Privacy policy
This policy explains what personal data SetWeb collects, why, how long it is kept and what rights you have over it. It covers this website and our dealings with clients and enquirers. It is written to be read rather than to be impressive.
Privacy policy
Who we are
SetWeb is a Nottinghamshire business providing website development, custom software, AI automation, hosting and IT support. For the purposes of UK GDPR we are the data controller for the personal data described in this policy.
Our company registration number, registered address and ICO registration number are shown in the footer of every page. If any of those are missing, they are pending and will be published before this site goes live.
What we collect
When you contact us: your name, business name, email address, telephone number, the nature of your enquiry and anything else you choose to tell us in the message.
When you ask the site assistant to arrange a callback: the name and number you give it, and a copy of that chat, sent to us by email so that whoever rings you already knows what you asked. Questions you put to the assistant without requesting a callback are not stored or sent to us at all.
When you use the site: standard server log data including IP address, browser type and the pages requested. This is used for security and for diagnosing faults.
When you become a client: the contact details of the people we deal with, records of the support work carried out, and the technical information necessary to support your systems. We do not routinely access the contents of your business data, and where support work requires it, it is done on the basis of your instruction.
Why we hold it, and on what basis
To respond to enquiries and provide quotes, on the basis of steps taken at your request prior to entering a contract.
To deliver services we have been contracted to deliver, on the basis of performance of a contract.
To keep records required by law, including accounting records, on the basis of legal obligation.
To keep this website secure and working, on the basis of our legitimate interest in operating the site safely.
We do not sell personal data, we do not share it for advertising, and we do not use it to build profiles for marketing purposes.
How long we keep it
Enquiries that do not become clients: 24 months, then deleted.
Client records: for the duration of the relationship and six years afterwards, which is the period required for accounting and contractual records.
Server logs: 90 days.
Anything held longer than these periods is held because a specific legal obligation requires it, and we will tell you what that obligation is if you ask.
Who else sees it
Our hosting and infrastructure suppliers, who process data on our instruction under a written agreement.
Our email provider, for the correspondence between us.
Our accountants, for invoicing and accounting records.
Where a piece of work genuinely requires a specialist subcontractor, we arrange and manage that ourselves, under the same obligations that apply to us.
We do not transfer personal data outside the UK or European Economic Area except where a supplier’s infrastructure requires it, and in those cases an appropriate safeguard is in place.
Cookies and analytics
This site sets only the cookies necessary for it to function, plus one that remembers the size of the assistant panel. No analytics provider is loaded and no advertising cookie is set. The cookie policy lists every entry in full and carries a scanner that reads your own browser and checks it against that list.
Your rights
Under UK GDPR you have the right to access the personal data we hold about you, to have inaccurate data corrected, to have data erased where there is no continuing lawful basis for holding it, to restrict or object to certain processing, and to receive data you provided in a portable format.
To exercise any of these, email us and we will respond within one month. There is no charge.
If you are unhappy with how we have handled your data you can complain to the Information Commissioner’s Office at ico.org.uk. We would rather you told us first so we can put it right.
Security
Access to client data is restricted to the people who need it, protected by multi-factor authentication, and logged. Data is encrypted in transit and at rest. Backups are held in more than one location and restores are tested on a schedule.
If a personal data breach occurs that is likely to result in a risk to individuals, we will notify the Information Commissioner’s Office within 72 hours and tell affected people without undue delay.