1. Who we are
This website, customcodedwebsites.com, is run by Custom Coded Websites Ltd, a company registered in England and Wales (company number 16762286). Our registered office is Office 14883, 182–184 High Street North, East Ham, London E6 2JA.
We decide how and why the personal information in this policy is used, which makes us its controller under UK data protection law (the UK GDPR and the Data Protection Act 2018). We’re registered with the UK’s data protection regulator, the Information Commission (still known as the ICO), under registration number ZC087180.
This policy covers this website and our dealings with people who contact us or work with us. It doesn’t cover the websites we build or look after for clients: each of those has its own privacy policy, and where we host one, we handle its data only on that client’s instructions (see section 12 of our terms). Products we run under their own names have their own privacy policies too.
2. What we collect
| When | What we collect |
|---|---|
| You send a message through the contact form | Your name, email address, the topic you choose and your message (and anything you put in it), the time it was sent and the IP address it came from, which we use to stop spam. |
| You email us | Your name, email address and whatever you write, kept in our email inbox. |
| We work together | The names, email addresses and phone numbers of the people we deal with, your business’s billing details and invoices, the content you give us for your site, and any logins you share so we can do the work. |
| You visit the site | Our hosting provider’s servers record each request: the IP address, browser, page and time. Nothing more unless you accept analytics cookies. |
| You accept analytics cookies | Google Analytics records the pages you view, roughly where you are (town or region), your device and browser, and how you found us. It links these to a random number, not your name, and it doesn’t keep your IP address. |
The free tools
The calculators and the image format tester run entirely in your browser, and images you test are never uploaded. The website health check sends the web address you enter from your browser to Google’s PageSpeed Insights service, which runs the test, and keeps your last few checks in your browser so you can run them again (see our cookie policy). We don’t store the addresses you check. The address is added to the page’s own web address so you can reload or share the result, so if you do, it reaches us like any page address: in our server logs, and in Google Analytics if you’ve accepted it.
If you ask for a quote from one of the tools, or send us your health check results, your answers are carried into the contact form in the page address so you can check them before you send it. Nothing reaches us unless you send the form.
You don’t have to give us any personal information, but we need your name and email address to reply to you. Please don’t send us sensitive information, such as details about your health, through the form. We don’t need it.
3. How we use it
The law only lets us use personal information when we have a lawful basis for it. Here is each thing we do and the basis we rely on.
| What we do | Lawful basis |
|---|---|
| Reply to your enquiry and give you a quote | Legitimate interests: answering people who contact us. If you ask for a quote, it’s also a step you’ve asked us to take towards a contract. |
| Filter spam out of the contact form | Legitimate interests: keeping the form usable for real enquiries. |
| Do the work, invoice you and support your site | Contract: we need it to do what we’ve agreed with you. |
| Keep our accounts and tax records | Legal obligation: company and tax law require these records. |
| See which pages are useful, with Google Analytics | Consent: only if you accept analytics cookies, and you can withdraw it at any time. |
| Keep the site secure and working (server logs, essential cookies) | Legitimate interests: running a safe website. |
| Deal with complaints or legal claims | Legitimate interests: protecting our business. |
The spam filter
Every message sent through the contact form is checked automatically. If a hidden field that only bots fill in has been filled in, or the form was sent within a few seconds of opening it, the message isn’t accepted: you’ll see a note asking you to try again, and nothing is kept. Otherwise we look at how many messages have come from the same IP address in the last hour (a fourth is treated as spam), at the wording, and at how many the whole site has had (after 20 in an hour, the rest wait with the spam rather than being emailed to us). Messages that look like spam aren’t thrown away. We keep them so we can check them by hand and reply to any real message caught by mistake. The one exception is a flood: once 60 messages have arrived in an hour, any more aren’t kept at all. The filter only decides which inbox a message lands in; it doesn’t make any decision about you.
No marketing
We don’t send newsletters or marketing emails, and we never sell your details or share them for anyone else’s marketing.
