Privacy Policy

The data controller for personal data collected through this website is Lukasz Wojcik, trading as Cheviot Web Studio, 33 Farrier Court, Kelso TD5 7UJ, Scotland — hello@cheviotwebstudio.co.uk. I take your privacy seriously and handle data in line with UK GDPR and the Data Protection Act 2018, and pay the annual data protection fee to the Information Commissioner's Office as a registered data controller.

Client websites: where I host or maintain a website for a client (for example an online-ordering site), that client is the data controller for their customers’ data and their own privacy notice applies; I act only as their processor under a written agreement.

What I collect

• Enquiry details you submit through the contact form — your name, business name, email, phone number, and the details of your enquiry, together with the page or website you came to the form from (for example “/pricing” or “google.com”) and any campaign tag in the link, so I can see which pages bring enquiries.
• Support tickets from existing clients — the same contact details plus the subject and message.
• Chat widget messages if you use the chat — the messages you type, the page you were on, and your IP address. The chat is answered by an automated AI assistant (Cloudflare Workers AI), not a person.
• Technical data such as your IP address, collected automatically when you submit a form or use the chat (used to prevent spam and abuse), and anonymous page-view statistics from Cloudflare Web Analytics, which does not use cookies.
• Anonymous click totals — when someone taps WhatsApp, phone, email or a contact-form link, the site adds one to a daily total for that page. No IP address or identifier is recorded, and nothing is stored in your browser.
• I do not use advertising trackers or sell your data to anyone.

Why I use it, and the legal basis

• Replying to your enquiry and preparing a quote — because you asked me to, before any contract (UK GDPR Article 6(1)(b)).
• Doing the work for clients and handling support tickets — to perform our contract (Article 6(1)(b)).
• Answering chat messages, and following up if you leave contact details or ask to be contacted in the chat — my legitimate interest in answering questions about my services (Article 6(1)(f)).
• Protecting the website from spam and misuse, including the Cloudflare Turnstile check on forms — legitimate interests (Article 6(1)(f)).
• Keeping business and accounting records for clients — legal obligation (Article 6(1)(c)).

How it’s stored and for how long

• Enquiries, support tickets and chat transcripts are stored in a database on Cloudflare’s infrastructure, and enquiries are also sent to my email so I can reply.
• Enquiries are kept for up to 2 years and then deleted automatically, unless you become a client.
• Chat transcripts are deleted automatically after 90 days without activity. If you left contact details or asked to be contacted in the chat, the transcript is kept for up to 12 months so I can follow up.
• Client records (quotes, invoices, agreements and project correspondence) are kept for 6 years after the end of the tax year the work was completed in, as required for tax records.
• You can ask me to delete your enquiry or chat sooner at any time.
• In your browser: when you send your first chat message, the widget saves a random ID in your browser’s local storage so the conversation carries across pages. Until then nothing is stored. The messages themselves are kept in session storage, which your browser clears when you close the tab. You can remove both at any time with “Clear chat” in the chat window. Neither is used to track you on other websites.

Who it’s shared with

I don’t sell your data or share it for anyone else’s marketing. To run the website, a small number of service providers process it on my behalf, only to provide their service:

• Cloudflare — website hosting, database, spam protection (Turnstile), the AI model that answers the chat, and anonymous analytics.
• Email delivery — Cloudflare Email or Resend, to forward enquiries and tickets to my inbox.
• WhatsApp (Meta) — if a chat message looks like a request to get started or includes contact details, the page name and that message are sent to my own WhatsApp as an alert so I can reply quickly.

Some of these providers may process data outside the UK, for example in the United States. Where they do, the transfer relies on safeguards recognised under UK data protection law, such as the UK–US data bridge or the ICO’s International Data Transfer Addendum, as offered by each provider.

Cookies and similar storage

This website does not use advertising or analytics cookies. Cloudflare may set a security cookie to protect the site from abuse, and the admin area uses a cookie to keep me signed in. The chat widget uses your browser’s local and session storage as described above, only once you start using the chat, because it’s needed for the chat you asked for to work.

Your rights

• You can ask for a copy of the data I hold about you, and ask me to correct or delete it.
• You can ask me to restrict how I use it, and you can object to any use based on legitimate interests — including follow-ups after a chat.
• Where I use data to carry out a contract with you, you can ask for it in a portable format.
• To exercise any right, email me. I’ll reply within one month.
• You also have the right to complain to the UK’s Information Commissioner’s Office (ICO) at ico.org.uk.

Contact

Questions about your data or this policy? Send me an email.