Privacy policy.

Who I am

Web Cardiff is run by Tom, a web designer based in Cardiff, Wales. I'm the data controller for the personal information collected through this website, which means I decide how it's used and I'm responsible for looking after it. You can contact me about anything in this policy at hello@webcardiff.co.uk.

What I collect when you send an enquiry

When you use the contact form, the site stores your enquiry in its own database. That includes:

• your name and email address
• your business name and current website, if you give them
• your message
• where the enquiry started on the site (for example, the homepage search box or a service page)
• how long you took to fill in the form
• the results of the site's automatic spam checks
• if you arrived from one of my Google adverts or a link with campaign details: the Google click ID, the campaign details in the link (source, medium, campaign and advert), the page you sent the form from, and whether you accepted the advertising cookie

Your IP address is used only to stop too many messages being sent from one place in a short time (rate limiting). It isn't stored with your enquiry.

I use this information to read and reply to your enquiry, and, if we work together, to provide the work you've asked for. My legal basis is legitimate interests: you've contacted me and expect a reply. If we go on to work together, it becomes the contract between us.

The FCA updates email

If you sign up for the free FCA updates email, the site stores:

• your email address and your firm reference number (FRN)
• when you signed up, confirmed and, if you do, unsubscribed
• a record of each email I send you: which FCA publications it listed and Brevo's reference for it
• your answers if you click "Relevant? Yes / No" under an item

Your firm's name, status and permissions come from the public FCA Register, using its official API. Your IP address is used only for rate limiting and isn't stored.

Brevo, which sends the email, adds a small image that registers when the email is opened, and routes links through its own servers so clicks can be counted. I've set it to record these anonymously: I only see totals, such as how many emails were opened this week, never whether you opened one. If you'd rather not be counted at all, set your email app not to load images.

I use this only to send you the weekly email, check it's arriving and improve how publications are matched to firms. My legal basis is your consent: you asked for the email and confirmed your address. You can withdraw it at any time with the unsubscribe link in every email.

No personal information is sent to the AI models that read and summarise FCA publications. They only see the FCA's own text.

The tax updates email

If you sign up for the free tax updates email, the site stores your email address, the kinds of clients you chose, when you signed up, confirmed and, if you do, unsubscribed, a record of each email sent to you and your answers if you click "Relevant? Yes / No". It's sent by Brevo in the same way as the FCA updates email, with opens and clicks counted anonymously, and kept on the same terms. My legal basis is your consent, which you can withdraw with the unsubscribe link in every email. The government publications it summarises come from GOV.UK under the Open Government Licence. No personal information is sent to the AI models that read them.

Measuring my Google adverts

I advertise on Google. When you click one of my adverts, Google adds a click ID to the page address. If you then send an enquiry, the site keeps a separate copy of it with that click ID and the campaign details, so I can see which adverts lead to enquiries.

If you accepted the advertising cookie, I tell Google that the click led to an enquiry, and later, if we work together, that it led to work and what it was worth. This is called conversion tracking. Google receives only the click ID, the time and the value, never your name, email address or message. If you rejected the cookie, the click ID stays with your enquiry and isn't sent to Google.

My legal basis is your consent for the cookie and for telling Google, and legitimate interests for keeping the copy, so I can tell whether my advertising is worth paying for.

How long I keep it

• Genuine enquiries are kept for 2 years, then deleted automatically.
• The copy used to measure my adverts is kept for 12 months, then deleted automatically.
• Messages filtered as spam are kept for 30 days, so I can check nothing real was caught by mistake, then deleted automatically.
• Client records (quotes, invoices and related emails) are kept for 6 years after we stop working together, because the law requires it for tax purposes.
• FCA updates and tax updates emails. Kept while you're subscribed. If you unsubscribe, or don't confirm your sign-up, your details and the record of emails sent to you are deleted after 30 days.
• Homepage search box. What's typed into the search box, the pages suggested and whether one was clicked are logged without any link to you, so I can see what visitors look for. The log is deleted after 90 days.

Who else processes your information

I don't sell or share your information for marketing. A small number of services handle it on my behalf, as processors. They can only use it to provide their service to me.

• Brevo (Sendinblue SAS, France) sends me an email to let me know a new enquiry has arrived. The notification includes the details of your enquiry. It also sends the FCA updates email and counts opens and clicks anonymously, as totals.
• TypeSafe (its Jev model) reads the text of enquiries to sort spam from genuine messages and to tag them by type, so I can reply sooner. It also processes the words typed into the homepage search box, and the address of a missing page, to suggest a relevant page. Search text isn't linked to you.
• Google (Google Ireland Limited) receives the click ID, time and value described in "Measuring my Google adverts", only if you accepted the advertising cookie, under the Google Ads Data Processing Terms.
• Hosting. The site and its database run on a server provided by Hetzner Online GmbH, in Germany.
• Cloudflare (Cloudflare, Inc.) sits in front of the site to deliver it quickly and protect it from attacks. Every visit passes through Cloudflare, so it processes your IP address and the technical details your browser sends, such as which page you asked for.

If you book a video call through Calendly, Calendly handles that booking under its own privacy policy.

Where a processor is based outside the UK, your information is only transferred with the safeguards UK data protection law requires. Brevo (France) and Hetzner (Germany) are in the EU, which the UK recognises as providing adequate protection. Google Ireland Limited is in the EU. TypeSafe AI, Inc. is in the United States; transfers to it are covered by the UK Addendum to the EU Standard Contractual Clauses in its data processing agreement. Cloudflare, Inc. is also in the United States; transfers to it are covered by the UK Extension to the EU-US Data Privacy Framework, with the UK Addendum to the EU Standard Contractual Clauses in its data processing addendum as a fallback.

Analytics

I use Plausible, running on my own server, to see which pages are visited. It doesn't use cookies and doesn't collect personal data, so it can't identify you or follow you across other websites.

Cookies

This site sets one optional cookie, only if you agree to it, and three that are strictly necessary, which the law allows without asking first.

• wc_ads (optional, advertising). Set only if you click Accept on the cookie message, which appears when you arrive from a Google advert or a link with campaign details. It records the Google click ID and campaign details for 90 days, so that if you get in touch later, I know which advert brought you here.
• wc_consent remembers whether you accepted or rejected wc_ads, for 12 months, so you aren't asked again.
• cf_clearance, set by Cloudflare. It records that your browser passed Cloudflare's automatic check for malicious bots, so you aren't checked again on every page. It doesn't track you across other websites.
• A sign-in cookie for the admin area, which only I use.

You can change your cookie choice at any time. Rejecting deletes wc_ads straight away.

Your rights

Under UK GDPR you can:

• ask for a copy of the personal information I hold about you
• ask me to correct anything that's wrong
• ask me to delete your information
• ask me to restrict how I use it, or object to it being used
• ask for your information in a format you can take elsewhere

To do any of these, email hello@webcardiff.co.uk. I'll reply within one month.

Keeping your information safe

The site uses HTTPS throughout, the database isn't publicly reachable, and the admin area needs a password and a code from an authenticator app. No system is perfectly secure, but I take sensible steps to protect what I hold.

Children

My services are for businesses, and I don't knowingly collect information from anyone under 18.

Complaints

If you're unhappy with how I've handled your information, you have the right to complain to me first: email hello@webcardiff.co.uk. I'll acknowledge your complaint within 30 days, look into it and tell you the outcome. You also have the right to complain to the ICO (formally called the Information Commission from 30 September 2026), the UK's data protection regulator, at ico.org.uk or on 0303 123 1113.

Changes to this policy

If I change how I use your information, I'll update this page and the date at the top.