Privacy Policy

This policy covers personal data we process in two situations: when you visit or contact us through this website, and when you engage us as a client for web design and development services. It also explains how we handle personal data contained in websites we build on behalf of clients (see section 12).

Our website may link to third-party sites and services that have their own privacy policies. We encourage you to read those policies; we are not responsible for how third parties handle your data on their own platforms.

Information you give us directly. When you enquire about our services or become a client, we collect:

• Your name and, where relevant, your job title;
• Your business name and business contact details (email address, phone number);
• Your billing details, such as company name, address, and VAT number where applicable;
• Project information you choose to share — briefs, content, brand assets, and requirements;
• Records of our communications with you (emails, call notes, meeting notes).

Technical and usage data. When you browse this website, our hosting and analytics tools may automatically collect limited technical information, such as IP address, browser type, device type, pages viewed, referring source, and approximate location derived from your IP address. This is used to keep the site secure and to understand aggregate traffic patterns.

We do not ask clients to send us passwords. Where a project requires access to an account you own, we prefer invite-based or role-limited access over shared credentials (see our Terms of Service, section 14).

Cookies are small files stored on your device by your browser. We use only the categories listed below:

• Strictly necessary cookies: required for the website to function securely (for example, security and load- balancing cookies set by our hosting provider). These do not require consent.
• Analytics cookies: help us understand, in aggregate, how visitors use the site so we can improve it. Where these cookies are not strictly necessary, we ask for your consent before setting them, and you can withdraw that consent at any time.

You can also control cookies through your browser settings, including blocking or deleting them. Blocking strictly necessary cookies may affect parts of the site.

Action required before publishing: list the specific analytics tools actually in use (for example Google Analytics 4 or a privacy-friendly alternative), their cookie lifetimes, and implement a consent banner if analytics cookies are set for UK/EU visitors.

We use personal data to:

• Respond to enquiries and provide quotes, proposals, and our services;
• Plan, build, deliver, and support client projects, including communicating about milestones, approvals, and delivery;
• Billing, invoicing, accounting, and tax compliance;
• Keep records of agreements, approvals, and project decisions;
• Secure our systems, prevent fraud, and protect our business and clients;
• Improve our website and services based on aggregate usage patterns;
• Ask whether clients would like their project showcased (see section 6) and, if they agree, promote that work;
• Comply with legal obligations and enforce our contractual rights.

We do not sell personal data, and we do not use client data to train AI models.

Because we operate in and serve the United Kingdom, we process personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Our legal bases are:

• Contract: processing needed to provide the services you have asked for — for example, managing your project, communicating with you, and delivering your website.
• Legitimate interests: processing that supports our business and does not override your rights — for example, keeping basic business records, securing our systems, improving our services, and following up on enquiries.
• Consent: non-essential analytics cookies, and any marketing communications or portfolio showcasing where we rely on your permission. You can withdraw consent at any time.
• Legal obligation: retaining invoices and accounting records, responding to lawful requests from authorities, and other mandatory record-keeping.

If we ever process special category data (for example health information you volunteer), we will do so only with your explicit consent or another lawful basis permitted by the UK GDPR.

Client websites are treated as 100% private by default. We will not publicly showcase, publish, advertise, or use your website as a portfolio piece, case study, testimonial source, or example of our work without your explicit choice and permission.

From time to time we may ask whether you would be willing to let us show your website to prospective customers, or feature it in our portfolio, marketing materials, social media, or case studies. Asking is all we will ever do without prior agreement.

Permission is entirely optional. Saying no costs you nothing: declining permission does not affect your service, pricing, priority, or relationship with us in any way. If you grant permission, you can change your mind at any time and we will remove the material going forward (material already printed or published elsewhere may take time to disappear from caches and archives beyond our control).

