This is the privacy policy for the SiteFlash website at siteflash.co.uk and for the SiteFlash business. It explains what personal data we collect, why we use it, who we share it with, how long we keep it and what rights you have. Last updated: 1 October 2026
Who we are
SiteFlash designs, builds and hosts websites for UK construction and trade businesses. In this policy, "we", "us" and "our" mean SiteFlash. SiteFlash is a trading name. The business is run by one person. It is based in Northolt, West London, and works with trade businesses across the UK.
We are the "controller" of the personal data described in this policy. That means we decide why and how it is used, and we are responsible for it. This policy is written to meet the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR).
You can contact us about anything in this policy:
- Email: alket@siteflash.co.uk
We have not appointed a Data Protection Officer, because the law does not require one for a business of our size and type. The owner handles every data protection question personally.
What this policy covers
This policy applies to personal data about:
- people who visit siteflash.co.uk;
- people who send us an enquiry or ask for a free homepage concept;
- our clients, and the people who work at client businesses;
- people at businesses we email about their website (see "If we have emailed your business" below).
"Personal data" means any information that identifies a living person. Information about a company is not personal data in itself, but the name, email address or phone number of a person there is. If you are a sole trader, information about your business is usually personal data about you.
What personal data we collect and where it comes from
When you use the enquiry form
The enquiry form is on our home page and our contact page. It asks for:
- your name (required);
- your business name (required);
- your trade, chosen from a list (required);
- your current website (optional);
- your email address (required);
- your phone number (optional);
- a message (optional).
The form also sends the address of the page you sent it from and a fixed subject line for the email we receive. A hidden anti-spam field, which a person never sees, catches automated programs. If it is filled in, the submission is dropped in your browser and nothing is sent.
When you press send, two things happen:
- Your browser sends the form directly to Formspree, Inc., a form service in the United States, which emails it to us. Formspree receives what you typed and your IP address.
- At the same time your browser sends a copy to our own server. Our server sends a short text message alert to the owner's mobile phone through Twilio Inc., a messaging service in the United States. The alert contains your name, phone number, email address and a summary of the other fields.
We need the required fields to reply to you and to design a free homepage concept if you have asked for one.
When you email us
We keep your email, any attachments and our replies in our mailbox, which is provided by Google Workspace.
When you become a client
We hold your contact details, the content you send us for your website (such as your logo, photographs and text), the details of your domain name and its DNS settings, and our correspondence with you. Where we register a domain name for you, we pass the details needed to a domain registrar.
Payments
Clients pay by monthly subscription through Stripe. Card details are entered on Stripe's own checkout page and go to Stripe. We never see your full card number. We hold your name, business name, email address, the status of your subscription and your invoices.
When you visit the website
Our website is hosted by Vercel Inc. When you load a page, Vercel's servers record your IP address, your browser, the page requested and the date and time. Every website works this way.
We do not use analytics, advertising pixels or tracking of any kind. The site has no embedded third-party content, its fonts are served from our own domain, and it has no newsletter sign-up. It sets no cookies and stores nothing on your device (see "Cookies" below).
If we have emailed your business
We email some UK trade businesses that are limited companies or limited liability partnerships (LLPs) to tell them about our website service. We do not send these emails to sole traders or ordinary partnerships unless they have agreed to receive them. This section applies to you if we contacted your business first.
Where your details came from
We did not collect these details from you. They came from public sources:
- the business's listing on Google Maps;
- the public register at Companies House;
- the business's own website.
What we hold
We hold the business name, address, phone number, website address and Google rating, the name of a director, and a business email address.
Why we use it and our lawful basis
We use these details to email the business about its website and to answer any reply. Our lawful basis is legitimate interests: our interest in finding new customers for a service that is relevant to the business we are writing to.
We have weighed that interest against your privacy. The details are business details that were already public. The emails are about the business's own website, not about you as a private person. We hold very little, we do not build a profile of you, and a single opt-out stops the emails for good.
PECR requires consent before marketing emails are sent to individuals, sole traders and ordinary partnerships. That rule does not apply to "corporate subscribers" such as companies and LLPs. PECR still requires us to say who we are and give you a way to opt out, and every email we send does both.
Who helps us
We use a data collection tool, an email verification service and an email sending platform. Some of these providers are based in the United States. Software, including AI tools, helps us sort replies and draft our answers. No decision that has a legal or similarly significant effect on you is made by automated means.
