Privacy Policy
What we collect, why, and what you can do about it. Written to be read rather than skimmed past.
Last updated:
Who we are
Altra Media is a web design and digital marketing business based on the Isle of Wight, United Kingdom, run by Callum Holbrook and Owen Smith. We build and maintain websites and produce content and branding for our clients.
For the purposes of UK data protection law, Altra Media is the data controller for the personal data described in this policy. That means we decide what is collected and why, and we are responsible for looking after it.
Registered details: [Registered business name, and company number if you are a limited company. If you are a sole trader or partnership, say so here.]
ICO registration: [Your ICO registration number, once registered — see the note at the top of this file.]
You can reach us about anything in this policy at:
- Email: callum@altramedia.co.uk
- Email: owen@altramedia.co.uk
- Phone: 07353 915148
- Post: [Trading address — required if you want people to be able to write to you]
What personal data we collect
When you use the contact form
The enquiry form on our contact page asks for:
- Your name — required
- Your email address — required
- A short description of your project — required
- Your company name — optional
- A rough budget range — optional
The form does not ask for a phone number. If you choose to include one in your message, we will hold it as part of that message.
When you visit the site
Our hosting provider records standard technical information for every request, including your IP address, the pages requested, the time, and your browser type. This happens at the server and is normal for any website. We use it only to keep the site running and to investigate faults or abuse.
We also intend to use [Plausible / Fathom — confirm which] for website analytics. It is a privacy-first, cookieless tool: it does not set cookies, does not use browser storage, does not create a profile of you, and does not follow you to other websites. The statistics we see are aggregate — page views, referrers, countries, device types — and cannot be traced back to an individual.
If you become a client
To do the work you have hired us for, we will hold whatever is needed for that project. That typically includes contact details for you and your team, billing details, project files, content and images you send us, and access credentials for systems we need to work on.
Where a website we build for you collects personal data from your customers, you are the controller of that data and we act as your processor. That relationship should be set out in a written agreement between us.
How we collect it, and our lawful basis
UK GDPR requires us to have a specific lawful reason for using personal data. Ours are:
| What | How we get it | Lawful basis |
|---|---|---|
| Enquiry form details | You send them to us | Legitimate interests — responding to an enquiry you chose to send. Where the enquiry leads towards a contract, we also rely on taking steps at your request before entering into one. |
| Client project data | From you during the work | Performance of a contract |
| Billing and accounting records | From you and from Stripe | Legal obligation — UK tax law requires us to keep these |
| Server and security logs | Automatically, by our host | Legitimate interests — keeping the site available and secure |
| Aggregate analytics | Automatically, once installed | Legitimate interests — understanding how the site is used. No cookies are set and no individual is identified. |
Where we rely on legitimate interests, we have considered whether our interest is outweighed by your rights, and we think it is not — but you can object at any time, and we will stop unless we have a compelling reason not to. See Your rights.
How we use it
- To read and reply to your enquiry.
- To quote for work, and to discuss what you need.
- To carry out work we have been engaged to do.
- To raise invoices and take payment, and to keep the accounting records the law requires.
- To keep the website working, secure and reasonably fast.
We do not use your details for marketing unless you have asked us to. We do not sell personal data, and we do not share it with anyone for their own marketing.
Who we share it with
We use a small number of suppliers to run the business. They process data on our instructions, under contract, and cannot use it for their own purposes.
| Who | What they do | What they see |
|---|---|---|
| Netlify | Hosts the website and runs the serverless function that receives the contact form | Server logs including IP addresses; the contents of an enquiry as it passes through the function |
| Resend | Sends the contact form enquiry to us by email | The contents of the enquiry, in transit |
| [Email provider for the @altramedia.co.uk mailboxes] and Google (for our shared Gmail inbox) | Hold our email | Enquiries and any correspondence, once delivered |
| Stripe | Takes client payments | Billing details for clients. Stripe is a controller in its own right for fraud prevention — see stripe.com/gb/privacy |
| [Plausible / Fathom] | Website analytics | Aggregate, cookieless statistics. No personal data. |
| [Accountant / bookkeeper, if applicable] | [Accounts and tax] | [Billing records] |
We may also disclose personal data where we are legally required to — for example to HMRC, or in response to a valid court order.
How long we keep it
| What | How long |
|---|---|
| Enquiries that do not become work | [Placeholder — 12 months is a common and defensible choice] |
| Client records and project files | [Placeholder — e.g. for the length of the engagement plus a defined period] |
| Invoices and accounting records | Six years from the end of the accounting period, as UK tax law requires |
| Server and security logs | [Placeholder — confirm your host’s log retention] |
| Analytics | Aggregate only, with no personal data retained |
When a retention period ends we delete the data or anonymise it so it can no longer identify anyone.
Where your data is stored
We are based in the UK, but some of our suppliers are not. Netlify, Resend, Stripe and Google are US companies and may process data outside the UK.
Where personal data leaves the UK, it is protected by an approved safeguard — usually the UK extension to the EU-US Data Privacy Framework, or the International Data Transfer Agreement with the standard contractual clauses. [Confirm which mechanism each supplier relies on and record it here. Check each provider’s current DPA or privacy page rather than assuming.]
Your rights
Under UK GDPR you have the right to:
- Be told what we hold and why — this policy is part of that.
- Get a copy of the personal data we hold about you (a subject access request).
- Have it corrected if it is wrong or incomplete.
- Have it deleted, where we have no continuing reason to keep it.
- Restrict what we do with it while a question about it is resolved.
- Object to us using it where we rely on legitimate interests.
- Receive it in a portable format, where it was provided by you and we rely on consent or a contract.
- Withdraw consent at any time, where consent is what we relied on.
To exercise any of these, email us at callum@altramedia.co.uk or owen@altramedia.co.uk. We will respond within one month. There is no charge, and we may ask you to confirm who you are before we release anything.
How we keep it secure
- The site is served over HTTPS, so anything you send through it is encrypted in transit.
- Enquiries go straight to our email — the website has no database and stores nothing.
- Access to our email, hosting and payment accounts is limited to Callum and Owen and protected by strong, unique passwords and two-factor authentication. [Confirm 2FA is on everywhere.]
- API keys and other credentials are held as environment variables in our hosting provider, never in the website code.
No system is perfectly secure, but if a breach happens that is likely to put your rights at risk, we will tell the ICO within 72 hours and tell you without undue delay.
Cookies
This website currently sets no cookies at all, and uses no browser storage. Our Cookie Policy explains that in full, including what would change if we add anything in future.
Children
Our services are aimed at businesses. We do not knowingly collect personal data from children. If you believe a child has sent us personal data, tell us and we will delete it.
Complaints
If you are unhappy with how we have handled your personal data, please tell us first — most things are quicker to fix directly.
You also have the right to complain to the Information Commissioner’s Office, the UK’s data protection regulator. You do not have to come to us first.
- Website: ico.org.uk/make-a-complaint
- Helpline: 0303 123 1113
- Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Changes to this policy
If we change how we handle personal data, we will update this page and change the date below. Where a change is significant, we will make that clear rather than relying on you noticing.