Privacy policy.

This site is run by Norwich Website Design Ltd, a company registered in England (company number 17355394), registered office 21 Cranleigh Rise, Eaton, Norwich, NR4 6PQ. For anything about your data, email hello@norwichwebsite.design. I’m the data controller, which means I’m the person responsible for it.

I get your name, your email address, the optional website address if you give it, and whatever you write in the message. The form emails it straight to my inbox, and also saves a copy in this website’s own database so that nothing gets lost if an email goes astray. It does not record your IP address. I use it to reply to you, and to do the work if you become a client. The lawful basis is my legitimate interest in answering enquiries, and, once you’re a client, performing our contract. I don’t add you to a mailing list and I don’t sell or pass your details to anyone to market to you.

The copy saved on the website is deleted automatically after 180 days. Enquiries that don’t turn into work get cleared out of my inbox periodically too. Client correspondence I keep for as long as I’m working with you, and for a reasonable period afterwards, because tax and the occasional dispute both have long memories.

The site runs on managed hosting from Rocket.net, on a server in London, with Cloudflare in front of it for security and speed. Like every web server it keeps standard access logs, which include IP addresses, for security and diagnostics. I don’t use those to build a picture of you, and they age out.

The processors I use are Rocket.net for hosting, Cloudflare for security and content delivery, and Google Workspace for email. Each handles this data on my behalf under its own agreement, and where any of them process data outside the UK that is covered by appropriate safeguards. The contact form and the visitor statistics both run on this site’s own server, so that data isn’t handed to anyone else at all.

There is no cookie banner on this site because there is nothing to ask you about. The only cookie set when you visit is one placed by Cloudflare (__cf_bm) which tells bots apart from people; it lasts half an hour and is strictly necessary for keeping the site up, which is why it doesn’t need your consent.

I do count visits, using Burst Statistics, which runs on this server rather than someone else’s. It stores no cookie, builds no fingerprint of your device, and doesn’t follow you anywhere. It tells me which pages get read and roughly where people arrive from, and nothing that identifies you. The fonts and icons are served from this domain too, so simply reading a page here doesn’t hand your IP address to Google or anyone else.

Under UK GDPR you can ask me what I hold about you, ask me to correct it, or ask me to delete it. You can also ask me to restrict what I do with it, or ask for a copy in a portable format to take elsewhere.

You can also object to my using your data at all. That one is worth spelling out: because I rely on legitimate interests to answer enquiries, you have the right to object to that, and if you do I’ll stop unless there is a compelling reason not to. Email me and I’ll sort any of it. There’s no process and no form: it’s one person and a mailbox.

I don’t do any automated decision-making or profiling. If you think I’ve handled your data badly, you can complain to the Information Commissioner’s Office at ico.org.uk.

Last updated 5 August 2026.