How long we keep it
If you do not reply, we keep your details for up to 12 months after our last email and then delete them, apart from any suppression entry described below.
Your right to object
You can object at any time, and you do not need to give a reason. Reply to any of our emails to say so, or email alket@siteflash.co.uk. We will stop emailing you and add the business to a suppression list. We keep that entry, with only the details needed to recognise the business, so that it is not contacted again.
You also have the rights set out in "Your rights" below, and the right to complain to the Information Commissioner's Office.
Why we use your personal data and our lawful basis
UK GDPR requires a lawful basis for each use of personal data. The table sets out ours.
| Purpose | Data we use | Lawful basis |
|---|---|---|
| Replying to your enquiry and designing a free homepage concept you have asked for | Your name, business name, trade, current website, email address, phone number and message | Taking steps at your request before entering into a contract. Where you enquire for a company, our legitimate interest in answering business enquiries. |
| Sending a text message alert to the owner so that enquiries are seen quickly | Your name, phone number, email address and a summary of the other form fields | Our legitimate interest in answering enquiries promptly. The alert goes only to the owner's phone. |
| Providing our service to clients: building, hosting and editing the website, looking after its domain, taking payments and sending invoices | Contact details, website content, domain and DNS details, correspondence, subscription status and invoices | Performance of our contract with you. For people who work at a client company, our legitimate interest in performing the contract with that company. |
| Keeping the accounts and tax records the law requires | Invoices, payment records and client details | Compliance with our legal obligations. |
| Running and securing the website, and stopping spam and abuse of the enquiry form | IP address, browser, page requested, date and time, the anti-spam field and the page the form was sent from | Our legitimate interest in keeping the site available and secure. The data is kept for a short time and is not used to profile you. |
| Emailing companies and LLPs about their website | The business details listed in "If we have emailed your business" | Our legitimate interest in finding new business customers, as explained in that section. |
| Keeping a suppression list of businesses that have opted out | The details needed to recognise the business | Our legitimate interest in making sure the business is not contacted again, and our legal duty to respect your objection. |
| Dealing with complaints, disputes and legal claims | Correspondence, contract and payment records | Our legitimate interest in being able to show what was agreed and what was done. |
| Answering data protection requests and complaints | Your request, our reply and the correspondence about it | Compliance with our legal obligations. |
Marketing
We do not run a newsletter or a mailing list. We do not sell personal data, and we do not share it with anyone for their own marketing. The only marketing we send is the business-to-business email described above.
Who we share your personal data with
We share personal data only where we need to in order to run the website and the business.
| Recipient | Why | Where they are |
|---|---|---|
| Formspree, Inc. | Processes the enquiry form. It receives what you type and your IP address, emails the enquiry to us and keeps a copy for a limited period. | United States |
| Twilio Inc. | Sends the text message alert about a new enquiry to the owner's mobile phone. | United States |
| Vercel Inc. | Hosts the website and serves its pages. Its servers log the technical details of each request. | United States |
| Google LLC (Google Workspace) | Provides our email. Enquiries and all email correspondence are stored in our mailbox. | United States |
| Stripe | Takes subscription payments from clients and holds their card details, which it uses under its own privacy policy. | See Stripe's privacy policy |
| A domain registrar | Registers and renews a domain name where we do that for a client. | Depends on the registrar used |
| Outreach service providers: a data collection tool, an email verification service, an email sending platform and software that helps sort and draft replies | Help us find, check and email businesses as described in "If we have emailed your business". | Some are in the United States |
| HM Revenue and Customs, courts, regulators, other authorities and any professional advisers we use | Where the law requires us to provide information, or where we need to in order to take advice or to establish, exercise or defend legal rights. | United Kingdom |
Our service providers act as our "processors". They may use the data only to provide their service to us. Stripe, advisers and authorities are controllers in their own right and are responsible for the data under their own privacy notices.
International transfers
Several of our providers are based in the United States, so personal data leaves the United Kingdom when you use the enquiry form, load a page or email us. UK GDPR allows this only where the data is protected by an approved safeguard.
Where a provider is certified under the UK Extension to the EU-US Data Privacy Framework (often called the UK-US data bridge), we rely on that certification. Where a provider is not certified, we rely on the International Data Transfer Agreement issued by the Information Commissioner's Office, or on the UK Addendum to the EU standard contractual clauses, in the provider's data processing terms.
