Privacy Policy

This Privacy Policy was last updated on 6 July 2026.

1. Who We Are

Uncommon Web Development ('Uncommon Web', 'we', 'us', 'our') is a web design and development agency based in the United Kingdom. We build bespoke websites for small and independent businesses.

We are the data controller for the personal information we collect about you. You can contact us at: info@uncommonweb.co.uk or by calling 03331 888 200.

We are registered with the Information Commissioner's Office (ICO) as a data controller.

2. What Information We Collect

Information you provide to us

When you contact us, submit an enquiry, or engage us for a project, we may collect: your name, email address, phone number, business name, and any other details you share with us in correspondence.

Information collected automatically

When you visit our website, we automatically collect certain technical information including your IP address, browser type, device type, pages visited, and how you found us. This is collected via cookies and analytics tools (see Section 8).

Information from your project

If you become a client, we may collect additional information necessary to deliver your project — for example, business information, branding materials, login credentials for third-party platforms, and content you supply for inclusion on your website.

3. Lawful Basis for Processing

Under UK GDPR, we must have a lawful basis for processing your personal data. We rely on the following:

Contract (Article 6(1)(b)): When you engage us for a project, processing your data is necessary to fulfil that contract — for example, communicating about the project, invoicing, and delivering the finished website.

Legitimate Interests (Article 6(1)(f)): We process data from website enquiries to respond to you and assess whether we can help. We have assessed that doing so does not override your rights and freedoms.

Legal Obligation (Article 6(1)(c)): We retain certain financial records (including invoices) to comply with HMRC requirements.

Consent (Article 6(1)(a)): If you opt in to marketing emails, we process your data on the basis of your consent, which you may withdraw at any time.

4. How We Use Your Information

We use the information we collect to: respond to your enquiries; prepare and deliver quotes and proposals; manage your project and communicate with you throughout; issue invoices and process payments; provide post-launch support; improve our website and services; and, where you have consented, send you occasional updates about our services.

We do not use your data for automated decision-making or profiling.

5. Data Retention

We keep your data only for as long as necessary. Our standard retention periods are:

Enquiry data (no project started): 12 months from the date of your last contact.

Client project data: 7 years from project completion, to comply with HMRC record-keeping requirements and to support any warranty or support obligations.

Marketing consent records: Until you withdraw consent, plus 12 months thereafter.

Website analytics data: As configured in Google Analytics (currently 26 months).

When data is no longer needed, we securely delete or anonymise it.

6. Third-Party Service Providers

We use a small number of trusted third-party services to operate our business. These act as data processors on our behalf and are contractually required to handle your data securely and only as instructed:

Google Analytics — website analytics and visitor behaviour. Data is pseudonymised and processed in accordance with Google's privacy policies. We use IP anonymisation.

Google Workspace — email, documents, and communications (Gmail, Drive, Docs).

Stripe (or equivalent) — payment processing. We never see or store your card details; these are handled entirely by our payment processor, who is PCI-DSS compliant.

Vercel / hosting providers — website hosting and deployment infrastructure.

Project management tools (e.g. Notion, Linear) — internal project tracking. Client data shared in these tools is limited to what is necessary.

We do not sell, rent, or trade your personal data with any third party for their own marketing purposes.

7. International Data Transfers

Some of our third-party service providers are based outside the UK. Where personal data is transferred outside the UK, we ensure appropriate safeguards are in place — either an adequacy decision by the UK Government, Standard Contractual Clauses, or equivalent protections recognised under UK law.

8. Cookies

Our website uses cookies — small text files stored on your device — to help the site function correctly and to understand how visitors use it.

Essential cookies: Required for the website to work. These cannot be disabled.

Analytics cookies: We use Google Analytics to understand how visitors interact with our site. These cookies collect anonymised data such as pages visited and time on site. You can opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on.

You can control and manage cookies through your browser settings. Disabling certain cookies may affect how the website functions.

9. Data Security

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. These include use of encrypted communications (HTTPS), access controls, and secure data storage.

No method of transmission over the internet is completely secure. While we take every reasonable precaution, we cannot guarantee the absolute security of data transmitted to us.

10. Data Breaches

In the unlikely event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office (ICO) within 72 hours of becoming aware of it, and will notify you directly where we are required to do so by law.

11. Your Rights Under UK GDPR

You have the following rights in relation to your personal data:

Right of access: You may request a copy of the personal data we hold about you (a Subject Access Request).

Right to rectification: You may ask us to correct inaccurate or incomplete data.

Right to erasure: You may ask us to delete your data where there is no legitimate reason for us to continue processing it. Note that we may need to retain certain data to comply with legal obligations.

Right to restrict processing: You may ask us to pause processing of your data in certain circumstances.

Right to data portability: Where processing is based on your consent or a contract and is carried out by automated means, you may request your data in a structured, commonly used, machine-readable format.

Right to object: You may object to processing based on legitimate interests or for direct marketing purposes.

Rights related to automated decision-making: You have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. We do not carry out such processing.

To exercise any of these rights, please contact us at info@uncommonweb.co.uk. We will respond within one month. There is no charge for making a request.

12. How to Complain

If you are unhappy with how we have handled your personal data, please contact us in the first instance at info@uncommonweb.co.uk and we will do our best to resolve your concern.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's data protection regulator:

ICO website: ico.org.uk | Helpline: 0303 123 1113

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated version on this page with a revised 'last updated' date. We encourage you to review this policy periodically.

14. Contact Us

For any questions or requests relating to this Privacy Policy, please contact us at: info@uncommonweb.co.uk or 03331 888 200.