Privacy policy.

1 Who we are

Oxsites is a web design, development and hosting business based in Oxford, United Kingdom. For the purposes of UK GDPR, Oxsites is the data controller for the information described in this policy.

You can reach us at any time at contact@oxsites.com, and we will give you our full registered details and postal address on request.

2 Information we collect

We only collect what we need to reply to you and keep the site running properly:

• Contact details you give us in the quote form: your name, business name, email address, the type of business you run, and anything you write in the message box.
• Anything else you send us by email or tell us during a call about your project.
• Technical data such as your IP address, browser type and device, recorded automatically in our server logs for security and to keep the site running reliably.
• A short-lived, one-way encrypted record of your IP address when you submit the quote form, used only to stop automated abuse of the form. It cannot be read back as an address and is discarded within the hour.

3 How we use it

• Replying to your enquiry and preparing your quote.
• Designing, building, hosting and supporting your website if you become a client.
• Security, fraud prevention and meeting our legal obligations.

We will not add you to a marketing list off the back of a quote request, and we do not send unsolicited marketing.

4 Our legal basis

• Legitimate interests — replying to your enquiry, preparing your quote, and keeping the site secure. It is in both our interests that we answer the question you asked us.
• Performance of a contract — designing, building, hosting and supporting your website once you become a client.
• Legal obligation — keeping accounting records and responding to lawful requests.

We do not rely on consent for anything at present, because we do not run advertising, profiling or marketing cookies. If that changes, we will ask you first.

5 Cookies

This site sets one cookie, and only once you start filling in the quote form. It is a session cookie that carries a security token proving the form was submitted from our site. It contains nothing that identifies you, it is deleted when you close your browser, and it is not used to track you or advertise to you.

Because that cookie is strictly necessary for a feature you asked for, UK cookie rules (PECR) do not require us to ask your permission for it, which is why you are not greeted by a consent banner. If you simply read the site and never touch the form, we set no cookies at all.

We do not currently run Google Analytics, or any other analytics or advertising tool, on this site. If we ever add one, we will update this policy and put a proper accept-or-decline cookie banner in place first, and nothing non-essential will be set until you agree to it.

The site loads its typefaces from Google Fonts. That sets no cookies, but it does mean Google receives your IP address in order to serve the font files. You can block or clear cookies in your browser settings at any time, and the site will still work.

6 Who we share it with

We do not sell your personal data, ever.

We share data only with the service providers we need to run the business: our hosting provider, and the email provider that delivers your enquiry to our inbox. They act on our instructions, are bound by their own data protection obligations, and only receive what is necessary. We may also disclose information if we are legally required to.

7 Where your data goes

Your data is normally handled inside the UK or the European Economic Area. Where a provider we rely on processes data outside those areas, we make sure an appropriate safeguard recognised by UK law is in place, such as the UK International Data Transfer Addendum or standard contractual clauses.

8 How long we keep it

Enquiry data is kept only as long as it is useful for the purposes above, or as long as the law requires. If your enquiry does not turn into a project, we delete it within 12 months.

If you become a client, we keep your project files for the length of our working relationship and for 12 months afterwards, and billing records for 6 years, as UK tax rules require.

9 Your rights

Under UK GDPR you have the right to ask us for a copy of the personal data we hold about you, to have it corrected if it is wrong, or to have it deleted. You can also object to how we process it, ask us to restrict processing, or request that we transfer it elsewhere.

Email us and we will action any of these free of charge, normally within one month. Where we rely on legitimate interests, you can object at any time and we will stop unless we have compelling grounds not to. If you are unhappy with how we have handled your data, you can complain to the Information Commissioner’s Office at ico.org.uk.

10 Contact us

For anything to do with privacy, or to exercise any of the rights above, email contact@oxsites.com and a real person will reply.