You can ask us which safeguard applies to a particular provider by emailing alket@siteflash.co.uk.
How long we keep your personal data
We keep personal data only for as long as we need it for the purposes above, and then delete it.
| Records | How long | Why |
|---|---|---|
| Enquiries that do not become clients, including free homepage concept requests | Up to 24 months after our last contact with you | So that we can answer a follow-up or a repeat enquiry. |
| Client records and invoices | 6 years after the end of our relationship with the client | Tax records must be kept for several years, and a contract claim can be brought for up to 6 years. |
| Outreach contacts who have not replied | Up to 12 months after our last email, then deleted apart from any suppression entry | So that we can deal with a late reply. After that we have no need for the details. |
| Suppression list entries | Kept for as long as we carry out email outreach | So that a business that has opted out is not contacted again. |
| Copies of form submissions held by Formspree | A limited period set by the Formspree plan we use | Formspree stores each submission as part of its service. |
| Website server logs | Short-lived. The period is controlled by our hosting provider, not by us | The logs exist only to deliver the site and detect problems. |
If a complaint, claim or investigation is open when a period ends, we keep the records concerned until it is finished.
Security
We take practical steps to keep personal data safe. The website and the enquiry form are served over an encrypted connection. Card details are handled by Stripe and never reach us. Access to our email, hosting and other accounts is limited to the one person who runs the business.
No system is completely secure. If a security breach ever puts your rights at risk, we will tell you and the Information Commissioner's Office as the law requires.
Websites we build and host for clients
This policy does not cover the websites we build and host for our clients. When you send an enquiry through one of those websites, the client is the controller of your personal data and we act as the client's "processor". We handle the data only on the client's instructions. The client's own privacy policy explains how your data is used, and requests about it should go to the client. If a request reaches us, we will pass it on.
Your rights
Under UK GDPR you have the following rights over your personal data. Some apply only in certain situations, and we will explain if so when you ask.
- Access: you can ask for a copy of the personal data we hold about you.
- Rectification: you can ask us to correct data that is wrong or incomplete.
- Erasure: you can ask us to delete your data. We may have to keep some of it, such as invoices the law requires us to keep.
- Restriction: you can ask us to stop using your data, but keep it, while a question about it is resolved.
- Portability: where we use data you gave us under a contract with you, you can ask for it in a common machine-readable format.
- Objection: you can object to our use of your data where we rely on legitimate interests. If you object to marketing, we will always stop. In other cases we will stop unless we have compelling grounds to continue, or we need the data for a legal claim.
- Automated decisions: you have the right not to be subject to a decision made only by automated means that has a legal or similarly significant effect on you. We make no such decisions.
- Withdrawing consent: where we rely on your consent, you can withdraw it at any time. That does not affect anything done before you withdrew it.
How to use your rights
Email alket@siteflash.co.uk. You do not need to use any particular form or wording, and there is no fee. We may charge a reasonable fee, or decline to act, only if a request is clearly unfounded or excessive.
We will reply within one month. If your request is complex, or you have made several, the law allows us up to two further months, and we will tell you within the first month if we need them. We may ask you to confirm who you are before we act.
How to complain
If you think we have not handled your personal data properly, please tell us first by emailing alket@siteflash.co.uk. We will acknowledge your complaint within 30 days and give you our answer without undue delay.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator.
- Website: ico.org.uk/make-a-complaint
- Helpline: 0303 123 1113
Children
Our website and services are for businesses. They are not aimed at anyone under 18, and we do not knowingly collect personal data from children.
Cookies
This website sets no cookies and stores nothing on your device. Our cookie policy explains this in more detail.
Links to other websites
Our website links to other websites, including our clients' websites, Google Maps and the sources we cite in our articles. The payment link we send to new clients opens Stripe's own checkout page. Those websites have their own privacy policies, which we do not control.
Changes to this policy
We review this policy whenever we change how we handle personal data, such as when we change a provider. When we make a change we update the "Last updated" date at the top of this page. If a change is significant and affects you directly, we will tell you by email where we can.
Contact
For any question about this policy, or about how we use your personal data, email alket@siteflash.co.uk. See also our website terms of use and terms of service.