Privacy Policy

1. What We Collect and Why

Website visitors

When you browse our website, we collect anonymised usage data through Umami Analytics. This includes pages you visit, time spent on site, where you came from, your device type, and your approximate location (country and city level). Umami does not use cookies and does not collect anything that identifies you personally.

We also use Facebook Pixel (Meta) to measure how well our adverts perform. This may set cookies on your device and collect data about your browsing after you see our adverts on Facebook or Instagram. We only load this after you give consent via our cookie banner.

Website checker and free report

If you use our free website checker tool, we collect your website URL, business name, and email address so we can send you your results. We also record which pages you view and how long you spend reading your report so we can follow up with relevant information.

Get Started form

If you fill in our Get Started form, we collect your name, email address, phone number, business name, business type, location, and your answers to our questions. We use this to understand your needs and get in touch with a tailored suggestion.

Contact form

If you use our contact form, we collect your name, email address, and message so we can reply to your enquiry.

Email communications

When we send you emails (for example, your website report or follow-up information), we may track whether you open the email and click any links. This helps us understand what information is useful to you and when to follow up.

Clients

If you become a client, we also collect information needed to deliver our services and manage your account. This includes your business address, payment details (handled securely by Stripe), project files, login credentials for services we manage on your behalf, and any communications between us about your project.

2. Our Legal Basis for Processing

Under UK GDPR, we must have a lawful reason for processing your personal data. Here are the reasons we rely on:

• Consent: when you fill in a form on our site, accept cookies, or ask us to contact you. You can withdraw consent at any time by emailing us.
• Contract: when we need your information to deliver services you have paid for, or to take steps before entering into a contract (such as providing a quote).
• Legitimate interest: to improve our website, follow up on genuine enquiries, and send relevant business information to people who have shown interest in our services. We always balance our interests against your rights.
• Legal obligation: where the law requires us to keep records (for example, invoices for tax purposes).

3. How We Use Your Information

• To respond to your enquiry or provide a quote
• To send you your free website report or action plan
• To follow up with relevant information if you have shown interest in our services
• To deliver and manage web design and hosting services
• To process payments and send invoices
• To improve our website and understand how visitors use it
• To measure the performance of our advertising
• To meet our legal and tax obligations

We will never sell, rent, or share your personal information with third parties for their marketing purposes.

4. Who We Share Your Data With

We use a small number of trusted services to run our business. Each one only processes your data on our instructions and under contract. Our full list of sub-processors is available at obrix.co.uk/legal/sub-processors.

In summary, we use:

• Supabase (database hosting) to store form submissions and account data
• Resend (email delivery) to send emails on our behalf
• Vercel (website hosting) to host and serve our website
• Stripe (payments) to process card payments securely. We never see or store your full card number.
• Umami (analytics) to collect anonymised website usage data
• Meta / Facebook (advertising) to measure advert performance. Only loaded with your consent.

We may also share your data if required by law, regulation, or court order.

5. International Transfers

Some of our sub-processors are based in the United States. Where your data is transferred outside the UK, we make sure there are appropriate safeguards in place, such as Standard Contractual Clauses or the service being certified under a recognised framework. See our sub-processor register for details on each provider's location and safeguards.

6. Cookies

Our website uses very few cookies. We only set non-essential cookies after you give consent through our cookie banner.

• Umami Analytics: does not use cookies at all.
• Facebook Pixel (_fbp, _fbc): set only after you consent. Used to measure advert performance. Expires after 90 days.
• Cookie consent preference: remembers your choice. Expires after 1 year.

You can withdraw cookie consent at any time by clearing your browser cookies and revisiting our site.

7. How Long We Keep Your Data

• Enquiry and form data: up to 2 years after your last interaction with us, then deleted.
• Client project data: for the length of our service agreement, plus 6 years afterwards for legal and accounting purposes.
• Invoices and payment records: 6 years (required by HMRC).
• Email engagement data: up to 12 months, then deleted.
• Analytics data: held by Umami in anonymised form. Not personally identifiable.

8. Your Rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you
• Correct any inaccurate or incomplete data
• Delete your data (the “right to be forgotten”)
• Object to processing based on legitimate interest
• Restrict how we use your data in certain cases
• Data portability (receive your data in a common format)
• Withdraw consent at any time, where consent is our basis for processing

To exercise any of these rights, email us at ryan@obrix.co.uk. We will respond within 30 days. There is no fee for making a request unless it is clearly excessive or repetitive.

9. Marketing and Follow-Ups

If you fill in a form on our site, we may send you helpful follow-up information related to your enquiry. This is not a mailing list. You can opt out at any time by clicking the unsubscribe link in any email we send, or by emailing us directly.

We do not send bulk marketing emails to purchased lists. We only contact people who have interacted with us directly.

10. Data Security

We take appropriate steps to protect your personal data. This includes:

• HTTPS encryption on all pages
• Strict security headers (HSTS, Content Security Policy, and others)
• Row-level security on our database
• Access restricted to only the people who need it to do their job
• Regular review of our sub-processors and their practices

No system is 100% secure. If we ever become aware of a data breach that affects your rights, we will notify you and the ICO as required by law.

11. Children

Our services are aimed at businesses. We do not knowingly collect personal data from anyone under 18.

12. Changes to This Policy

We may update this policy from time to time. Any changes will be posted on this page with a new “last updated” date. If we make a significant change, we will take reasonable steps to let you know.

13. Contact Us

If you have any questions about this policy or your personal data, contact us:

• Email: ryan@obrix.co.uk
• Post: Castlegate Property Solutions Ltd, 38 Hanover Crescent, Shotton Colliery, DH6 2NR

14. Complaints

If you are unhappy with how we have handled your personal data, you have the right to complain to the Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Helpline: 0303 123 1113