Privacy & Cookies

Last updated: 12 October 2026 · how we handle your personal data under UK GDPR and the Data Protection Act 2018.

1. Who we are

Blackpool Web Design (“we”, “us”), of Blackpool Enterprise Centre, Lytham Road, Blackpool, Lancashire FY4 1EW, is the “data controller” for the personal data described here. Questions or requests: [email protected] or WhatsApp.

2. What we collect

• Enquiry & sign-up details - name, business name, email, phone/WhatsApp number, and the answers you give in your website brief.
• Billing details - billing address and payment records. Card details are entered directly into Stripe and stored by them as a secure token; we do not store or see your full card number.
• Account & project data - your domain, hosting details, logins you choose to share with us, and correspondence (email, WhatsApp, tickets).
• Website analytics - anonymous, cookieless usage data from our own site (see analytics & cookies below).
• Live chat messages - what you type into the chat window, the page you were on, and any name or email you choose to give us (see live chat below).

3. Why we use it & our legal basis

4. Who we share it with

We only share data with the providers we need to run the service, each under their own data-protection terms:

• Stripe - payment processing and secure card storage.
• WHMCS - our billing and client-account system.
• Our own servers - your website runs on hardware we manage ourselves from Blackpool, in an enterprise datacentre in northern France with UK edge servers via our CDN. The UK and EU formally recognise each other's data-protection rules (adequacy), so this does not change your UK GDPR position. More on where your site lives.
• ENOM - domain registration and management.
• Email and messaging tools we use to support you.

We never sell your personal data. We may disclose data if required by law.

5. How long we keep it

We keep your account and project data while you're a client and for a reasonable period afterwards. Financial records are kept for at least 6 years to meet UK tax rules. Enquiry data that doesn't become an account is deleted once it's no longer needed.

6. Your rights

Under UK data-protection law you can ask to access, correct, delete or restrict your personal data, object to certain processing, or receive a copy to take elsewhere. Email [email protected] and we'll respond within one month. You can also complain to the Information Commissioner's Office (ICO), though we'd rather sort any concern with you first.

7. Analytics, live chat & cookies

We use Matomo, a privacy-friendly analytics tool that we host ourselves, to see which pages are visited and where visitors come from. It runs in cookieless mode: it sets no cookies and stores nothing on your device, your IP address is anonymised before it's stored, and nothing is shared with or sent to any third party. Because it can't identify or follow you - here or anywhere else - UK cookie rules (PECR) don't require a consent banner for it, which is why you won't see one. If your browser sends a “Do Not Track” signal, we honour it and don't record your visit at all.

The site itself uses only essential cookies - the ones needed for sign-up and checkout to work, which can't be switched off. You can control or delete cookies in your browser settings. Note that the checkout uses Stripe, which sets its own cookies to process payments and prevent fraud.

Our live chat runs on Chatwoot, which - like our analytics - we host ourselves on our own server. Your messages are not sent to a third-party chat provider, and nothing you type is used for advertising. The chat does store a small identifier on your device so your conversation survives moving between pages; that's strictly necessary for a chat you asked to start, which is why it needs no consent banner under PECR. We keep chat conversations for 12 months and then delete them automatically. If you'd rather not use it, WhatsApp and email reach the same person.

8. Your customers' data

Where we build a website that collects data from your customers (enquiry forms, bookings, shop orders), you are the data controller for that information and responsible for your own privacy policy. We act as your processor and will help you set this up.

9. Contacting local businesses

Now and then we design a homepage concept for a local business whose website we think we could improve, and send it to them by post, and by email or text message to limited companies and LLPs only (never sole traders or partnerships). A text only goes to a mobile number the business lists publicly on Google. To do this we use publicly available information: the business’s Google Maps listing (name, address, phone, opening hours, price level, reviews and photos), its Companies House record (company name and number, directors and when they were appointed, filing status and accounts type), its own website, the date its web address was registered (from the public domain registry), where it appears in our Google searches, and a website check we run on it. We use this to decide which businesses to contact first and to address them by name.

When a concept is viewed we record the visit: the date and time, the type of device, the approximate town (worked out from the internet address, which is not stored), how long the page was open and how far it was scrolled. No cookies are used.

Our legal basis is legitimate interests: offering a relevant service to a local business. Concepts are designed with help from AI services (Anthropic’s Claude and Google’s Gemini), website checks use Google PageSpeed, postcards are printed and posted by Stannp, and text messages are sent by Twilio. Each processes the data on our behalf. If you reply to one of our emails or texts, we read the reply (with help from Claude to sort it) so we can answer you or stop contacting you.

We delete the concept, the visit records and everything collected for it 90 days after we contact a business, unless they reply and we’re talking. To opt out at any time, use the “Remove my business” link on the concept, reply “no thanks” to an email, text STOP, or email [email protected]. We’ll add you to a do-not-contact list (business name, website, email and phone number only), which we keep so we never contact you again. More detail: how I found you.

10. Changes

We may update this policy from time to time; the “last updated” date above shows when. Material changes will be notified to active clients.

11. Contact

Any privacy question: [email protected] or WhatsApp us.

Common privacy questions