Privacy

This notice explains what personal information I collect, why I collect it and what I do with it when you visit this website, contact Punk Web Design, or become a client.

Last updated:

Who is responsible for your information?

Punk Web Design is the trading name of Jess Crees, a sole trader based in England.

I am the data controller for the personal information described in this notice. This means I am responsible for deciding why and how that information is used.

You can contact me about privacy or data protection at hello@punkwebdesign.com.

What information I collect

Depending on how you interact with Punk Web Design, I may collect:

  • Contact information, such as your name, email address, telephone number, and preferred contact method.
  • Business information, such as your business name, role, website address, and the services you are interested in.
  • Project information, including your requirements, content, feedback, website assets, and correspondence.
  • Billing information, including invoice, transaction, and payment status records. I do not normally receive or store your full payment card details.
  • Communication records, including emails, messages, meeting notes, and support requests.
  • Technical information, such as your IP address, browser type, device information, and website security logs.
  • Any other information you choose to provide when contacting or working with me.

Please avoid sending sensitive personal information unless it is genuinely necessary for the service you have requested.

How I collect your information

I normally collect personal information:

  • directly from you when you contact me by email, telephone, or a website form;
  • when you request a quote, website review, or other service;
  • while I am providing services or support to you;
  • automatically through essential website, hosting, and security systems; or
  • from another person, such as when someone refers you to me or introduces us.

Why I use your information

How personal information is used and the relevant lawful basis
Purpose Lawful basis
Responding to enquiries, discussing your requirements, and preparing a quote. Taking steps at your request before entering into a contract, or my legitimate interest in responding to business enquiries.
Providing web design, development, hosting, maintenance, SEO, consultancy, and related services. Performing my contract with you.
Managing projects, communication, support, and the client relationship. Performing my contract with you and my legitimate interest in managing my business effectively.
Creating invoices, maintaining accounts, and meeting tax or legal obligations. Performing my contract with you and complying with legal obligations.
Protecting this website, my systems, and client websites from misuse, attacks, and unauthorised access. My legitimate interest in maintaining the security and reliability of my services.
Maintaining appropriate business records and dealing with complaints, disputes, or legal claims. My legitimate interests and, where applicable, compliance with legal obligations.

Where I rely on legitimate interests, those interests include operating and improving my business, communicating with potential and existing clients, securing my systems, and protecting my legal rights.

When information is required

You are not normally legally required to provide personal information when making an initial enquiry.

However, I will need certain contact, business, and billing information before I can enter into a contract or provide services. If you do not provide the necessary information, I may be unable to provide a quote, complete the work, or support your website.

Who I share information with

I only share personal information where it is necessary to run my business, provide your services, or comply with the law. This may include:

  • Google Workspace, including Gmail, for business email, communication, and document storage;
  • Cloudflare for website security, performance, and network services;
  • website hosting, infrastructure, backup, and form-processing providers;
  • payment, accounting, and bookkeeping providers where needed;
  • professional advisers such as accountants, insurers, or legal advisers; and
  • regulators, law enforcement agencies, or other organisations where disclosure is legally required.

I do not sell or rent your personal information.

How long I keep information

I only keep personal information for as long as it is reasonably needed for the purpose for which it was collected.

  • Enquiries that do not become client projects: normally up to 12 months after our last meaningful contact.
  • Client, contract, and project records: normally up to six years after the client relationship ends, where needed for business records, legal claims, or tax purposes.
  • Invoices and accounting records: for the period required by tax and accounting law.
  • Website files and working backups: normally deleted within three months after hosting or services end, subject to normal backup cycles and any legal requirement to retain particular records.
  • Website and security logs: for as long as reasonably necessary to maintain security, investigate incidents and operate the website.

Information may be retained for longer where it is needed to resolve a dispute, establish or defend a legal claim, investigate misuse, or comply with a legal obligation.

Cookies and website technology

This website does not currently use advertising cookies, behavioural tracking, or non-essential analytics cookies.

Essential cookies or similar technologies may be used where necessary to provide website functionality, maintain security, manage network traffic, or prevent malicious activity.

If non-essential analytics, embedded services, or advertising technologies are added in the future, this notice will be updated and appropriate cookie controls will be provided.

Client websites and client customer data

When I process personal information on behalf of a client while designing, hosting, maintaining, or supporting their website, the client will normally be the data controller and Punk Web Design will act as a data processor.

In those circumstances, I only process the information according to the client's documented instructions, the relevant contract, and applicable data protection law.

Questions about information collected through a client's website should normally be directed to that client using the contact details in their own privacy notice.

How I protect your information

I use reasonable technical and organisational measures designed to protect personal information from accidental loss, unauthorised access, misuse, alteration, or disclosure.

These measures may include access controls, secure accounts, software updates, encrypted connections, backups, and website security services.

No internet-based service can guarantee complete security, but I review the measures I use and make improvements where appropriate.

Your data protection rights

Depending on the circumstances and the lawful basis being used, you may have the right to:

  • ask for a copy of your personal information;
  • ask me to correct inaccurate or incomplete information;
  • ask me to delete your information;
  • ask me to restrict how your information is used;
  • object to how your information is used;
  • receive certain information in a portable, machine-readable format; and
  • withdraw your consent where processing is based on consent.

Your right to object

You have the right to object when I use your personal information on the basis of legitimate interests.

If you object, I will stop using the information for that purpose unless there are compelling legitimate reasons to continue or it is needed for a legal claim.

These rights are not absolute and may not apply in every situation.

To make a request, email hello@punkwebdesign.com.

I may need to confirm your identity before completing a request. I will normally respond within one month.

Making a data protection complaint

If you are concerned about how I have collected or used your personal information, you can make a complaint by emailing hello@punkwebdesign.com.

I will acknowledge your complaint within 30 days, investigate it without undue delay, keep you informed where appropriate, and tell you the outcome.

You also have the right to complain to the Information Commissioner's Office, the UK regulator for data protection: make a complaint to the ICO.

Links to other websites

This website may link to websites operated by other organisations. I am not responsible for their privacy practices. You should read the privacy notice of any external website you visit.

Changes to this notice

I review this privacy notice periodically and update it when my services, suppliers, or use of personal information changes.

The date at the top of this page shows when it was last updated.