Privacy notice.

iWeb Ltd is the data controller for the personal data described below. We are a UK-registered company (no. 01966851), employee-owned, with offices in London, Bristol and Stafford.

This notice covers personal data we hold as a controller, about prospects, clients, suppliers, candidates and website visitors. It does NOT cover personal data we process as a processor on behalf of our clients (end-customer data on programmes we deliver), that is governed by the data-processing agreement with each client.

We collect personal data in four contexts. We collect only what we need to operate honestly with the people we deal with.

Sales & enquiries

Name, work email, employer, role, the content of any enquiry, and any notes we take during follow-up calls.

Programme delivery

Names and contact details of nominated client staff, decision-makers, third-party suppliers and platform vendors involved in the work.

Recruitment

CV, cover letter, application answers, technical-task submissions and (if you progress) interview notes and references.

Operations

Website analytics, security logs, support correspondence with vendors.

• To respond to enquiries and prepare proposals, pre-contractual measures (Art. 6(1)(b)) or legitimate interests (Art. 6(1)(f): running a commerce consultancy).
• To deliver the work we are contracted for, contract (Art. 6(1)(b)).
• To assess job applications, pre-contractual measures (Art. 6(1)(b)) and legitimate interests (Art. 6(1)(f)).
• To keep our systems secure and meet our accreditation obligations, legal obligation (Art. 6(1)(c)) and legitimate interests (Art. 6(1)(f)).
• To send a periodic newsletter where you've opted in, consent (Art. 6(1)(a)).

We share personal data with a small set of vendors and professional advisers. We do not sell personal data, and we do not share it with advertisers.

• Infrastructure and software providers that host our internal systems (Microsoft 365, Atlassian, GitHub, AWS).
• Professional advisers, auditors of our ISO/Cyber Essentials/Adobe Partner programmes, legal counsel, accountants.
• Payroll and HR providers for staff data.
• Law enforcement or regulators, only where we are legally required.

We retain personal data only for as long as it serves the purpose it was collected for, plus any period we are legally required to keep it.

Some of our processors are based outside the UK and the EEA. Where we transfer personal data outside the UK we rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, and we assess each transfer for adequacy on a route-by-route basis.

A list of which processors host data where is included in the sub-processor register.

You have rights over the personal data we hold about you. Most of them have qualifications under UK GDPR; we'll tell you up-front if any apply to your request.

1. R.01Right of accessA copy of the personal data we hold about you.
2. R.02Right to rectificationCorrect anything inaccurate.
3. R.03Right to erasureThe 'right to be forgotten', in certain circumstances.
4. R.04Right to restrict or objectIncluding processing for direct marketing.
5. R.05Right to data portabilityFor data you have given us, processed by automated means under contract or consent.
6. R.06Right to withdraw consentWhere consent is the lawful basis we rely on.

To exercise any right, email dpo@iweb.co.uk. We respond within one calendar month. If we need longer we'll tell you why, within that month, and we won't take more than two further months.

If you believe we've mishandled your personal data, you have a right to complain directly to the Information Commissioner's Office. We'd appreciate the chance to put things right first.

ICO website

ico.org.uk/make-a-complaint

ICO helpline

0303 123 1113

By post

Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow SK9 5AF

We review this notice annually, and whenever a material change to our processing happens (a new sub-processor in a new jurisdiction, a new category of data, a new purpose). Material changes are flagged in the changelog at the foot of this page and, where required, notified to affected individuals.