Privacy Policy

Who We Are

Web Studio London is a bespoke web design and digital marketing agency based in London, United Kingdom. The business is founded and led by Sehrish Sattar.

As the data controller, we are responsible for deciding how and why your personal data is processed. This Privacy Policy applies to all personal data we collect through our website, enquiry forms, email, WhatsApp, and any other communications with us.

Data We Collect

We only collect personal data that is necessary for us to provide our services and communicate with you effectively. We do not collect sensitive personal data unless you voluntarily provide it.

How We Collect Your Data

We collect personal data through the following methods:

• Enquiry forms — when you submit a contact or quote request form on our website
• Email — when you send us an email directly
• WhatsApp — when you message us via WhatsApp
• Phone calls — when you call us directly
• Cookies and analytics — automatically when you browse our website (see Section 9)
• Third-party platforms — such as Google Analytics or Formspree when you interact with our forms

Why We Use Your Data

We use personal data only for legitimate business purposes. We will never use your data in ways that are unexpected, excessive, or contrary to the purpose for which it was collected.

• To respond to your enquiry and provide a quote for our services
• To deliver web design, development, SEO, or digital marketing services you have engaged us for
• To manage the contractual relationship between you and Web Studio London
• To send you project updates, invoices, and relevant communications
• To improve our website and user experience through analytics
• To comply with our legal and regulatory obligations
• To protect against fraud, misuse, or security threats

Legal Basis for Processing

Under UK GDPR, we must have a valid legal basis for processing your personal data. We rely on the following bases:

• Contractual necessity — processing is necessary to fulfil a contract with you (e.g. delivering a website you've commissioned)
• Legitimate interests — processing is necessary for our legitimate business interests, such as responding to enquiries and improving our services, where these interests are not overridden by your rights
• Legal obligation — processing is necessary to comply with a legal obligation, such as tax and accounting requirements
• Consent — where we rely on your consent (e.g. for marketing communications), you have the right to withdraw it at any time

Data Sharing & Third Parties

We do not sell, rent, or trade your personal data. We may share limited data with trusted third-party service providers who help us operate our business, strictly for the purposes described in this policy.

Third-Party Services We Use

• Formspree — processes form submissions from our website. Data submitted via our enquiry forms is transmitted through Formspree's servers. View Formspree Privacy Policy ↗
• Google Analytics — used to analyse website traffic and user behaviour in an anonymised manner. View Google Privacy Policy ↗
• Google Workspace — used for email communications (Gmail). Messages you send to our email address are processed via Google's servers.
• WhatsApp (Meta) — if you contact us via WhatsApp, your messages are processed by Meta Platforms. View WhatsApp Privacy Policy ↗
• WordPress & web hosting providers — our website is built on WordPress and hosted by a third-party hosting provider. Server logs may contain technical data such as IP addresses.

All third-party processors are required to handle your data securely and in accordance with applicable data protection law. We do not permit them to use your data for their own purposes.

Legal Disclosure

We may disclose your personal data if required to do so by law, court order, or in response to a valid request from a law enforcement authority.

Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected, or as required by law.

• Enquiry data — if you enquire but do not become a client, we retain your contact details for up to 12 months before deletion
• Client project data — retained for the duration of the project plus 6 years (in line with UK contract law and HMRC requirements)
• Financial records — invoices and payment records are retained for 6 years as required by HMRC
• Website analytics data — retained in anonymised form as configured in Google Analytics (typically 26 months)
• Email correspondence — retained for up to 6 years or until no longer relevant to our business relationship

When data is no longer required, we delete it securely or anonymise it so it can no longer be linked to you.

Your Rights Under UK GDPR

As a data subject, you have the following rights regarding your personal data. You can exercise any of these rights by contacting us at hello@webstudiolondon.co.uk. We will respond within 30 days.

Cookies

Our website uses cookies — small text files placed on your device — to improve functionality and analyse how visitors use our site. We use the following types of cookies:

• Essential cookies — required for the website to function correctly (e.g. WordPress session cookies). These cannot be disabled.
• Analytics cookies — used by Google Analytics to collect anonymised data about website traffic and behaviour. These help us understand how to improve the site.
• Functional cookies — remember your preferences to improve your experience on return visits.

You can control and delete cookies through your browser settings at any time. Disabling cookies may affect certain features of the website. For more information about cookies, visit aboutcookies.org.

Third-Party Links

Our website may contain links to external websites, including LinkedIn, WhatsApp, and client websites. Once you leave our site, this Privacy Policy no longer applies. We are not responsible for the privacy practices of third-party websites and encourage you to read their privacy policies before providing any personal data.

Data Security

We take appropriate technical and organisational measures to protect your personal data against accidental loss, unauthorised access, disclosure, alteration, or destruction. These measures include:

• SSL/HTTPS encryption on our website and all data transmissions
• Secure, password-protected access to systems containing personal data
• Use of reputable, GDPR-compliant third-party processors
• Regular review of our data handling practices
• Limiting access to personal data to those who genuinely need it

Despite these precautions, no data transmission over the internet is completely secure. While we do everything we reasonably can to protect your data, we cannot guarantee absolute security. In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the ICO as required by law.

Children's Privacy

Our services are intended for businesses and adults aged 18 and over. We do not knowingly collect personal data from children under the age of 13. If you believe we have inadvertently collected information from a child, please contact us immediately at hello@webstudiolondon.co.uk and we will delete it promptly.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or the services we offer. When we make material changes, we will update the "Last updated" date at the top of this page.

We encourage you to review this policy periodically. Continued use of our website or services after any changes constitutes your acceptance of the updated policy. If you have concerns about any changes, please contact us.

Contact Us About Privacy

If you have any questions about this Privacy Policy, wish to exercise your data rights, or want to make a complaint, please contact us:

If you are not satisfied with our response, you have the right to lodge a complaint with the UK's data protection supervisory authority: