Privacy
Privacy policy
Last updated 26 October 2026.
1. Who we are
Virtuosite is a web design agency based in Accrington, Lancashire. We design, build, host and look after websites for small businesses, mostly on a monthly rental basis. For the personal information described in this policy, we are the data controller: we decide how and why it is used.
Business | : Virtuosite |
Address: | 57 Hambledon Mill Park, Accrington, Lancashire, BB5 5FQ |
Email: | admin@virtuosite.co.uk |
Phone: | 07862 745944 |
. |
2. What this policy covers
This policy explains how we handle personal information about:
- visitors to virtuosite.co.uk;
- people who ask us for a quote, call us or email us;
- our clients and the people we deal with at their businesses;
- partners who introduce clients to us through our partner programme, and people who ask about it;
- suppliers we work with.
It does not cover the websites we build for clients. Each client's own website has its own privacy policy, and the client decides how visitors' information is used there (see section 11).
3. The information we collect
We only collect what we need to answer you, provide our services and run the business. Most of it comes from you directly.
Who | What we collect | Where it comes from |
|---|---|---|
Quote enquiries | Name, business name, email, phone number, the plan you are interested in, whether you are a charity or not-for-profit, your message, and that you agreed to this policy | The quote form on our Contact page, or your email or call |
Partner enquiries | Name, organisation, email, phone number, type of partner, your message | The form on our Partner with us page |
Clients | Contact details for you and your colleagues; billing details and payment records; your contract and plan; content you send us for your website (text, photos, logos); domain registration details; support requests and our emails with you | You, and our payment provider |
Partners | Contact details; the clients you introduce; commission records; bank details to pay your commission | You |
Website visitors | IP address, browser and device type, pages visited and the time of your visit (server logs); cookie choices; [analytics data, if used] | Your browser, our web host [and analytics provider] |
Suppliers | Business contact details and payment details | You |
We do not ask for special category information (such as health, religion or ethnicity). Please don't send it to us. If it appears in content you give us for your website, we only use it to publish that content as you instruct.
Our forms use hidden spam checks (a trap field and a timing check). These don't collect any information about you.
4. How we use it and our lawful bases
UK data protection law says we must have a lawful basis for each use of your information. These are ours:
What we do | Lawful basis |
|---|---|
Reply to your enquiry and prepare a quote | Steps you asked us to take before a contract; legitimate interests in answering people who contact us |
Build, host, maintain and support your website, and manage your account | Contract |
Register and renew your domain name | Contract |
Take payments, chase late payments and keep accounts | Contract; legal obligation (tax and accounting records) |
Run the partner programme and pay commission | Contract |
Keep the website secure and stop spam and misuse | Legitimate interests in protecting our business and visitors |
Remember your cookie choices | Legal obligation (PECR) |
Measure how the website is used, with analytics | Consent, given through the cookie banner |
Send occasional news or offers to clients by email | Legitimate interests (similar services to ones you bought); you can opt out at any time |
Deal with complaints and legal claims | Legitimate interests; legal obligation |
Where we rely on legitimate interests, we have weighed them against your rights and kept the use to what you would reasonably expect. You can object at any time (section 10).
We will not send marketing emails to people who have only enquired unless they ask us to. We never sell your information, and we don't use it for automated decisions that have legal or similarly significant effects on you.
5. Cookies and similar technologies
Our website uses a small number of cookies and similar browser storage. Strictly necessary ones are always on. Anything else is only used if you agree through the cookie banner, and you can change your mind at any time from the cookie settings link on the site.
Name | Type | What it does | How long |
|---|---|---|---|
Cookie banner consent cookie | Strictly necessary | Remembers your cookie choices so we don't ask again | 12 months |
wordpress_test_cookie, wordpress_logged_in_, wordpress_sec_, wp-settings-* | Strictly necessary | Only set for people who log in to manage the website | Session to 1 year |
comment_author_* | Functional | Remembers your name and email if you leave a blog comment and tick the box to save them | 1 year |
vsFestiveClosed | Functional (browser storage) | Remembers that you closed our seasonal message, so it stays closed | Until you clear your browser data |
vsSnowPaused | Functional (browser storage) | Remembers that you paused the falling-snow effect | Until you clear your browser data |
Analytics cookies, e.g. _ga, ga* | Analytics | Count visits and see which pages are used, only with your consent | Up to 2 years |
Our fonts are stored on our own server, so loading the site does not contact Google Fonts. Social sharing buttons are plain links: nothing is sent to the social network unless you click one, and then that network's own privacy policy applies.
