Legal / Privacy notice

What we do
with your data.

This site has one form on it. This page sets out exactly what happens to what you type into it — who reads it, what it passes through, how long it survives, and how to make us delete it. There is no cookie banner because there is nothing here to consent to.

Last updated 10 September 2026

01Who we are

Drewframe is a web design and development studio working from the United Kingdom. We are the data controller for the personal data described on this page, which means we decide what is collected and why, and we are answerable for it.

Contact: hello@drewframe.co.uk

02What we collect

Two things, and one of them you never type.

What you send us. The enquiry form asks for your name, your email address, your business name if you care to give it, and a message about your project. That is the whole form. No hidden field collects anything else, and nothing about you is gathered from anywhere other than what you choose to write.

What your browser sends. Like every website, ours sees your IP address and the basic details of the request. When you submit the form, your IP address is used for a few seconds to apply a rate limit and run an anti-bot check, so the form cannot be flooded. It is not stored alongside your enquiry, and it is not used to profile you.

We collect nothing in the special categories — health, beliefs, ethnicity and the like. Please do not put anything of that kind in the message box.

03Why we use it, and on what basis

UK data protection law requires a lawful basis for every use of personal data. Ours are set out here in full.

Your name, email address, business name and message: PurposeTo read your enquiry, reply to it, and talk through a possible project; Lawful basisTaking steps at your request before entering a contract, and our legitimate interest in answering people who get in touch
A copy of your enquiry, sent back to your own address: PurposeSo you have a record of what you sent, and know it arrived; Lawful basisThe same — it is part of responding to the enquiry you chose to send
Your IP address, and the bot check the form runs: PurposeTo stop spam and automated abuse, and keep the form working for real people; Lawful basisOur legitimate interest in keeping the site secure and available
Standard server and security logs: PurposeTo run the site, and to investigate faults or attacks; Lawful basisOur legitimate interest in operating a reliable, secure website

We do not send marketing. Enquiring does not put you on a mailing list. We do not have one. We will never sell, rent or pass your details to anyone else for their marketing.

No decision about you is made by machine. The single automated judgement on this site is the bot check deciding whether a submission looks human. If it wrongly blocks you, email hello@drewframe.co.uk and a person will read it.

04Cookies and tracking

This site sets no cookies. There is no analytics, no advertising pixel, no session tracking, and nothing is written to your browser's local storage. That is why you have not been asked to accept anything: UK rules require consent for non-essential storage, and there is none here to consent to.

One narrow exception is strictly necessary. The anti-bot check on the enquiry form may briefly store a security token in your browser to confirm that a challenge has been passed. It protects the form you chose to use, it carries no identifier that follows you between websites, and it plays no part in analytics or advertising.

If we ever add analytics, this page changes first, and you will be asked before anything non-essential is stored.

06Where your data goes

The providers above are US-based and run global networks, so your data may be processed outside the UK. Where it is, the transfer relies on safeguards UK law recognises: the UK extension to the EU–US Data Privacy Framework, or the Information Commissioner's International Data Transfer Addendum to the standard contractual clauses. Ask us and we will tell you which one covers a particular provider.

07How long we keep it

Enquiries that go nowhere: Deleted within 12 months of the last message either of us sent.
Enquiries that become projects: Kept for the length of the work, then six years after it ends — tax and accounting rules, and the time limits for bringing a claim, require us to be able to show what was agreed.
Security and rate-limiting data: Transient. Your IP address is checked as the form is submitted and is not filed with the enquiry. Our providers hold their own short-lived logs.

You can ask us to delete an enquiry sooner, and unless we need it for one of the reasons above, we will.

08How we protect it

The site is served entirely over HTTPS under a strict content security policy, so your enquiry is encrypted in transit and the page cannot quietly load third-party code. The form is rate-limited and bot-checked. Enquiries are delivered straight to an inbox rather than kept in a database on the website, so there is no store of past enquiries sitting on the server for anyone to break into.

09Your rights

Over the data we hold about you, you have the right to ask for the following.

Access: Ask for a copy of the personal data we hold about you.
Correction: Have anything inaccurate put right.
Erasure: Ask us to delete it, where we have no good reason to keep it.
Restriction: Ask us to pause using it while something is being sorted out.
Objection: Object to us relying on legitimate interests, and we will stop unless we can show compelling grounds not to.
Portability: Receive the data you gave us in a machine-readable form.

Email hello@drewframe.co.uk and we will deal with it within one month. It costs you nothing. We may ask a question or two to confirm it is really you before sending personal data anywhere.

10Complaints and changes

If something here troubles you, tell us first — hello@drewframe.co.uk — and we will try to put it right. You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office, at ico.org.uk/make-a-complaint or on 0303 123 1113. You do not have to come to us first.

If we change how this site handles data, we will update this page and change the date at the top of it.

Back to home