Short version: this website collects whatever you type into the contact form, and, only if you agree to it, statistics about how you use the site through Google Analytics. I use the first to reply to you and the second to understand which pages are useful. I don’t sell either, I don’t subscribe you to anything, and I delete things when they’re no longer useful. The long version is below.

Effective date: 4 October 2026

Who I am

I’m Jason Westwood, trading as Westwood Digital Advisory, and I run this website. For data protection purposes I’m the data controller for any information you send me through this site.

Contact: hello@westwooddigital.co.uk
Postal address: available on request
ICO registration: registration pending. I’ll add the number here once I have it

What I collect

If you fill in the contact form on this website, I receive the following:

• Your name
• Your company name
• Your email address
• The enquiry type you selected (if any)
• The message you wrote
• Which page of the website you submitted the form from

If you accept analytics cookies, Google Analytics also records how you use the site: the pages you visit, how you arrived, your approximate location (country or city level), and your device and browser type. It isn’t linked to your name and I don’t use it to identify you. If you decline, Google Analytics collects none of this.

Your IP address and browser details are visible to my hosting provider and to Formspree (the form processor, see below), in the normal course of them keeping the service running, but I don’t collect or use them.

Why I collect it

To reply to you. That’s the only purpose. If your enquiry turns into an engagement and you become a client, I’ll then process your information under whatever contract we agree, but that’s a separate matter and I’ll explain it at the time.

Under UK GDPR, my legal basis for processing your contact-form submission is legitimate interest: specifically, responding to a business enquiry you’ve initiated. You haven’t subscribed to a newsletter or a marketing list by submitting the form, and I won’t treat you as if you have.

For analytics, my legal basis is consent, which you give or refuse through the cookie banner. I use analytics data only to understand which pages are useful and how people find the site. You can change your mind at any time.

Who else sees it

Three third parties help run this website:

• Formspree (Formspree, Inc., based in the United States) processes the form submission and forwards it to me. They act as a data processor on my behalf. Their privacy policy is at formspree.io/legal/privacy-policy. They hold submissions on their servers for a short period so I can review them in their dashboard if my email misses one.
• IONOS (IONOS SE, Germany) hosts this website. They don’t see your form submissions as content, but standard server logs, including IP addresses of visitors, pass through their infrastructure. Their privacy policy is at ionos.co.uk/terms-gtc/privacy-policy.
• Google (Google LLC, United States, and Google Ireland Limited) provides Google Analytics, but only if you accept analytics cookies. Google acts as a data processor for this. Google Analytics 4 doesn’t store IP addresses, and I don’t share analytics data with Google for advertising. Their privacy policy is at policies.google.com/privacy.

When your data reaches me, it lives in my business email. My business email uses a mainstream UK-appropriate provider with sensible security in place: MFA, recovery processes, the usual. I don’t put enquiry information into any other system unless we enter into a contract, at which point I’ll tell you which tools I use.

I don’t sell your data, I don’t share it with marketing partners, and I don’t use it to profile you.

International transfers

Formspree is based in the United States. Your submission therefore briefly travels outside the UK. Formspree relies on standard contractual clauses for this transfer, which is the mechanism UK law recognises for moving personal data to the US. If you’re uncomfortable with a US-based form processor, you can email me directly instead of using the form and your data never leaves the UK.

If you accept analytics cookies, Google may process analytics data in the United States. Google is certified under the UK Extension to the EU-US Data Privacy Framework (the “UK-US data bridge”), which UK law recognises for these transfers. If you decline analytics cookies, the site sends nothing to Google.

How long I keep it

If your enquiry doesn’t lead anywhere, I delete it within 24 months. Where it turns into a conversation that doesn’t become an engagement, I keep the email trail for up to 24 months after our last exchange in case you come back. Ask me to delete it sooner and I will.

If you become a client, I keep correspondence related to our engagement for as long as it’s reasonably needed for tax, contractual, or professional-liability reasons. That’s typically six years after the engagement ends, which matches standard UK retention for business records.

Google Analytics keeps data for 14 months and then deletes it automatically.

Your rights

Under UK GDPR you have the right to:

• Access: ask me what information I hold about you
• Correct: ask me to fix anything that’s wrong
• Delete: ask me to remove your information (subject to the tax/contract exceptions above)
• Object: tell me to stop processing your information
• Portability: ask for a copy of your information in a common format
• Withdraw consent: for analytics cookies, change your choice at any time using the cookie settings button on this site

To exercise any of these, email me at hello@westwooddigital.co.uk. No specific form, no bureaucracy. A sentence explaining what you want is fine. I’ll respond within a working day and action the request within a month (which is the UK GDPR requirement).

If you’re not happy with how I’ve handled your data, you can complain to the UK’s Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113. I’d rather you talked to me first, but you don’t have to.

Cookies and tracking

When you first visit, a banner asks whether you accept analytics cookies. The site sets nothing non-essential until you choose, and declining is as easy as accepting.

• Essential: a cookie that remembers your cookie choice, so the banner doesn’t keep reappearing. Formspree also sets a session cookie briefly while you submit the form. WordPress sets technical cookies if you log in to the admin, which only I do.
• Analytics (only with your consent): Google Analytics sets _ga and _ga_* cookies to tell visits apart and measure how the site is used. These last up to two years unless you clear them or withdraw consent.

There’s no advertising tracking, no Facebook Pixel, and nothing that follows you across other websites. You can change your choice at any time using the cookie settings button on this site, or by clearing cookies in your browser.

Children

This website is aimed at UK business owners and directors. It’s not designed for or directed at anyone under 18. If you’re under 18, please don’t use the contact form without an adult’s involvement.

Changes to this policy

If I update this page materially (for example, if I add new tools or change how I handle data), I’ll update the effective date at the top and make sure anyone with an active enquiry with me knows about the change. Trivial updates (typo fixes, clarifications) won’t trigger a notification.