Privacy Policy

Last updated: 24 August 2026

1. Who We Are

Draftworks is the data controller for the personal data described in this policy. Contact: hello.draftworks@gmail.com. This policy explains how we collect, use, and protect personal data in line with UK GDPR and the Data Protection Act 2018.

2. What Data We Collect

We may collect and process the following categories of personal data:

• Contact details you provide via enquiry forms or email (name, email address, phone number, business name).
• Project-related information you share with us, such as business details, branding materials, and login credentials needed to complete work.
• Billing information (name, and bank details you provide) needed to process payment by bank transfer. We do not store card details, as we do not currently accept card payments.
• Website usage data collected via our hosting provider's built-in analytics (Fasthosts), including IP address, browser type, and pages visited.

3. How We Use Your Data

We use personal data to:

• Respond to enquiries and provide quotes.
• Deliver and invoice for design, development, hosting, and maintenance services.
• Communicate with you about your project or subscription.
• Improve our Site and services.
• Comply with legal and accounting obligations.

4. Legal Basis for Processing

We process personal data under the following legal bases: performance of a contract (delivering services you've engaged us for), legitimate interests (responding to enquiries, improving our Site), and legal obligation (record-keeping for tax purposes).

5. Sharing Your Data

We may share data with third parties who help us deliver our services, such as hosting providers, payment processors, and analytics tools. These providers only process data on our instructions and are bound by appropriate data protection agreements. We do not sell personal data to third parties.

6. Data Retention

We retain client project data for the duration of the engagement and for 6 years afterward to meet accounting and legal obligations, unless you request earlier deletion where legally possible. Enquiry data from non-clients is deleted after 12 months of inactivity.

7. Your Rights

Under UK GDPR, you have the right to access, correct, delete, or restrict processing of your personal data, the right to data portability, and the right to object to processing based on legitimate interests. To exercise these rights, contact us using the details above. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

8. Cookies

Our Site may use cookies for analytics and functionality. You can control cookies through your browser settings. We currently use basic, hosting-provider-level visit statistics and do not use tracking or advertising cookies. If this changes, this section will be updated accordingly.

9. Data Security

We take reasonable technical and organisational measures to protect personal data against unauthorised access, loss, or misuse.

10. Changes to This Policy

We may update this policy from time to time. Material changes will be reflected by an updated "last updated" date at the top of this page.