Privacy Policy

1. Who We Are

Ten Fast Feet is a web design and digital marketing agency based in Beccles, Suffolk, UK. For the purposes of UK data protection law, we are the data controller in respect of personal data collected through this website and in the course of providing our services.

You can contact us about data protection matters at: hello@ten-fast-feet.com

We are not currently required to appoint a Data Protection Officer but take our obligations under UK GDPR seriously.

2. What Personal Data We Collect

We collect and process the following categories of personal data:

Contact and enquiry data:

• Name
• Email address
• Phone number (if provided)
• Business name and website URL
• The content of messages and enquiries you send us

Client and contractual data:

• Business contact details and billing information
• Bank details for payment purposes
• Login credentials to platforms we manage on your behalf
• Project files, content, and communications

Website usage data (collected automatically):

• IP address and approximate location (country/region)
• Browser type and device type
• Pages visited, time on site, and navigation behaviour
• Referring website
• Date and time of visits

Marketing data:

• Email address if you subscribe to communications from us
• Your preferences and interactions with our emails

We do not collect or process special category data (such as health information, political opinions, or biometric data) in the ordinary course of our business.

3. How We Collect Personal Data

We collect personal data through:

• Contact forms and enquiry submissions on this website
• Direct email and telephone communications
• The provision of our services (when clients share content and access credentials)
• Google Analytics and similar analytics tools (automatically collected)
• Social media interactions (if you contact us via social platforms)
• Referrals from existing clients or business contacts

4. Legal Basis for Processing

We rely on the following lawful bases for processing personal data under UK GDPR (Article 6):

Contractual necessity (Article 6(1)(b)): Processing necessary to perform our contract with you, or to take steps at your request before entering into a contract. This applies to all processing in the course of providing our services.

Legitimate interests (Article 6(1)(f)): Processing necessary for our legitimate business interests, where these are not overridden by your interests or rights. This includes: analysing website usage to improve our site; sending marketing to existing clients; fraud prevention; and record-keeping. We have conducted a legitimate interests assessment for each of these purposes.

Consent (Article 6(1)(a)): Where we send marketing communications to non-clients or use non-essential cookies, we rely on your consent. You may withdraw consent at any time.

Legal obligation (Article 6(1)(c)): Where processing is necessary to comply with a legal obligation, such as keeping financial records for HMRC.

5. How We Use Your Personal Data

We use personal data for the following purposes:

• Responding to enquiries and providing quotations
• Delivering the services you have engaged us to provide
• Managing our contractual relationship with you
• Processing payments and maintaining financial records
• Communicating project updates, feedback requests, and delivery schedules
• Sending relevant marketing communications to existing clients and prospects who have opted in
• Improving our website and understanding how visitors use it
• Complying with legal and regulatory obligations
• Preventing fraud and protecting our business

We do not use personal data for automated decision-making or profiling in ways that produce legal or similarly significant effects.

6. Cookies and Analytics

We use cookies and similar tracking technologies on this website. A cookie is a small text file placed on your device when you visit a website.

Strictly necessary cookies: Required for the website to function. These cannot be disabled.

Analytics cookies: We use Google Analytics 4 to understand how visitors use our website. This collects anonymised usage data. IP addresses are anonymised before storage. Google Analytics data is processed by Google LLC under a Data Processing Agreement. You can opt out of Google Analytics tracking by installing the Google Analytics opt-out browser add-on.

Marketing cookies: We may use marketing tracking tools (such as Google Ads conversion tracking) where you have consented.

On your first visit, you will be presented with a cookie consent banner. Non-essential cookies are only placed with your consent. You can withdraw consent at any time by adjusting your browser settings to delete or block cookies, though this may affect the functionality of the website.

7. Data Sharing and Third Parties

We share personal data with third parties only where necessary and lawful. The categories of recipients are:

Service providers: We use trusted third-party services to operate our business, including: email and communication platforms; accounting and invoicing software; project management tools; and website hosting providers. These parties process data on our behalf under data processing agreements and are contractually bound to handle data securely and only as instructed.

Platform providers: In the course of providing services, we may access or configure platforms you use (such as Shopify, WordPress hosting, Google Search Console, or Google Analytics). Data processed on these platforms is subject to those providers' own privacy policies.

Payment processors: We use third-party payment processors (such as Stripe or bank transfer). We do not store your full payment card details.

Legal and regulatory: We may disclose personal data to HMRC, law enforcement, or courts where required by law.

Business transfers: If we sell or merge our business, personal data may be transferred as part of that transaction, subject to equivalent privacy protections.

We do not sell personal data to third parties for marketing purposes.

8. International Data Transfers

Some of our service providers are based outside the UK or European Economic Area (EEA). When we transfer personal data outside the UK, we ensure appropriate safeguards are in place, such as:

• UK adequacy regulations (for transfers to countries the UK recognises as providing adequate protection)
• UK International Data Transfer Agreements (IDTAs) or equivalent standard contractual clauses
• The UK-US Data Bridge (where applicable for US-based providers)

You can request details of the specific safeguards we rely on for any particular transfer by contacting us.

9. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected, subject to legal and regulatory requirements. Our standard retention periods are:

• Client and contractual records: 7 years from the end of the contract (to comply with HMRC requirements under the Taxes Management Act 1970)
• Enquiry and pre-contract communications: 2 years from the date of the enquiry if no contract is entered into
• Marketing data: Until you opt out or withdraw consent, or 3 years from last engagement if earlier
• Website analytics data: As configured in Google Analytics (standard retention is 14 months)
• Correspondence: 3 years from the date of the communication

When data is no longer required, we securely delete or anonymise it.

10. Data Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction, or alteration. These include:

• Encryption of data in transit (HTTPS/TLS)
• Password management using reputable password manager software
• Access controls limiting who can access personal data
• Regular review of third-party provider security practices
• Secure disposal of data when no longer required

No method of transmission over the internet or electronic storage is 100% secure. While we take security seriously, we cannot guarantee absolute security. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the Information Commissioner's Office (ICO) as required by UK GDPR.

11. Your Rights

Under UK GDPR, you have the following rights in relation to your personal data:

• Right of access: You can request a copy of the personal data we hold about you (a Subject Access Request). We will respond within one month.
• Right to rectification: You can ask us to correct inaccurate or incomplete data.
• Right to erasure ("right to be forgotten"): You can ask us to delete your personal data in certain circumstances, for example if it is no longer necessary for the purpose it was collected.
• Right to restriction of processing: You can ask us to limit how we use your data in certain circumstances.
• Right to data portability: Where processing is based on consent or contract and carried out by automated means, you can ask for your data in a structured, machine-readable format.
• Right to object: You can object to processing based on legitimate interests or for direct marketing purposes. We will stop processing unless we can demonstrate compelling legitimate grounds.
• Rights related to automated decision-making: You have the right not to be subject to decisions based solely on automated processing that produce legal or significant effects.
• Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at hello@ten-fast-feet.com. We will not charge a fee and will respond within one month (extendable to three months in complex cases, with notice).

We may need to verify your identity before processing a request.

12. Right to Complain

If you are unhappy with how we have handled your personal data, please contact us in the first instance so we can try to resolve the matter.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection:

• Website: ico.org.uk
• Helpline: 0303 123 1113
• Address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

13. Children's Privacy

Our website and services are not directed at children under the age of 13. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us immediately and we will delete it.

14. Links to Other Websites

Our website contains links to third-party websites, including client sites we have built or managed. We are not responsible for the privacy practices of those sites and encourage you to read their privacy policies.

15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We will update the "last updated" date at the top of this page. For material changes, we will take reasonable steps to notify affected individuals.

We encourage you to review this policy periodically.