PrivacyPolicy

Webgro Ltd is a company registered in England and Wales under company number 10889889, with its registered office at 12 Longshot Lane, Bracknell, Berkshire, RG12 1RL.

For anything relating to this policy or your personal data, contact us at hello@webgro.co.uk. We are the data controller responsible for your data as described on this page.

This policy applies to personal data we collect through webgro.co.uk. It does not cover third-party sites we link to, or the separate systems we use on client engagements (those are governed by the contracts we sign with each client).

Contact form submissions

When you submit the contact form on our site, we collect your name, email address, optional phone number and company, the services you’re interested in, your ballpark budget, and your answers to the form’s questions. We use this information for one thing only: to reply to your enquiry and, if you want to work with us, to scope a project together.

The contact form asks a few follow-up questions based on your earlier answers. To choose those questions, your answers are sent to Anthropic, whose AI model Claude suggests the next question. When you send the form, your answers and your company name (if you give one) are also sent to Anthropic to write a short summary for our team. Your name, email address and phone number are never sent to Anthropic. A person at Webgro reads every enquiry, and no decision about you is made automatically.

Lawful basis: legitimate interest (Article 6(1)(f) UK GDPR). You contacted us to ask about our services, and we use the data you supplied to respond.

Newsletter

If you sign up for our newsletter, we collect your email address and use it to send you our newsletter: news from Webgro, new releases and articles from The Gro. You can also sign up by ticking the box when you send an enquiry or a charity application. Signups are managed in Klaviyo. Every email includes a link to unsubscribe, and you can also ask us to remove you at any time.

Lawful basis: consent (Article 6(1)(a) UK GDPR).

Charity website applications

If you apply for a free charity website, we collect the details you give about the charity and its needs, and your name, role, email address and optional phone number. We use them to consider the application and to contact you about it.

Lawful basis: legitimate interest (Article 6(1)(f) UK GDPR). You asked us to consider your application.

Emails you send us directly

If you email hello@webgro.co.uk or another Webgro address, we collect whatever you chose to send. We use it to reply, and if the conversation turns into a project, to scope and deliver that project.

Server logs

Our hosting provider retains standard server logs (IP address, timestamp, page requested, user agent) for operational and security purposes. These are retained for 30 days and are not tied to named individuals.

Lawful basis: legitimate interest (keeping the site online and secure).

Analytics (only if you opt in)

If you accept analytics cookies on the cookie banner, we load Google Analytics 4 with IP anonymisation. GA4 tells us which pages get visited, which don’t, and roughly where visitors come from. We do not combine this with any other Google product or use it for advertising.

Lawful basis: consent (Article 6(1)(a) UK GDPR). You can withdraw consent at any time from the cookie controls, which removes analytics scripts from future page loads.

Bot protection (Cloudflare Turnstile)

When you submit a form on our site, Cloudflare Turnstile runs a short challenge to distinguish humans from bots. Cloudflare receives the minimum needed for the challenge (headers, a short token) and returns a pass/fail. This is necessary to keep the contact form usable without drowning in spam.

Lawful basis: legitimate interest (preventing abuse of the form).

What we don’t collect

We don’t run advertising pixels, remarketing tags, or behavioural-profiling scripts. There is no commercial “profile” of you being built anywhere.

• Unsuccessful enquiries: 12 months after last contact, then deleted.
• Active clients and prospects: for the duration of our working relationship, plus 7 years after the last invoice (UK tax and accounting requirements).
• Charity website applications: 12 months after last contact, then deleted, unless we go on to work together.
• Newsletter: until you unsubscribe or ask us to remove you.
• Server logs: 30 days.

We use a small set of third-party tools to run the business. None of them sell your data or use it for their own marketing. Each is a data processor acting on our instructions.

• Email provider: to receive and send email (Microsoft 365 or Google Workspace, operated in the UK/EU).
• Hosting provider (Vercel, US): to serve the site. Processes request metadata such as IP and user agent for routing and logging. UK International Data Transfer Agreement in place.
• Resend (US): transactional email delivery for form submissions. Processes only the content of each submission and the recipient address. UK IDTA in place.
• Cloudflare Turnstile (US): bot-protection challenge on our forms. Receives challenge metadata, not the content of your submission. UK IDTA in place.
• Anthropic (US): the AI model behind the contact form’s follow-up questions and enquiry summaries. Processes your answers to the form’s questions and your company name, never your name, email address or phone number, and does not use them to train its models.
• Klaviyo (US): newsletter signups and emails. Processes your email address and whether you open or click our emails.
• Google Analytics 4 (US, consent-only): anonymised page analytics. Only processes your data if you accept analytics cookies on the cookie banner.
• Accounting and invoicing software: for active clients, to issue invoices and meet HMRC obligations.

Where personal data is transferred outside the UK or European Economic Area (typically to US-based providers above), we rely on the UK International Data Transfer Agreement or the EU Standard Contractual Clauses with the UK Addendum as the appropriate safeguard.

Under the UK GDPR you have the right to:

• Ask for a copy of the personal data we hold on you.
• Ask us to correct anything that’s wrong.
• Ask us to delete your data (subject to legal retention obligations, like the 7-year HMRC rule above).
• Ask us to restrict how we use it, or to port it to another provider.
• Object to us processing it on legitimate-interest grounds.
• Withdraw any consent you gave (where consent was the basis).

To exercise any of these rights, email hello@webgro.co.uk. We’ll respond within one working day and complete your request within one calendar month.

If you’re unhappy with how we’ve handled your data, you have the right to complain to the UK’s Information Commissioner’s Office at ico.org.uk. We’d appreciate the chance to fix it first.

Our services are aimed at businesses. We do not knowingly collect personal data from anyone under 18. If you believe we have, contact us and we’ll delete it.

We review this page at least once a year, and update it any time the site’s data practices change. The “last reviewed” date at the top of the page reflects the most recent review.