How we collect, use and protect your information.

1. Who we are

WH Web Design Ltd provides website design, website management, social media content, video marketing, digital services and custom business-system development for clients in the United Kingdom, Malta and other locations.

For the purposes of applicable data-protection law, WH Web Design Ltd is the data controller for the personal data described in this policy.

2. Personal data we collect

Depending on how you interact with us, we may collect:

• your name, job title, business name and contact details;
• information included in contact, quote or support forms;
• project requirements, budgets, timescales and correspondence;
• billing, transaction and payment-status information;
• website account details where we provide managed services;
• technical data such as IP address, browser, device and server-log information;
• cookie preferences and analytics information where consent is required and obtained;
• records of meetings, calls, support requests and client instructions;
• information supplied when you apply to work with us or provide services to us.

Please do not send special-category or highly sensitive personal data unless it is genuinely necessary and we have agreed an appropriate secure method for receiving it.

3. How we use personal data

We may use personal data to:

• respond to enquiries and prepare quotations or proposals;
• enter into and perform contracts with clients and suppliers;
• design, develop, host, maintain and support websites or applications;
• manage projects, invoices, payments and business records;
• provide customer service and respond to support requests;
• secure, monitor and improve our websites, systems and services;
• send service communications and, where permitted, relevant marketing;
• comply with legal, tax, accounting and regulatory obligations;
• establish, exercise or defend legal claims;
• prevent fraud, misuse, security incidents and unlawful activity.

4. Our lawful bases

Where we rely on legitimate interests, those interests may include operating and improving our business, protecting our services, communicating with clients and prospective clients, and keeping appropriate business records. We balance those interests against your rights and reasonable expectations.

5. Who we share personal data with

We do not sell personal data. We may share it only where reasonably necessary with:

• hosting, domain, email, cloud-storage and technical-service providers;
• website platforms, plugins, form-processing and security providers;
• payment, accounting, invoicing and professional-adviser services;
• contractors or specialist partners working under appropriate confidentiality obligations;
• regulators, law-enforcement bodies, courts or public authorities where required;
• a purchaser or successor in connection with a genuine business transfer.

Service providers are permitted to use personal data only for the agreed services and must protect it appropriately.

6. International data transfers

Some technology providers may process information outside the United Kingdom, Malta or the European Economic Area. Where personal data is transferred internationally, we use an applicable legal transfer mechanism, such as an adequacy decision, approved contractual safeguards or another lawful exception.

You may contact us for further information about safeguards relevant to a particular transfer.

7. How long we keep personal data

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, including legal, accounting, tax, contractual and security requirements.

• unsuccessful general enquiries: normally up to 24 months;
• client and project records: normally for the contract period and up to 7 years afterwards;
• invoice and accounting records: normally 6 to 7 years, subject to applicable law;
• support and security logs: according to operational and security requirements;
• marketing preferences: until consent is withdrawn or the information is no longer required.

These periods may be extended where information is needed for a dispute, legal claim, regulatory investigation or continuing contractual obligation.

8. Your data-protection rights

Depending on the law that applies and the circumstances, you may have rights to:

• be informed about how your personal data is used;
• request access to your personal data;
• request correction of inaccurate or incomplete data;
• request erasure of personal data;
• request restriction of processing;
• object to processing, including direct marketing;
• receive certain data in a portable format;
• withdraw consent at any time where processing relies on consent;
• challenge certain decisions made solely by automated means.

These rights are not absolute and may be subject to legal conditions or exemptions. To exercise a right, email info@whwebdesign.co.uk. We may need to verify your identity before acting on a request.

9. Data security

We use proportionate technical and organisational measures intended to protect personal data against accidental loss, unauthorised access, alteration, disclosure or destruction. Measures may include access controls, secure hosting, encryption where appropriate, software updates, backups and supplier controls.

No internet transmission or storage system is completely secure. You should use secure methods when sending confidential or sensitive project information.

10. Questions and complaints

Please contact us first so that we can investigate and try to resolve your concern.

UK residents may also complain to the Information Commissioner’s Office. Individuals in Malta may complain to the Office of the Information and Data Protection Commissioner. Individuals elsewhere may contact their local data-protection authority.

• UK Information Commissioner’s Office
• Malta Information and Data Protection Commissioner

11. Contact us and policy updates

Questions about this policy or our handling of personal data should be sent to:

We may update this policy when our services, suppliers, legal obligations or data-handling practices change. The latest version will be published on this page with a revised “last updated” date.