Who we are
This website, headwaterstudios.co.uk, is run by Headwater ("we", "us"), a bespoke software studio in the United Kingdom. For the personal data described below, we are the "controller" under UK data protection law (the UK GDPR and the Data Protection Act 2018).
You can reach us about anything in this policy at hello@headwaterstudios.co.uk.
What we collect, and why
When you use the contact form
We collect your name, email address and message, plus the optional details you choose to give us (your sector, company size and what you need). We use them to read your enquiry and reply to you, and to send a short automatic acknowledgement to the address you gave.
Our lawful basis is our legitimate interest in responding to people who contact us, and, where you're asking about a project, taking steps at your request before a contract. You don't have to use the form: you're welcome to email us directly instead.
When you email us
We keep the email and any attachments so we can reply and keep a record of the conversation, on the same lawful basis as above.
Spam protection
To stop automated abuse, the form checks your IP address against a short-lived counter that limits how many messages can be sent in an hour. The counter stores a one-way scrambled (hashed) version of the address rather than the address itself, and it is discarded automatically. The form doesn't use a CAPTCHA and sets no cookies.
Server logs
Our hosting provider keeps routine technical logs (such as IP address, browser type and the pages requested) to keep the site secure and working. These are used for security and fault-finding only.
Analytics (only if you accept)
If you choose "Accept analytics" on our cookie banner, we use Google Analytics to understand which pages are read and how people find the site. See the cookies section below. If you reject, or ignore the banner, no analytics tools are loaded. Our lawful basis is your consent, which you can withdraw at any time.
Who we share it with
We don't sell your data, and we don't use it for advertising. We use a small number of providers to run the site, who process data only on our instructions:
- Hostinger, our website hosting and email provider, which stores the website, the mailbox that receives your enquiry, and the server logs.
- Google (Google Analytics), only if you accept analytics cookies. Google may process data outside the UK; where it does, it relies on approved safeguards such as the UK International Data Transfer Addendum or the UK–US data bridge.
We may also disclose information if the law requires it. The site's fonts are hosted on our own server, so loading a page doesn't send your details to a font provider.
How long we keep it
- Enquiries: for as long as it takes to deal with them, then up to 12 months afterwards in case you come back. If you become a client, we keep project records for as long as the work, the legal and accounting rules, and any support period require.
- Spam-protection counters: automatically discarded after a short period (a day at most).
- Analytics data: held in Google Analytics for the retention period we've set in that tool (no longer than 14 months).
Cookies and similar technologies
"Essential" storage is what's needed to run the site or remember your choice, and doesn't need consent. Everything else only runs if you accept it.
| Name | Purpose | Type | Lasts |
|---|---|---|---|
| hw_consent | Remembers whether you accepted or rejected analytics, so we don't keep asking. Stored in your browser's local storage, not sent to us. | Essential | 12 months |
| _ga, _ga_<id> | Google Analytics: tells us roughly how many people visit, which pages they read and how they arrived, so we can improve the site. | Analytics (consent) | Up to 2 years |
We've turned off Google's advertising features and signals in Analytics. You can change your mind at any time using the "Cookies" link in the footer of every page. If you withdraw consent, we remove the analytics cookies we can and stop loading the tool. You can also clear cookies in your browser settings.
Your rights
Under UK data protection law you can ask us to:
- give you a copy of the personal data we hold about you;
- correct anything that's wrong;
- delete your data, where we no longer have a good reason to keep it;
- restrict how we use it, or object to us using it on the basis of our legitimate interests;
- give you your data in a portable format; and
- withdraw consent, if we're relying on it (this won't affect what happened before you withdrew).
To use any of these, email hello@headwaterstudios.co.uk. We'll normally reply within a month. If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113, though we'd appreciate the chance to put things right first.
Security
The site runs over HTTPS, and enquiries are delivered straight to a private mailbox. No system is perfectly secure, but we take sensible steps to protect the data we hold and only keep what we need.
Links to other sites
Where we link to other websites, they have their own privacy policies, which we don't control.
Changes to this policy
We'll update this page if how we handle data changes, and change the date at the top. For anything significant, we'll make it obvious on the site.