Privacy Notice
Last updated: [DATE OF PUBLICATION]
- Every highlighted field below.
- Pay the ICO data protection fee and put the registration number in. It is £52 or £78 a year for a business this size. Check first with the ICO's own self-assessment at ico.org.uk.
- Delete this box.
This notice explains what I do with personal information, why, and what you can ask me to do about it. It is written to be read, not to be survived.
Who I am
Saltwork is the trading name of [FULL LEGAL NAME], a sole trader based in Liverpool. I am the data controller for the information described in this notice.
- Address for correspondence: [SERVICE ADDRESS, UK]
- Email: hello@saltwork.co.uk
- ICO registration number: [ICO REGISTRATION NUMBER]
What I collect, and why
I collect very little, and only what I need to answer you or do the work.
| What | Why | Lawful basis |
|---|---|---|
| Your name, email address, phone number and the website address you send me | To reply to you and to carry out the free audit you asked for | Legitimate interests — you contacted me and expect a reply |
| What we agree, quotes, invoices and payment records | To do the work and to keep proper business records | Contract, and legal obligation for the tax records |
| Access details for your website, hosting or accounts, where you give them to me | To do the work you have engaged me to do | Contract |
| Emails you and I exchange | So there is a record of what was agreed | Legitimate interests — keeping an accurate account of the work |
What I do not do
- This website sets no cookies and runs no analytics. Nothing on it tracks you. The detail is in the cookie notice.
- I do not buy or sell contact lists, and I do not add anyone to a mailing list for having emailed me.
- There is no automated decision-making and no profiling.
A note on the free audit
The audit measures a website, not a person: loading times, image sizes, whether the analytics are recording, what search engines can and cannot read. If your site happens to publish personal information — staff names, direct email addresses, customer reviews — I will see it in passing, but I do not collect it, keep it or use it for anything.
How long I keep it
- Enquiries that do not become work: up to 12 months, then deleted.
- Client records, contracts and invoices: at least six years after the last piece of work. HMRC requires the tax records to be kept, and six years is the period in which a contract dispute can still be brought.
- Access credentials: removed as soon as the work is finished. Where I hold them for an ongoing plan, they stay in a password manager and are revoked when the plan ends.
Who else sees it
Only the suppliers I need to run the business, and only what each one needs:
- Email and file storage — [EMAIL / STORAGE PROVIDER]
- Website hosting — [HOSTING PROVIDER, e.g. Cloudflare]
- Accountant — [ACCOUNTANT, once appointed], for the tax records
- HMRC and other authorities, where the law requires it
I do not sell personal information to anyone, ever, and I do not share it for anyone else's marketing.
Information handled outside the UK
Part of the technical work behind Saltwork — building and maintaining websites and software — is carried out by [ANDRÉS SALAMÉ / TRADING NAME] in Peru, working to my instructions. Where that involves personal information, it leaves the UK.
Peru is not covered by UK adequacy regulations, so that transfer is made under an International Data Transfer Agreement (IDTA) together with a transfer risk assessment, which is the safeguard UK law provides for exactly this situation. You can ask me for a copy of the arrangement.
When I am working on your website
If you engage me to build or look after a website or a system, any personal information belonging to your customers stays yours. You remain the controller of it; I act as your processor and only do what you tell me to do with it. That arrangement is set out in the contract we sign, as required by Article 28 of the UK GDPR, and it is a separate document from this notice.
Keeping it safe
- Credentials live in a password manager, never in a spreadsheet, a note or an email.
- Two-factor authentication on every account that offers it.
- Access to a client's systems is requested at the lowest level that does the job, and handed back when the work is done.
No one can promise a system is impossible to breach. If something did go wrong and it put your information at risk, I would tell you, and I would report it to the ICO within 72 hours where the law requires it.
Your rights
Under UK data protection law you can ask me to:
- tell you what I hold about you, and give you a copy;
- correct anything that is wrong;
- delete it, where I have no reason left to keep it;
- restrict what I do with it while a question is being sorted out;
- hand it over in a portable format;
- stop relying on legitimate interests, if you object to it.
Email hello@saltwork.co.uk and I will deal with it within one month. It costs you nothing.
If you are not happy
Tell me first — most things are a misunderstanding and get fixed the same day. If that does not settle it, you have the right to complain to the Information Commissioner's Office, the UK's data protection regulator: ico.org.uk/make-a-complaint, or 0303 123 1113.
Changes to this notice
If the way I handle information changes, I update this page and change the date at the top. If the change is significant and I hold your details, I will email you about it rather than leave you to find it.