and similar technologies for:
• strictly necessary website functions;
• analytics and performance measurement; and
• where applicable, marketing or embedded content functionality.

We do not set non-essential cookies unless and until we have a lawful consent mechanism in place and you have positively opted in. You can change your settings through our cookie controls where available.

Cookie categories

Strictly necessary cookies, used for security, load balancing, session continuity and essential form/consent functions. These do not require consent where they are genuinely necessary.

Analytics cookies, used to understand traffic, form completion, device/browser trends and website performance. These require consent where they are not strictly necessary.

Marketing / embedded-content cookies, used by advertising pixels, retargeting tools or some embedded third-party media. These require consent.

Marketing communications

If you opt in to receive marketing from us, we may send you service updates, offers, legal/compliance updates or related business content. You can unsubscribe at any time by using the unsubscribe link, replying STOP where available, or contacting us using the details above.

We maintain suppression records to ensure we respect opt-outs.

Your rights

Depending on the circumstances, you may have the right to:
• access your personal data;
• request rectification of inaccurate or incomplete data;
• request erasure;
• request restriction of processing;
• object to processing based on legitimate interests;
• withdraw consent where processing relies on consent;
• request data portability; and
• complain to the ICO.

The rights available depend on the lawful basis and the circumstances of the processing. Where we rely on legitimate interests, your right to object will be brought to your attention clearly.

How to exercise your rights

Please contact privacy@hendersonweb.co.uk with enough information for us to identify you and the request. We may ask for proof of identity where reasonably necessary.

We will usually respond within one month, although that period may be extended where the law permits for complex requests.

Children

Our services are aimed at businesses and business contacts. Our website is not directed at children. If you believe a child has provided personal data to us inappropriately, please contact us.

Complaints

If you have any concern about how we handle personal data, please contact us first so we can investigate.

You also have the right to complain to the Information Commissioner's Office at ico.org.uk.

Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in law, guidance, technology or our processing practices. The latest version will always be posted on our website with the updated date shown at the top.