Privacy notice

This notice explains what personal data West Country Digital collects, why we collect it, how we use it, and the rights you have over it. It also explains our role when we process data on behalf of our clients, for example as the developer and host of bespoke software for care sector organisations. We have tried to keep it plain and short.

Who we are

West Country Digital is the trading name of West Country Digital Ltd, a limited company registered in England and Wales under company number 17305076, founded and run by Will Crawshaw and Harvey Wood. Our registered office is Flat 303 Gosling Lodge, 8 West Parkside, London, SE10 0PD. For the personal data described in the sections below on this page (up to and including “Your rights”), we are the “data controller”, meaning we decide what is collected and why. Further down, “Working with our client organisations” explains a different role we sometimes hold: data processor.

We are registered with the Information Commissioner’s Office, the UK’s independent data protection regulator, under registration number ZC186083. You can verify this on the ICO’s public register at ico.org.uk.

If you have questions about your data, or want to make a request under UK data protection law (UK GDPR), email us at hello@westcountrydigital.com.

What we collect and why

1. Bookings and calls

When you book a call through our website, we collect your name, business name, email address, phone number, the services you are interested in, what you would like help with and the time you choose. If you book through a referral link, we also collect the name of the person who referred you, so we know who to thank and, where agreed, pay. We use this only to arrange, confirm, prepare for and run the call.

The booking creates an event in our Google Calendar (part of Google Workspace) and generates a Google Meet video link, which Google emails to you as a calendar invitation. We also receive an internal notification email about the booking, delivered through Resend. We do not use your booking details for marketing.

2. Email correspondence

If you email us directly, we will have your email address and whatever you write. We keep correspondence for as long as it is useful for our working relationship, then delete it.

3. Server and security logs

Our site is served via Cloudflare, which keeps basic request logs (IP address, timestamp, page requested) for security, abuse prevention and performance reasons. These logs are retained by Cloudflare on a rolling short term basis and we do not combine them with anything else.

4. Visitor statistics and cookies

We count visits to this website so we can see which pages are useful and improve it. For each page you view we record the page, how long it was on your screen, how far down you scrolled and which parts of it you saw, how quickly it loaded, the website you came from (its name only, such as google.com) and any campaign name in the link you followed. We record the buttons, links and questions you press, by their wording on the page, and how far you get through booking a call, including which form field you were in, but never anything you type. We also record whether you are on a phone, tablet or computer, your screen width, the names of your browser, its language and your operating system, the town and country that our host, Cloudflare, places your connection in, and any errors in our website’s own code.

We do not record your IP address, your name or anything else that identifies you, and we do not set any cookies. Your browser keeps a random visit number in its session storage, which links the pages of one visit together and is deleted when you close the tab or after 30 minutes without activity. Your choice in our cookie banner is kept in your browser’s local storage, so the banner does not appear on every page. We use no advertising, session recording or third party analytics tools, and the statistics are never shared or used to build a profile of you.

Visitor statistics are on unless you turn them off, which you can do at any time:

Cookie settings

The statistics are kept in our own Cloudflare account and deleted after two years. The website’s typeface is loaded from Fontshare, which receives your IP address and browser details when a page loads, as happens with most websites you visit.

Legal basis, sharing and retention

Under UK GDPR we rely on the following legal bases:

• Legitimate interests, for responding to your enquiries, arranging and running calls, providing our services, basic security logging, and counting visits so we can improve this website. UK law allows statistics like these without asking first, provided we tell you and you can turn them off.
• Contract, where you have engaged us as a client, to perform the work agreed.

We do not sell your data. We use the following processors, each of which handles specific data on our behalf under their own privacy commitments:

• Cloudflare: site hosting, DNS, security logs and visitor statistics, on its global edge network.
• Google Workspace (Calendar and Meet): business email and documents; call bookings, calendar invitations and video links. USA, with UK and EU safeguards.
• Resend: delivering internal booking notification emails. USA and EU, with UK and EU safeguards.
• Fontshare: delivering the website’s typeface.

Where a processor is based outside the UK or EU, we rely on UK International Data Transfer Agreements, the EU Standard Contractual Clauses, or equivalent safeguards as set out in those providers’ terms.

How long we keep your data:

• Booking details: held as calendar events in our Google Workspace, and within the related booking notification emails. We remove them when they are no longer needed for our records.
• Enquiries that do not lead to work: kept for up to 24 months from your last contact. Deleted on request.
• Client correspondence: kept for the duration of our working relationship plus 6 years for accounting and legal record purposes.
• Server logs: short term rolling retention by Cloudflare (typically days, not months).
• Visitor statistics: deleted after two years.

Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you
• Have inaccurate data corrected
• Have your data erased (the “right to be forgotten”)
• Restrict or object to our processing of your data
• Receive your data in a portable format

To exercise any of these rights, email hello@westcountrydigital.com. We will respond within one month. If your data is processed through software we have built for a client organisation, such as a care provider, these rights are exercised with that organisation directly, not with us. See “Working with our client organisations” below for why.

If you are not happy with how we have handled your data, you can complain to the Information Commissioner’s Office (ICO) at ico.org.uk. We would appreciate the chance to address your concerns first, but it is your right to go directly to the ICO.

Working with our client organisations

West Country Digital designs, and in most cases hosts and supports, bespoke software for organisations including those in health and social care. Where we do this, our client (for example, a home care provider) is the data controller for the personal data held in that software: information about the people they support, their staff, and their day-to-day operations. We act only as their data processor. We process this data on their behalf, only for the purposes they have instructed, and under a written data processing agreement between us.

We do not decide what data is collected, why it is collected, or how long it is kept; those decisions sit with our client. If your data is held in a system we have built or support, and you have a question about how it is used, or want to exercise a right such as access, correction or erasure, please contact that organisation directly. They are the data controller and are responsible for responding to you.

We have completed the NHS Data Security and Protection Toolkit, the annual assessment the NHS uses to check that organisations handling health and social care data meet the required standards for data security and information governance. We are also Cyber Essentials certified, the UK Government-backed standard that protects against the most common cyber attacks. Details of all our registrations and certifications, and how to verify each of them independently, are on our compliance page.

We take our responsibilities as a processor seriously. Where we can access personal data within a client’s system, that access is:

• limited to a small number of named, authorised individuals working on that engagement;
• protected by multi factor authentication and logged on the client’s own audit trail;
• never copied, exported or reused outside delivering the agreed service; and
• removed when an individual leaves the engagement, and removed entirely when the contract ends, unless the client asks us to retain support access.

If you have a concern specifically about how we, as a processor, have handled data on a client’s behalf, you are welcome to contact us at hello@westcountrydigital.com and we will look into it together with the relevant client.

Accessibility and other formats

This notice is published here in plain, web accessible HTML for anyone to read at any time, free of charge. We do not currently issue this notice in printed form, since West Country Digital does not deliver care services directly or meet service users in person; where one of our client organisations provides service users with printed information (for example a leaflet on admission to their service), that is the client’s own document as data controller, published separately from this notice.

If you need this notice in a different format, for example large print, an audio version, or a translated copy, contact us at hello@westcountrydigital.com and we will do our best to help.

Changes to this notice

If we make material changes we will update the date at the top and, where appropriate, flag the change on the site. The current version is always the one published here.

Contact

Questions, requests or complaints: hello@westcountrydigital.com