4. Who we share it with
We use a small number of services to run the business. Each one only sees what it needs to do its job.
| Who | What for |
|---|---|
| Render | Hosts this website and its database, including messages sent through the contact form. |
| Our email (Gmail), including the notification each contact-form message sends us. Google Analytics, only if you accept it. The fonts on this site, which load from Google’s servers and so see your IP address and browser. The PageSpeed check, only if you use the health check. | |
| Our accountant and professional advisers | Bookkeeping, tax and legal advice, where they need client records. |
| Our bank | Taking and sending payments. |
| Authorities | Only when the law requires it, for example HMRC, or the police with a valid request. |
If the business were ever sold or merged, its records would pass to the new owner, who would have to keep to this policy.
5. Where it’s stored
This website and its database, including contact-form messages, run on Render’s servers in Frankfurt, Germany. UK law recognises the EU as protecting personal information to the same standard as the UK, so no extra safeguards are needed for that.
Render and Google are US companies, and some of their processing happens in the US. Both are certified under the UK Extension to the EU–US Data Privacy Framework (the “UK–US data bridge”), which UK law recognises as giving adequate protection. Where that doesn’t apply, they use the contract clauses approved for UK transfers.
6. How long we keep it
| What | How long |
|---|---|
| Enquiries that don’t lead to work, and messages caught by the spam filter | Up to 2 years from our last contact, then deleted. |
| Project emails and records, contracts and invoices | 6 years after the work ends. The law requires us to keep accounting records for that long, and it’s the time in which a claim under a contract can be made. |
| Server logs | Deleted automatically by Render after a short period. |
| Google Analytics data | Up to 14 months, then deleted automatically by Google. |
| Cookies | Each cookie’s lifetime is listed in our cookie policy. |
7. Keeping it safe
The whole site runs over an encrypted connection (HTTPS), and browsers are told never to load it any other way. Contact-form messages are kept in a database behind a password-protected admin area that only we can reach. We only ask for what we need, and we delete it when we no longer need it.
No system is completely secure. If something ever went wrong that put your information at risk, we would tell you and, where the law requires it, the UK’s data protection regulator, the Information Commission (still known as the ICO).
8. Your rights
You can ask us to:
- give you a copy of the personal information we hold about you
- correct anything that’s wrong or incomplete
- delete it, where we no longer have a good reason to keep it
- limit how we use it while a concern is looked into
- stop using it where we rely on legitimate interests, unless we have strong grounds to carry on
- send it to you, or to another organisation, in a format a computer can read, where you gave it to us under a contract or with your consent
Where we rely on your consent (analytics cookies), you can withdraw it at any time with the Cookie settings link at the bottom of every page.
To use any of these rights, email customcodedwebsites@
Complaints
If you’re unhappy with how we’ve handled your information, you can complain to us: email customcodedwebsites@
You can also complain to the UK’s data protection regulator, the Information Commission (still known as the ICO), at ico.org.uk/make-a-complaint or on 0303 123 1113. It usually asks you to raise the complaint with us first.
9. Google reviews on this site
Some pages show reviews people have left for us on Google, with the reviewer’s name as it appears on Google and a link to their Google profile, as Google requires. We copy them from Google about once a day. If you’ve reviewed us and want your review off this site, edit or delete it on Google and it will disappear here within a day, or email us and we’ll hide it.
10. Children
Our services are for businesses, and this site isn’t aimed at children. We don’t knowingly collect information about anyone under 16. If you think a child has sent us their details, tell us and we’ll delete them.
11. Changes to this policy
We’ll update this policy when the way we handle information changes, and change the date at the top of the page. If a change affects information you’ve already given us, we’ll tell you directly before it takes effect.
12. Contact us
Questions about this policy or your information are welcome.
- Post
- Custom Coded Websites Ltd, Office 14883, 182–184 High Street North, East Ham, London E6 2JA
- Company
- Registered in England and Wales, number 16762286
- ICO registration
- ZC087180