One honest caveat: “private by default” describes whatwe do with your website. It cannot mean absolute secrecy in every circumstance. Building and running a website necessarily involves processing by hosting providers, domain registrars, content delivery networks, and other legitimate service providers, and information may also be accessed by legal authorities under lawful orders, or disclosed where the law requires it. Those processors handle data under their own terms and safeguards, as described in sections 9 and 10.

We keep personal data only as long as we need it for the purposes described above:

• Enquiries that do not become projects: kept for up to [RETENTION PERIOD — e.g. 12 months], then deleted or anonymised.
• Client project records and communications: kept for the duration of the project plus [RETENTION PERIOD — e.g. 6 years] so we can honour warranties, support requests, and resolve disputes.
• Invoices and accounting records: kept for the period required by UK tax law (currently a minimum of 6 years for most business records).
• Analytics data: retained according to the retention setting of the analytics tool in use, typically between 2 and 26 months.

Action required before publishing: confirm each retention period against your actual practice and accountant’s advice, and replace the bracketed placeholders.

We apply appropriate technical and organisational measures to protect personal data, proportionate to its sensitivity. In practice this includes encrypted connections (HTTPS/TLS) for data in transit, access controls and strong authentication on our devices and accounts, limiting access to people who need it, keeping software updated, and using reputable hosting providers with their own security certifications.

No system is perfectly secure. If a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner’s Office (ICO) within 72 hours where required, and inform affected individuals where the law requires us to.

To run our business and deliver projects, we share personal data with trusted providers who process it on our instructions. These typically include:

• Hosting and infrastructure providers who host this website and staging environments;
• Email and communication tools used to correspond with you;
• Analytics providers (only with consent where required);
• Accounting and payment services used for invoicing and receiving payments;
• Project-specific services chosen with you, such as Supabase, Stripe, Google services, or email platforms — in these cases the account belongs to you (see our Terms of Service, section 14) and the provider processes data primarily under your control.

Action required before publishing: replace this general list with the actual named providers you use, and ensure written data processing agreements (DPAs) are in place with each processor where required.

We never sell personal data or share it with advertisers.

Some of the providers we use may store or process personal data outside the UK. Where that happens, we require safeguards recognised under UK data protection law — such as the UK government’s International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, or an adequacy regulation covering the destination country — before transferring personal data.

Action required before publishing: identify which providers transfer data internationally and to which countries, and document the safeguard relied on for each.

Under the UK GDPR (and equivalent EU rules if you are in the EEA), you have the right to:

• Access the personal data we hold about you and receive a copy of it;
• Rectification of inaccurate or incomplete data;
• Erasure of your personal data in certain circumstances (“right to be forgotten”);
• Restriction of processing while a dispute is resolved;
• Data portability — receiving data you provided to us in a structured, commonly used format where processing is based on consent or contract;
• Objection to processing based on legitimate interests, and to direct marketing at any time;
• Withdraw consent at any time where processing relies on consent, without affecting the lawfulness of processing already carried out.

To exercise any of these rights, email support@thesupershoppe.com. We will verify your identity where necessary and respond within one month. Rights are not absolute — for example, we may retain data we are legally required to keep even after an erasure request.

If you are unhappy with how we handle your data, please tell us first so we can try to put things right. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK supervisory authority, at ico.org.uk.

When we build a website for a client, any personal data collected through that website (for example, form submissions from the client’s customers) is controlled by the client, not by us. Once delivered, the client is responsible for complying with data protection law for their own website, including providing their own privacy notice.

During development we may come into contact with such data (for example, while testing forms). We treat it confidentially, use it only to build and test the website, delete test submissions, and hand over or securely dispose of development copies at Delivery.

Our services are directed at businesses and adults. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, contact us at support@thesupershoppe.com and we will delete it promptly.

We may update this policy to reflect changes in our practices, services, or the law. The effective date at the top of this page shows the current version. If changes materially affect how we use your personal data, we will bring them to your attention before they take effect where reasonably possible.

Questions, requests, or complaints about this policy or your personal data can be sent to support@thesupershoppe.com. We aim to respond within one working day, and always within one month for formal rights requests.