You can also block or delete cookies in your browser settings. Blocking strictly necessary cookies may stop parts of the site from working.
6. Who we share it with
We only share information where we need to, and only what is needed. The companies below act on our instructions under contracts that require them to keep your information safe.
Who | Why |
|---|---|
Hosting.com, our hosting provider | Stores our website, client websites, form submissions and server logs |
Microsoft | Runs our business email |
GoCardless | Collects your monthly payments |
Sage | Keeps our accounts and invoices |
Domain registrars and registries (such as Nominet for .uk names) | Register domain names in your name; registries may publish some details unless you are an individual who opts out |
Website usage statistics, only with your consent | |
Our accountant | Accounts and tax returns |
Freelancers who help us build or support a website | Only the content and access they need for that job, under a confidentiality agreement |
We may also share information if the law requires it (for example with HMRC or the police), to protect our legal rights, or with a buyer if the business is ever sold. If a partner introduced you to us, we tell them that you became a client so we can pay their commission, but we don't share details of your account.
7. International transfers
We keep your information in the UK where we can. Some of our providers, such as Microsoft and GoCardless, may store or access it outside the UK, including in the EEA or the United States.
When that happens, we make sure it is protected in one of the ways UK law allows: the country has a UK "adequacy" decision (as the EEA does), the company is certified under the UK Extension to the EU–US Data Privacy Framework, or the transfer is covered by the UK International Data Transfer Agreement or Addendum. You can ask us for more detail about any transfer.
8. How long we keep it
We keep information only as long as we need it, then delete it securely.
Information | How long |
|---|---|
Enquiries that don't lead to work | 12 months from our last contact |
Client records, contracts and support history | For as long as you are a client, then 6 years (the time in which legal claims can be made) |
Invoices, payments and accounting records | 6 years from the end of the financial year they relate to (HMRC rules) |
Your website files and content | Until 30 days after your plan ends, so you can ask for a copy; backups roll off within [30] days after that |
Partner records and commission payments | For as long as you are a partner, then 6 years |
Server logs | 30 days, unless needed to investigate a security problem |
Analytics data | 14 months |
Cookies | See section 5 |
We may keep information longer if the law requires it or if we need it for a complaint or legal claim.
9. Keeping it secure
We use sensible technical and practical measures to protect your information, including:
- SSL encryption (HTTPS) on our website and every client website we host;
- strong, unique passwords and two-step login on our accounts where available;
- software, themes and plugins kept up to date;
- daily backups, stored separately from the live websites;
- giving freelancers access only to what a job needs, and removing it afterwards.
No system is completely secure. If a breach puts your information at risk, we will tell you and the ICO where the law requires, normally within 72 hours of finding out.
10. Your rights and how to use them
Under UK data protection law, you have the right to:
- access the information we hold about you and get a copy;
- correct information that is wrong or incomplete;
- delete your information, where we no longer have a good reason to keep it;
- restrict how we use it while a concern is looked into;
- object to us using it based on legitimate interests, and to any direct marketing (we will always stop marketing when asked);
- move information you gave us to another provider, in a common digital format;
- withdraw consent at any time, where we rely on it (for example cookie choices), without affecting what we did before.
To use any of these rights, email admin@virtuosite.co.uk or write to the address in section 1. It is free, and we will reply within one month. We may ask you to confirm who you are first. Some rights have limits; for example, we must keep accounting records for 6 years even if you ask us to delete them, and we will explain if that applies.
11. Websites we build and host for clients
When we host and maintain a client's website, the client is the data controller for information collected through it, such as contact form messages, orders or newsletter sign-ups. We act as their data processor. That means we:
- only handle that information to host, back up, maintain and support the site, as the client instructs;
- keep it confidential and secure, and only use sub-processors (such as our web host) under suitable contracts;
- help the client respond to requests from people using their rights;
- tell the client without delay if we become aware of a breach;
- delete or return the information when our service ends.
The terms of this processing are set out in our client terms. If you visited a website we built for someone else, please contact that business about your information.
12. Children, changes and complaints
Children. Our services are for businesses and organisations. We don't knowingly collect information from anyone under 18.
Changes to this policy. We will update this policy when the way we use information changes, and show the new date below. If a change is significant, we will tell clients by email.
Complaints. If you are unhappy with how we have handled your information, please tell us first, and we will try to put it right. You also have the right to complain to the Information Commissioner's Office:
- Website: ico.org.uk/make-a-complaint
- Helpline: 0303 123 1113
- Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Last updated: 26/10/2026