Privacy policy

1. Who We Are

SR7 Web Design is the trading name of George Metcalf, a sole trader based in Seaham, County Durham. We can be contacted at info@sr7webdesign.co.uk or on 0191 722 1678.

We are committed to protecting your personal data and complying with UK GDPR and the Data Protection Act 2018.

2. What Data We Collect

When you use our website or contact us, we may collect:

• Your name, email address, and phone number (via contact forms)
• Your business name and website URL
• Message content you submit through our forms
• Technical data including IP address, browser type, and pages visited (via analytics)
• Cookie data (see our Cookie Policy)
• Publicly available business details, if we contact your organisation about our services (see section 11)
• The details you send through our enquiry forms on Facebook or Instagram (see section 12)

3. How We Use Your Data

We use your personal data to:

• Respond to your enquiries and provide our services
• Send project-related communications
• Issue invoices and manage payments
• Improve our website and services
• Comply with legal obligations

We may send relevant business-to-business marketing to limited companies and LLPs where permitted by law. We do not send unsolicited marketing emails to consumers, sole traders or partnerships treated as individual subscribers under PECR unless they have consented or another valid exception applies. Section 11 explains our business-prospecting activity.

4. Legal Basis for Processing

We process your data under the following lawful bases:

• Contract: To fulfil services you have requested
• Legitimate interests: To respond to enquiries, improve our services, and contact limited companies and LLPs about our services (see section 11)
• Legal obligation: Where required by law (e.g. tax records)
• Consent: Where you have given explicit consent (e.g. marketing emails)

5. Data Sharing

We do not sell your personal data. We may share it with:

• Hosting providers (for website infrastructure)
• Email service providers (for communications)
• Accountants (for financial obligations)
• The email and software providers named in section 11, for business prospecting

All third parties are required to keep your data secure and only process it as instructed.

6. Data Retention

We retain your personal data only as long as necessary. Enquiry data is kept for up to 2 years. Financial records are normally kept for up to 7 years to meet our tax and accounting obligations.

7. Your Rights

Depending on the circumstances and the lawful basis used, your rights under UK GDPR may include:

• Access the data we hold about you
• Correct inaccurate data
• Request deletion of your data
• Restrict or object to processing
• Data portability
• Withdraw consent at any time

To exercise any of these rights, contact us at info@sr7webdesign.co.uk. You also have the right to lodge a complaint with the ICO (ico.org.uk).

8. Security

We take reasonable technical and organisational measures to protect your data from unauthorised access, loss, or disclosure. Our website uses SSL encryption.

9. Changes to This Policy

We may update this policy from time to time. The current version will always be available on this page with the date it was last updated.

10. Contact

For any privacy-related queries: info@sr7webdesign.co.uk · 0191 722 1678

11. Business prospecting

From time to time, we contact limited companies and LLPs whose websites we believe we could genuinely improve. We may use a published general business address or the business contact details of a person working for that organisation. Where a named person’s details are used, we process that personal data under UK GDPR as explained below.

We do not send unsolicited marketing emails to sole traders or partnerships treated as individual subscribers under PECR unless they have consented or the soft opt-in applies.

How we tell you. Our first email to your organisation includes a link to this privacy policy, so this information is provided when we first contact you.

Where the details come from. The organisation’s Google Maps listing, its own website (for the business email address and contact details it publishes), and the public Companies House register (to confirm it is an active registered company).

What we keep. The business name, address, phone number and website; the business email address we use, which may be a named person’s work address; the results of our checks on the website (for example Google PageSpeed scores and screenshots); and a record of any messages between us.

Lawful basis. Legitimate interests, namely SR7 Web Design’s interest in offering its services to organisations that may need them. We keep this proportionate: limited companies and LLPs only, business contact details only, normally one introductory email and no more than one relevant follow-up, and every message says where we found the details and how to stop further contact.

Your right to object. Reply “no” to any message, use the unsubscribe link at the bottom of it, or email info@sr7webdesign.co.uk, and we will stop.

Who handles the data for us.

• Mailforge (Salesforge OÜ, Estonia) provides the separate SR7 Web Design mailbox (sr7webdesign.uk) that sends our prospecting emails and receives replies.
• Railway runs our prospecting software, on servers in the Netherlands.
• Supabase holds the software’s database, on servers in Ireland.
• Anthropic provides an AI service that reviews website screenshots and content and helps draft messages. It receives business names, addresses, phone numbers and website content, not email addresses. Every message is checked and approved by us before it is sent.

Some service providers may process data outside the UK. Where required, we rely on UK adequacy regulations or approved contractual safeguards, such as the UK International Data Transfer Agreement or the UK Addendum. Contact us for further information about the safeguard relevant to a particular provider.

Automated checks. Our software checks websites and helps us decide which organisations might benefit from our services. This only affects who we might contact; no decision with legal or similarly significant effects is made about anyone automatically.

If you ask for a report. If you ask us for a write-up of your website, we use your details to send that report only. Asking for it does not sign you up to anything else.

How long we keep it. If there is no response, the prospecting record is deleted no later than 12 months after our last message. When the full prospecting record is deleted, we may retain only the email address and company website on a suppression list. This prevents us from repeatedly contacting the same organisation and ensures that anyone who objects is not contacted again. Suppression entries are kept while we conduct business prospecting and are reviewed periodically. Details of organisations we find but never contact are deleted within 12 months of being found. If you reply and want to talk, your details move to our enquiry records and section 6 applies.

12. Facebook and Instagram enquiry forms

Some of our adverts on Facebook and Instagram include an enquiry form. If you fill one in, Meta passes us the details you submit: your name, email address, phone number and your answers to the form’s questions.

How we use them. Only to reply to your enquiry and, if you go ahead, to provide our services. Asking for a quote does not add you to a mailing list.

Lawful basis. Legitimate interests: responding to an enquiry you chose to send us.

Where they are kept. We download your details from Meta’s lead tools and keep them with our other enquiries, for up to 2 years as set out in section 6.

Meta’s role. Meta Platforms Ireland Limited runs Facebook and Instagram and handles its own use of the information you give it under Meta’s Privacy Policy.

Your rights in section 7 apply to these details in the same way. Email info@sr7webdesign.co.uk to use them.