Privacy policy

We value your privacy. We are a web design company, not a data mining operation. Here is exactly how we handle your information.

1. Who we are

For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, the data controller is Connor Copeland trading as Fixels, a sole trader based in Chandler's Ford, Hampshire, United Kingdom.

You can contact us about data matters at: hello@fixels.co.uk

2. Information we collect

Information you give us directly

We collect information when you fill out a form on our site, email us, or call us. This usually includes:

• Your Name & Business Name
• Email Address & Phone Number
• Details about your project

Client portal

If you are a client, we give you a login for our client portal, where you can see your website and plan. For this we keep your name, email address and the business you sign in for, along with your website’s details. When you sign in, we record the sign-in (including your IP address and browser type) to keep you signed in and to protect your account. To stop anyone guessing sign-in codes, we also briefly note the IP address of anyone who asks for a code or enters one. The portal also shows your invoices and Direct Debit from our invoicing and Direct Debit providers. If you set up a Direct Debit there, you enter your bank details on GoCardless’s own pages, not ours: we only see your bank’s name and the last digits of your account number. GoCardless also uses your details for its own legal duties, such as preventing fraud, as its privacy notice explains. If you ask for a change to your website in the portal, we keep what you asked for, who asked and our replies, so you can see where each change is up to. If someone recommended us to you with their referral link, we note who it was, so we can thank them.

Websites we look after for you

When we host your website, we also handle personal data about its visitors on your behalf, such as the messages people send through its forms. For that data, you are the controller and we are your processor, and our terms of service set out how we look after it. Your portal shows how many people visit your site, counted without cookies and only as totals, so it never shows who they are.

Visit counts without cookies

We count visits to our own site with Vercel Web Analytics, and measure how quickly its pages load with Vercel Speed Insights. Both come from our hosting provider. Neither sets cookies or stores anything on your device, and we only ever see totals, such as how many people visited a page and where they came from, never who they are.

Automated Data (Google Analytics & Signals)

If you click “That’s Fine” on our cookie banner, we collect data about how you use our site through Google Analytics 4. We do not see information that identifies you personally; the data we see is aggregated. We also use a feature called Google Signals. If you are signed into your Google account and have “Ads Personalisation” turned on, Google links your browsing activity with your account. This provides us with aggregated insights (such as general age ranges or interests) and allows us to show you relevant ads for our web design services after you leave our site. This data is only collected with your consent, which you can withdraw at any time via the cookie banner.

3. How we use your information & lawful basis

We use your information lawfully. The table below sets out what we use your data for and the legal basis we rely on:

Where we rely on legitimate interests, our interest is in responding to business enquiries, providing quotes, and operating and promoting our web design business. We have balanced this against your rights, and you can object to this processing at any time (see “Your Rights” below).

We do not carry out any automated decision-making or profiling that produces legal effects, or similarly significant effects, for you. The Google Signals feature described above is operated by Google to provide aggregated insights and advertising, and only with your consent.

4. Sharing your data

We never sell your personal data to third parties.

However, we share data with the following categories of service providers who help us run our business. Each is bound by a contract to keep your data secure and process it only as instructed:

• Resend (Resend Inc., US-based): delivers the details you submit through our contact and order forms to our inbox, and sends you a copy of your order and our client portal emails (sign-in codes and invites). Subject to the international transfer safeguards described below.
• Google Analytics & Google Ads: website analytics and advertising. Only set with your consent.
• Website hosting provider: serves our site to your browser, and counts visits and page speed without cookies.
• Database provider: stores client portal logins and website details.
• Accounting / invoicing software: manages billing and bookkeeping.
• Direct Debit provider (GoCardless): sets up Direct Debits and collects payments by them. GoCardless also uses your details for its own legal duties, such as preventing fraud, under its own privacy notice.
• Email provider: sends and receives communications with you.

A current list of our named providers is available on request, so we can swap one in or out without keeping this page perpetually out of date.

Some of our providers, including Google, may process personal data outside the UK. Where this happens, we make sure an appropriate safeguard is in place, such as a UK adequacy decision (for example, the UK Extension to the EU-US Data Privacy Framework, under which Google is certified), the UK International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses.

5. Data Retention

We only keep your data for as long as necessary:

• Enquiry data (name, email, project details): retained for up to 2 years after our last contact, then securely deleted.
• Client project data: retained for 6 years after project completion to comply with UK tax and accounting obligations.
• Client portal logins: kept while you are a client, then deleted. A sign-in lasts up to 90 days after you last used the portal, and its record (with your IP address and browser type) is deleted when it ends. The IP addresses we note to stop code guessing are deleted within a day. Changes you ask for in the portal, and who recommended you, are kept with your client project data.
• Order confirmations: when we email you a copy of your order, we note the email address for two days, so the form can’t be used to send lots of emails to one person, then delete it.
• Analytics data: retained for up to 14 months within Google Analytics 4, then automatically deleted.
• Cookie consent choice: stored in your browser’s local storage on your own device until you clear it. We do not keep a separate copy.

6. Data Security

We take security seriously. We use SSL encryption (https) on our website and secure, password-protected systems to store client details. While no online service is 100% secure, we work hard to protect your information.

7. Your Rights

Under UK GDPR, you have the following rights. We will respond to any request within one month, and will not normally charge a fee. If your request is complex or you have made several requests, we may extend this by up to two further months and will let you know if that is the case. Your rights are:

• Access: Ask for a copy of the personal data we hold about you.
• Correction: Ask us to correct any inaccurate or incomplete information.
• Deletion: Ask us to delete your data (“Right to be forgotten”), where we have no legal obligation to retain it.
• Restriction: Ask us to pause processing your data in certain circumstances (e.g., while a dispute is resolved).
• Data Portability: Ask us to provide your data in a structured, machine-readable format so you can transfer it to another provider.
• Object: Object to us processing your data where we rely on Legitimate Interests as our lawful basis.
• Withdraw Consent: Where processing is based on your consent (e.g., analytics cookies), you can withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, simply email us at hello@fixels.co.uk.

You can also view, manage, or delete the data Google holds about you for ad personalisation by visiting your Google My Activity page.

8. Right to Complain

If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the UK’s data protection supervisory authority:

We would, however, always appreciate the chance to address your concerns before you approach the ICO, so please contact us first.

9. Children's Data

Our services are aimed at businesses and adults. We do not knowingly collect personal data from anyone under the age of 13. If you believe we hold data on a child in error, please contact us and we will delete it as soon as we can verify the request.

10. Changes to This Policy

We may update this policy from time to time, for example if we change a provider or if the law changes. The “Last updated” date at the top of this page will reflect the most recent revision. If we make material changes that affect how we process your data, we will email active clients with a summary so you do not have to keep checking back.

11. Contact Us

If you have any concerns about your privacy, please contact the founder directly: