Privacy information
How I handle personal information
This explains what I do with personal information in my freelance web design business, in plain English.
Last updated: 27 October 2026
Who is responsible
Alexandru Albert, trading as Albert Web Design, a sole trader, decides how and why personal information is used and is the “controller”.
Contact: [email protected]
3 Lawnside Lodge, 1 Avenue Road, Malvern, WR14 3AG, United Kingdom
What I use personal information for, and why
The “legal basis” is the reason UK GDPR allows me to use the information. I use personal information for the activities below. Proposals and contracts have two rows because the basis differs for individual clients and for people acting for a company.
| Activity | Information | Purpose | Legal basis |
|---|---|---|---|
| Business enquiries | Your name (if you give it), email address, anything you write, and any details of your business. | To read your message, reply, and discuss whether I can help. | Legitimate interests in answering your enquiry. Contacting me does not add you to any marketing list or subscription. |
| Proposals and contracts: you personally are the client (for example a sole trader or an individual) | Name, business name, email, project details, content and files you supply. | To agree the work, prepare a proposal, and deliver the website. | Necessary steps you ask for before a contract (such as preparing a quote), and then performing the contract. |
| Proposals and contracts: you act for a company or organisation (for example as an employee or director) | Your name, work email, role and the messages and files you send on the company’s behalf. | To deal with your company, prepare a proposal, and deliver the website. | Legitimate interests in managing the business relationship with your company. The contract is with your company, not with you, so I do not rely on the contract basis for your details. |
| Invoicing and records | Name, business name, billing details, what was ordered, and payment dates and amounts. | To invoice, take payment, and keep the business and tax records I am required to keep. | Individual clients: contract. Company billing contacts: legitimate interests in managing the business relationship. For all clients: legal obligation, limited to the tax and accounting records I am required to keep. |
Business website research and relevant service offers
I may research UK business websites and public business information to identify organisations for which my web-design services could be relevant. I use business websites and the Companies House register to record limited details such as business name, website, business contact address, source and a brief note about a relevant website opportunity. I do not buy contact lists or collect private contact details for this purpose.
Where this involves personal information, my lawful basis is legitimate interests in finding business customers and offering relevant services, balanced against the contact’s rights and reasonable expectations. I check the applicable electronic-marketing rules before contact; legitimate interests does not replace any consent those rules require. I do not send unsolicited marketing email to sole traders or other individual subscribers unless a valid consent or other applicable route has been established.
If I contact you, I identify myself, explain the relevant offer and provide a way to object. You can object at any time by replying or emailing [email protected]. I stop using your personal information for direct marketing when you object. I retain inactive prospect research for up to 90 days from collection, unless it develops into an enquiry with a different stated retention period. I keep minimal suppression information as needed to honour objections, reviewed annually.
Where information comes from
From you: when you email me, agree work with me, or send me content for your website. From public sources: business websites and the Companies House register, if I research business customers as described above.
Who else may see it
I do not sell personal information. These providers handle it for me:
- Google Workspace provides my business email ([email protected]), so the emails you send me are held there. Google acts as a processor for me under its data processing addendum, which I have accepted.
- Cloudflare hosts this website. When you visit it, Cloudflare handles technical information such as your IP address and details of your request so that pages can be delivered and kept secure. Cloudflare acts as a processor for me under its data processing terms. How long Cloudflare keeps its own server logs is set by Cloudflare, not by me.
- Payment providers: payment instructions are supplied with the agreed proposal or invoice. If you pay through a payment provider, that provider handles your payment details under its own privacy information.
- Professional advisers (for example an accountant), or authorities where the law requires it, if that is needed.
Transfers outside the UK: my providers may process information outside the UK, and I make no claim that information stays in the UK. Google says it may process data in any country where it or its subprocessors have facilities. For transfers of UK personal data to the US, Google says it relies on the UK Extension to the EU–US Data Privacy Framework; that statement covers transfers to the US only, and other transfers rely on other safeguards described in Google’s terms. Cloudflare says it mainly stores information in the US and the EEA, may access it from around the world, and describes published safeguards for transfers, including its data processing addendum.
AI tools: I do not use AI tools with clients’ personal or confidential information. If that changes, I will update this page first.
How long I keep information
I keep personal information only as long as I need it. These are the periods I use. They are my own choices, not legal requirements, except where I say a rule applies.
| Information | Retention |
|---|---|
| Enquiries that do not go ahead | Deleted six months after the last meaningful contact. |
| Business prospect research that gets no response | Kept for up to 90 days from collection, unless it becomes an enquiry with a different retention period above. |
| Contracts and records of acceptance | Essential records kept for six years after the project closes, then reviewed. Not every file is kept that long. |
| Temporary client files (content and assets you send me) | Deleted 90 days after handover unless we agree otherwise. |
| People who opt out of marketing | A minimal record (enough to avoid contacting you again) is kept so I can respect your choice, and reviewed each year. |
| Tax and accounting records | Kept for the minimum HMRC requires, generally five years after the 31 January filing deadline for the relevant tax year. |
I may keep specific information longer if it is needed for a particular dispute or legal claim, or because the law requires it, and I record why. I do not apply the longer periods to everything.
Where a provider controls how long its own copies, logs or backups are kept (for example Cloudflare’s server logs, or Google’s backups after I delete something), those are kept for as long as the provider’s own schedule and legal duties require, and I cannot promise instant deletion from them.
Your rights
Under UK data protection law you can ask me to:
- tell you what I hold about you and give you a copy;
- correct information that is wrong;
- delete information, in some circumstances;
- restrict how I use it, in some circumstances;
- give you your information in a portable form, in some circumstances;
- object to how I use it, including an absolute right to object to direct marketing;
- withdraw consent, if I rely on consent, at any time.
To use any right, or to say you do not want to be contacted, email [email protected]. I will not charge you to object to marketing.
Complaints
Please tell me first so I can try to put things right. You can also complain to the Information Commissioner’s Office (ICO), the UK data protection regulator: ico.org.uk/make-a-complaint.
This website
- I do not add cookies or analytics to this website.
- There is no form. The “Discuss your website” link opens your own email app; nothing is sent until you send it.
- Cloudflare hosts the site and handles visitors’ technical data as described above.