Privacy and GDPR

GDPR is the privacy regulation that applies across Europe, including to small businesses. It sounds heavy, but for an ordinary website it really comes down to a few sensible things. Here are the essentials.

This is a practical introduction, not legal advice. If you're unsure about something that applies to your specific business, you should check with a lawyer or the Data Protection Authority.

What GDPR actually requires

In short: if your website collects personal data – like name, email or phone number via a form – you must:

• Be open about what you collect and why (that's what your privacy policy does).
• Have a purpose and not collect more than you need.
• Store it securely and no longer than necessary.
• Let people request access to or deletion of their data.

What we set up for you

• A privacy policy. The website gets a privacy page that explains what's collected (for example via the contact form) and how it's handled.
• Safe data processing. Forms and data are handled in a way that complies with the rules, with encrypted transfer.
• Consent for tracking. If the site uses cookies for analytics or marketing, a consent banner is set up. See Cookies and consent.

What's your responsibility

As a business, you are the "data controller" for information about your customers. That means you should:

• Know what you collect and why.
• Respond to requests from people who want access or deletion.
• Not use the data for anything other than what you've stated.
• Have a data processing agreement with suppliers who process personal data on your behalf where relevant.

We keep the barrier low

We build sites "light" and with few third parties precisely because that's also good for privacy – the fewer external services that get data, the easier it is to stay in control. Wondering about something on your site around privacy? Get in touch.