1. Who We Are
GB Sites LTD ("we", "us", "our") is a company registered in England and Wales. Our registered company number is 17106182 and our registered address is 22 South Road, Sandy, England, SG19 1HE.
We operate the website at www.gbsites.co.uk (the "Site") and provide website design, build, hosting, and related digital services to UK small businesses (the "Services").
For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018), GB Sites LTD is the data controller in respect of personal data processed as described in this Privacy Policy.
Our data protection contact is: admin@greatbritishsites.co.uk.
We are registered with the Information Commissioner's Office (ICO). Our ICO registration number is [ICO REGISTRATION NUMBER — registration in progress].
2. Scope of This Policy
This Privacy Policy applies to:
- visitors to and users of the Site;
- prospective clients who submit an enquiry via our contact form or otherwise communicate with us;
- existing clients whose personal data is processed in connection with the delivery of our Services; and
- any other individual whose personal data we process in the ordinary course of our business operations.
This Policy does not apply to third-party websites that may be linked to from the Site. We are not responsible for the privacy practices of those websites and we encourage you to review their policies independently.
Where we process personal data on behalf of our clients (for example, personal data relating to their own website visitors), we do so as a data processor. In those circumstances, the relevant client is the data controller and their privacy policy governs that processing. A separate data processing agreement is available upon request.
3. Personal Data We Collect
3.1 Data you provide to us directly
We collect the following categories of personal data that you voluntarily provide when interacting with us:
- Enquiry and contact data: your name, email address, business name, and the content of any message or description you submit via our contact form or by email.
- Client account data: your name, business name, email address, billing address, and payment reference information (we do not store payment card details — card processing is handled by our payment provider).
- Correspondence data: records of communications between you and us, including emails and any attachments.
- Contractual data: information contained in or generated pursuant to service agreements, including plan selection, add-on choices, and project requirements.
3.2 Data collected automatically
When you visit the Site, we or our third-party service providers may automatically collect the following technical data:
- your IP address and approximate geographic location (derived from IP);
- browser type and version;
- operating system;
- pages viewed, time spent on pages, and navigation paths;
- referring URL; and
- date and time of access.
This data is collected primarily through cookies and similar technologies. Please see Section 7 (Cookies) for further information.
3.3 Special category data
We do not intentionally collect or process any special category personal data (as defined in Article 9 UK GDPR) or personal data relating to criminal convictions or offences. Please do not submit such data to us.
4. Lawful Bases for Processing
Under Article 6 of the UK GDPR, we must have a lawful basis for processing your personal data. The lawful bases we rely upon are as follows:
| Processing Activity | Lawful Basis | Details |
|---|---|---|
| Responding to an enquiry submitted via the contact form | Legitimate interests (Article 6(1)(f)) | It is in our legitimate interests to respond to prospective clients who have actively contacted us. This interest is not overridden by your rights given the limited and expected nature of the processing. |
| Performance of a service agreement (existing clients) | Contract (Article 6(1)(b)) | Processing is necessary for the performance of the contract between us or to take steps at your request prior to entering into a contract. |
| Sending direct marketing communications to existing clients | Legitimate interests (Article 6(1)(f)) | We may send you relevant communications about our Services. You can opt out at any time. See Section 6. |
| Compliance with legal obligations (e.g. tax, accounting records) | Legal obligation (Article 6(1)(c)) | We are required by law to retain certain financial and business records. |
| Website analytics and performance monitoring | Legitimate interests (Article 6(1)(f)) / Consent (Article 6(1)(a)) where cookies are used | We have a legitimate interest in understanding how our Site is used. Where analytics cookies are deployed, we rely on your consent obtained via our cookie banner. |
5. How We Use Your Personal Data
We use the personal data we collect for the following purposes:
- to respond to your enquiry and, where appropriate, to provide you with a quotation or proposal;
- to enter into, administer, and perform our contractual obligations under our service agreements with you;
- to process payments and manage billing;
- to provide ongoing support, maintenance, and account management in connection with your subscription;
- to send you service-related communications (for example, invoices, renewal notices, and important updates regarding your website or our Services);
- to improve the Site and our Services through analysis of usage data;
- to comply with our legal, regulatory, and accounting obligations; and
- to establish, exercise, or defend legal claims.
We will not use your personal data for any purpose that is incompatible with the purposes described above without first providing you with notice and, where required, obtaining your consent.
6. Direct Marketing
We may send direct marketing communications to existing clients by email, where we rely on the soft opt-in provided under Regulation 22 of the Privacy and Electronic Communications Regulations 2003 (PECR). This permits us to market similar products and services to existing customers without separate consent, provided you were given the opportunity to opt out at the point of data collection and are given a clear opportunity to opt out in each subsequent communication.
We will never send direct marketing to non-clients without their prior express consent.
You have the right to object to direct marketing at any time. To opt out, simply:
- click the "unsubscribe" link in any marketing email we send you; or
- email us at admin@greatbritishsites.co.uk with the subject line "Marketing opt-out".
We will action your opt-out request without undue delay and within no more than five business days. Opting out of marketing will not affect the delivery of service-related communications (such as invoices or support correspondence).
7. Cookies and Similar Technologies
Our Site uses cookies and similar tracking technologies. A cookie is a small text file placed on your device when you visit a website. We use the following categories of cookies:
7.1 Strictly necessary cookies
These cookies are essential for the Site to function and cannot be disabled. They do not require your consent under PECR.
7.2 Analytics and performance cookies
These cookies allow us to count visits and traffic sources so we can measure and improve the performance of the Site (for example, via Google Analytics). They are activated only upon your consent via our cookie banner.
7.3 Functional cookies
These cookies enable enhanced functionality, such as remembering your preferences. They require your consent where not strictly necessary.
You may withdraw your consent to non-essential cookies at any time by adjusting your preferences via our cookie management tool [insert link to cookie settings] or by configuring your browser settings to refuse cookies. Please note that disabling certain cookies may affect the functionality of the Site.
For detailed information about the specific cookies we use, their purpose, and their duration, please refer to our Cookie Policy.
8. Sharing and Disclosure of Your Personal Data
We do not sell, rent, or trade your personal data to any third party. We may share your personal data in the following limited circumstances:
8.1 Service providers and sub-processors
We engage carefully selected third-party service providers to assist in the delivery of our Services and the operation of our business. These parties act as data processors on our behalf and are contractually bound to process your data only on our documented instructions and in compliance with UK GDPR. Current categories of sub-processor include:
- Hosting and infrastructure providers — for hosting client websites and our own Site;
- Email delivery services — for sending transactional and service communications;
- Payment processors — for processing subscription and other payments securely;
- Analytics providers — for Site performance analysis (subject to your cookie consent); and
- Form submission services — for routing enquiry form submissions.
8.2 Legal and regulatory disclosure
We may disclose personal data where required to do so by law, court order, or pursuant to a lawful request from a competent authority (such as HMRC, the police, or another regulatory body). Where legally permitted, we will endeavour to notify you of such a request before disclosing your data.
8.3 Business transfers
In the event of a merger, acquisition, reorganisation, or sale of all or a material portion of our business assets, personal data held by us may be transferred to the successor entity. We will notify affected individuals in accordance with our obligations under UK GDPR before any such transfer takes effect.
8.4 Professional advisers
We may share personal data with our legal advisers, accountants, and insurers where necessary for them to provide professional services to us, subject to applicable duties of confidentiality.
9. International Transfers of Personal Data
Where we transfer personal data outside the United Kingdom, we ensure that appropriate safeguards are in place as required by Chapter V of the UK GDPR and Part 3 of the DPA 2018. Such safeguards may include:
- transfer to a country subject to an adequacy decision made by the Secretary of State under section 17A of the DPA 2018;
- use of the International Data Transfer Agreement (IDTA) or, where applicable, the UK Addendum to the EU Standard Contractual Clauses; or
- reliance on another appropriate transfer mechanism in accordance with Article 46 UK GDPR.
You may request further information about the specific safeguards applicable to any international transfer of your personal data by contacting us at admin@greatbritishsites.co.uk.
10. Retention of Personal Data
We retain personal data for no longer than is necessary for the purposes for which it was collected, having regard to the following principles and obligations:
| Category of Data | Retention Period | Rationale |
|---|---|---|
| Enquiry / contact form data (where no contract follows) | 12 months from date of enquiry | To allow adequate time to respond and follow up, after which the data is no longer required. |
| Client account and contractual data | Duration of contract + 6 years | To satisfy the statutory limitation period under the Limitation Act 1980 (simple contract: 6 years) and to enable us to defend any potential claim. |
| Financial and accounting records (invoices, payments) | 6 years from the end of the relevant financial year | Obligations under the Companies Act 2006 and HMRC requirements. |
| Email correspondence | Duration of client relationship + 2 years | Reasonable operational and legal purposes. Reviewed on an ongoing basis. |
| Website analytics data (anonymised) | 26 months (default Google Analytics setting) | Industry-standard analytics retention. Data is anonymised and therefore falls outside the scope of UK GDPR upon anonymisation. |
At the end of the applicable retention period, personal data will be securely deleted or anonymised.
