YOUR INFORMATION

Privacy notice

This notice explains how I use personal information when you enquire about, purchase or receive my website services.

Who handles your information

I am Joseph Fishwick, a sole trader trading as J Fishwick Web Design. I am the data controller for information used to manage my own enquiries, client relationships and business records.

For privacy questions, requests or complaints, email enquiries@jfishwickwebdesign.co.uk.

Information I collect

The quick enquiry asks whether you have a website, what you need, your type of business and how you would like to be contacted. It then asks for your name and either your email address or your phone or WhatsApp number, depending on your choice. Your business name, current website and any extra note are optional. I also receive information you provide in subsequent correspondence.

For a project, I collect only the information needed for the agreed work. Depending on the service, this can include billing details, invoices, project requirements, supplied website content, service correspondence and access details needed to configure or maintain your website. Please do not send passwords or sensitive personal information through the consultation form.

Hosting systems may record technical information such as IP addresses, browser details, request times and pages requested. The enquiry form also uses a hashed network identifier to limit repeated submissions.

Why I use information and my lawful bases

• Enquiries and services: to discuss requirements, prepare quotes and deliver an agreed service. Where you are the contracting individual, this is necessary to take steps at your request before a contract or to perform that contract.
• Business contacts: where you represent a company or another organisation, I rely on legitimate interests in communicating with its representatives and providing the requested services.
• Security and administration: I rely on legitimate interests in protecting the website, preventing abuse, maintaining services and keeping appropriate records to handle queries or disputes, balanced against your rights.
• Required records: I retain and use relevant accounting and tax information to comply with legal obligations.

If you do not provide information needed to answer an enquiry or carry out a service, I may be unable to proceed. Sending an enquiry does not subscribe you to a marketing mailing list.

Service providers and sharing

Namecheap provides website hosting and business email services. Enquiries are delivered to my business mailbox, and relevant information is processed through these services to operate the website and communicate with you. Email may also be accessed through Outlook on my devices.

GitHub Actions is used to create portfolio previews from approved public client websites. This process captures public website images and logos; it does not receive consultation form submissions. The previews are stored on my hosting account. Private sales prototypes use mock data rather than real customer records.

Information may also be shared where necessary with an authorised service provider for agreed work, professional advisers for relevant business matters, or authorities where legally required. Only information needed for the relevant purpose should be shared. Project-specific providers and access arrangements will be identified as part of the service arrangements.

Third-party integrations, including payments

A project may involve connecting a website to a payment processor such as Stripe, or to booking, email or other services. Stripe is a possible future integration, not a payment service currently used by this website.

Before a new integration handles personal information, the relevant provider, information involved, purpose and account responsibilities need to be identified. A payment provider may process payer details, transaction information and payment credentials through its own systems. Its role and privacy terms depend on the particular integration; providers are not automatically all acting in the same capacity.

Accounts may be owned by the client or managed as part of an agreed service. A client's website must explain its actual integrations in its own privacy information. This notice does not give blanket permission to send information to any future provider. If I introduce an integration affecting information collected for my own business, I will update this notice and provide any necessary information or consent choice before that processing starts.

Client websites and handover

Clients are responsible for deciding how their own websites collect and use personal information. When I host or maintain a website on a client's behalf, I may act as a data processor under the agreed instructions and applicable data-processing terms. That does not remove my own responsibilities for information I handle.

I limit access to what is needed to run and maintain the website. I do not inspect customer records unless requested or authorised as part of the work. Technical hosting and backup services may still process information without me manually viewing it. Access after handover depends on whether ongoing support or management has been agreed.

If your question concerns information submitted to a client's website, contact that website's owner first. I will assist with relevant requests where required by my role and instructions.

Where information is processed

I aim to use UK hosting where available and appropriate. This is not a guarantee that all processing stays in the UK: providers may use overseas infrastructure, support teams or subprocessors. Namecheap describes its practices in its privacy policy.

Where a service involves a restricted international transfer of personal information, an applicable UK transfer mechanism is required, such as adequacy regulations or appropriate contractual safeguards. You can contact me for details of the locations and safeguards applicable to your service, and how to obtain a copy of relevant safeguards.

How long information is kept

• Unsuccessful enquiries: deleted 12 months after the last meaningful contact, unless a specific legal obligation or ongoing dispute requires relevant information to be retained longer.
• Active projects and maintenance: relevant correspondence and working information are kept while needed to deliver the agreed service. After it ends, information no longer needed is removed; records still needed for accounting, contractual obligations or a specific dispute are retained only for those purposes.
• Credentials and working copies: removed after handover when no longer needed, unless ongoing maintenance or another agreed requirement justifies keeping them.
• Accounting and tax records: kept for the applicable statutory period. For sole-trader Self Assessment records, this is normally at least five years after the 31 January submission deadline for the relevant tax year; longer periods can apply in particular circumstances.
• Backups and hosting logs: follow the relevant provider's retention and rotation settings. Deleted information may remain in backups until those copies expire. Contact me for the arrangements applicable to your service.

Cookies and abuse prevention

This public website currently uses no analytics or advertising cookies. Interacting with the consultation form starts a necessary session cookie, jf_enquiry, to protect submissions. It has no persistent expiry and is intended for the browser session; browser session-restore behaviour can affect when it is removed. The submission security token is valid for up to one hour.

The form's hashed network identifier is used in a 15-minute rate-limit window. Expired entries are removed when the rate-limit store is next processed, rather than by a guaranteed timed deletion job. Hosting access logs are separate from this mechanism.

Authorised users of the private sales library can explicitly save mock prototypes in their browser for offline use. Those copies stay until cleared or removed by the browser. This does not save public visitors' enquiry submissions.

If analytics or other optional tracking is introduced, I will explain it and request consent before enabling it where required. You will be able to refuse or withdraw that consent.

Your questions and rights

Depending on the circumstances, you can ask to access your personal information, correct it, delete it, restrict its use or receive a portable copy. You can object to processing based on legitimate interests. Where processing relies on consent, you can withdraw it without affecting the lawfulness of earlier processing. These rights are subject to applicable conditions and exemptions.

Email enquiries@jfishwickwebdesign.co.uk to exercise a right or raise a concern. I may need proportionate information to verify your identity. I will normally respond to a rights request within one month, explaining any lawful extension that applies.

You can also complain to the UK Information Commissioner's Office through ico.org.uk/make-a-complaint or by calling 0303 123 1113.

Changes to this notice

I will update this notice when services or information-handling practices change and provide further information where required.

Last updated: 21 September 2026.