Privacy Policy

This Privacy Policy explains how Vane Built ("we", "us", "our") collects, uses and protects personal data when you visit vanebuilt.co.uk, enquire about our services, or become a client. We are committed to the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who we are

Vane Built is a small independent studio based in Wellingborough, England, providing Website Creation, Local SEO, Paid Ads & Growth, and Brand & Design services to businesses across the UK. For any privacy-related questions, contact us at DavidM@VaneBuilt.co.uk.

For the personal data described in this policy, Vane Built is the Data Controller. Where we process personal data on behalf of a client (e.g. enquiry-form submissions on a website we host, or ad-platform audiences), we act as a Data Processor under that client's instructions.

2. What data we collect

We only collect data we actually need to run the business:

• Enquiry data: name, email, phone number, current website, service you're interested in, and anything you write in the message field of our contact form.
• Client data: business name, billing address, VAT number where applicable, and payment records for invoicing.
• Correspondence: emails, messages and call notes exchanged while we work together.
• Technical data: basic server logs (IP address, browser, timestamps, referring page) generated automatically when you visit the site, kept for security and troubleshooting.

We do not knowingly collect data from anyone under 18.

3. How we use your data & our lawful basis

• To reply to enquiries and provide a quote — lawful basis: taking steps at your request prior to entering a contract.
• To deliver services under a Proposal (design, development, SEO, ad management, hosting, invoicing) — lawful basis: performance of a contract.
• To send transactional emails (order confirmations, project updates, invoices) — lawful basis: performance of a contract.
• To keep records for tax and accounting — lawful basis: legal obligation.
• To keep the site and our systems secure (server logs, spam filtering) — lawful basis: legitimate interests.

We do not send marketing emails or newsletters. If we ever do, it will be opt-in only.

4. Cookies & tracking

This site uses only strictly necessary cookies and local storage — for example, remembering that you dismissed the cookie notice. These do not require consent under PECR.

We do not use Google Analytics, Meta Pixel, or any third-party advertising or tracking cookies on this website. If we ever add analytics or marketing tracking, we will update this policy and ask for your consent through the cookie banner before any non-essential cookie is set.

Websites we build for clients may use analytics (e.g. Google Analytics), advertising pixels (e.g. Google Ads, Meta Pixel) or CRM/form tools. On those sites, the client is the Data Controller and their own privacy notice applies.

5. Third parties & sub-processors

We keep the stack small. The services we rely on to run Vane Built may process your personal data on our behalf:

• Hosting & infrastructure: Cloudflare, Supabase (backend database and authentication for this site).
• Email delivery: our transactional email provider used to send confirmations and admin notifications.
• Payments & invoicing: our accounting and payment providers (used only when you become a paying client).
• Ad platforms (for client campaigns): Google Ads, Meta Ads — governed by their own privacy policies.

We never sell your personal data. We only share it with a third party when it's necessary to deliver the service, comply with the law, or protect our rights.

6. International transfers

Some of our providers (e.g. Cloudflare, Google, Meta) are based outside the UK. Where personal data is transferred outside the UK, we rely on UK-approved safeguards — typically the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or an adequacy decision.

7. How long we keep data

• Enquiries that don't turn into work: up to 12 months, then deleted.
• Client records: for the duration of the engagement plus 7 years after the final invoice (to meet HMRC record-keeping requirements).
• Server logs: up to 30 days.

8. Your rights under UK GDPR

You have the right to:

• Access the personal data we hold about you.
• Ask us to correct data that is inaccurate or incomplete.
• Ask us to erase your data (where we are not required to keep it by law).
• Ask us to restrict or object to certain processing.
• Request a copy of your data in a portable format.
• Withdraw consent at any time, where consent is the lawful basis.

To exercise any of these rights, email us at DavidM@VaneBuilt.co.uk. We'll respond within one month.

If you're not happy with how we've handled your data, you can complain to the UK Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113. We'd appreciate the chance to sort it out with you first.

9. Security

We use reputable providers, encrypted connections (HTTPS), and access controls to protect your data. No system is perfect — if a personal data breach ever affects your rights, we'll notify the ICO within 72 hours and you as soon as reasonably practicable.

10. Changes to this policy

We may update this policy from time to time. The "Last Updated" date at the top shows the current version. For anything more than a small clarification, we'll let existing clients know by email.