11. Your Rights Under UK GDPR
As a data subject, you have the following rights under the UK GDPR and DPA 2018. These rights are not absolute and are subject to certain conditions and exemptions set out in the legislation.
| Right | What It Means |
|---|---|
| Right of access (Article 15) | You have the right to obtain confirmation of whether we process your personal data and, if so, to receive a copy of it along with supplementary information about how it is used (a Subject Access Request or "SAR"). |
| Right to rectification (Article 16) | You have the right to require us to correct inaccurate personal data and, having regard to the purposes of the processing, to have incomplete personal data completed. |
| Right to erasure (Article 17) | You have the right to request that we erase your personal data in certain circumstances — for example, where it is no longer necessary for the purposes for which it was collected, or where you withdraw consent and there is no other lawful basis. |
| Right to restrict processing (Article 18) | You have the right to request that we suspend processing of your personal data in certain circumstances — for example, where you contest its accuracy or have objected to our processing pending verification of our legitimate grounds. |
| Right to data portability (Article 20) | Where processing is based on your consent or the performance of a contract, and carried out by automated means, you have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit it to another controller. |
| Right to object (Article 21) | You have the right to object, on grounds relating to your particular situation, to processing based on our legitimate interests. We must cease processing unless we can demonstrate compelling legitimate grounds that override your interests, or the processing is for the establishment, exercise, or defence of legal claims. You have an absolute right to object to direct marketing at any time. |
| Rights related to automated decision-making (Article 22) | You have the right not to be subject to a decision based solely on automated processing (including profiling) that produces legal or similarly significant effects. We do not currently engage in any such automated decision-making. |
| Right to withdraw consent (Article 7(3)) | Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal. |
How to exercise your rights
To exercise any of the above rights, please submit a written request to us by email at admin@greatbritishsites.co.uk with the subject line "Data Subject Request". We may need to verify your identity before processing your request.
We will respond to your request without undue delay and, in any event, within one calendar month of receipt. Where a request is complex or we have received a large number of requests, we may extend this period by a further two months, in which case we will notify you within the initial one-month period and provide reasons for the extension.
There is no charge for exercising your rights unless the request is manifestly unfounded or excessive, in which case we may charge a reasonable fee or decline to act.
12. Children
Our Site and Services are directed exclusively at businesses and individuals aged 18 years or over. We do not knowingly collect personal data from children under the age of 18. If you believe we have inadvertently collected personal data from a child, please contact us immediately at admin@greatbritishsites.co.uk and we will take prompt steps to delete such data.
13. Security of Personal Data
We implement appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction, or damage, having regard to the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing, as well as the risk of varying likelihood and severity to the rights and freedoms of individuals (Article 32 UK GDPR).
Such measures include, without limitation:
- SSL/TLS encryption for data transmitted between your browser and our Site;
- access controls restricting personal data to authorised personnel on a need-to-know basis;
- use of reputable and contractually bound third-party processors;
- regular review of our data handling practices; and
- secure disposal of personal data at the end of the applicable retention period.
Notwithstanding the above, no method of transmission over the internet or method of electronic storage is entirely secure. We cannot guarantee absolute security but we will notify you and the ICO in accordance with our obligations under Article 33 and 34 UK GDPR in the event of a personal data breach that is likely to result in a risk to your rights and freedoms.
14. Third-Party Websites
The Site may contain links to third-party websites, including social media platforms and service providers. We have no control over the content, privacy policies, or practices of those websites. This Privacy Policy applies solely to personal data processed by GB Sites LTD. We strongly encourage you to review the privacy policies of any third-party sites you visit.
15. Changes to This Privacy Policy
We reserve the right to update or amend this Privacy Policy from time to time to reflect changes in our data processing activities, changes in applicable law, or guidance issued by the ICO or other supervisory authority.
Material changes will be notified to existing clients via email to the address held on their account at least 14 days before coming into effect. Non-material changes will take effect upon publication on the Site. The "Last reviewed" date at the top of this Policy will be updated accordingly.
We encourage you to review this Policy periodically. Your continued use of the Site or Services following notification of a change constitutes your acknowledgment of the amended Policy.
16. How to Contact Us
All data protection enquiries, Subject Access Requests, and requests to exercise your rights should be directed to:
Email: admin@greatbritishsites.co.uk
Registered Address: 22 South Road, Sandy, England, SG19 1HE
Company Number: 17106182
Please mark the subject line of your email clearly (for example: "Subject Access Request", "Data Erasure Request", or "Privacy Enquiry") to ensure your request is dealt with promptly.
17. Right to Lodge a Complaint with the ICO
If you are dissatisfied with how we have handled your personal data or responded to your rights request, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), which is the supervisory authority for data protection in the United Kingdom.
Website: www.ico.org.uk
Helpline: 0303 123 1113
Post: ICO, Wycliffe House, Water Lane, Wilmslow, SK9 5AF
We would, however, appreciate the opportunity to address your concerns before you approach the ICO. Please contact us in the first instance at admin@greatbritishsites.co.uk.