Privacy Policy

Oxford Web Services Ltd ("we", "us", or "our"), registered in England and Wales (company no. 12499236, registered office: 115 Magdalen Road, Oxford OX4 1RQ), is the data controller for this website. We are committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website or use our services.

This policy explains what we collect, why, and the choices you have. Where we rely on your consent, such as for analytics, embedded content or a follow-up email about your tool results, we ask for it explicitly rather than assuming it.

We use the information we collect to:

• Respond to your enquiries and provide customer support
• Deliver and manage the services you have requested
• Email you the results you ask for from one of our free tools
• Send you information about our services, or a follow-up about your results, only with your consent, for example when you tick the follow-up box on a tool form. You can withdraw that consent at any time
• Improve our website and services
• Analyse website usage and trends
• Comply with legal obligations
• Protect against fraudulent or illegal activity

Under the UK GDPR, we process your personal data on the following legal bases:

• Consent: Where you have given explicit consent for a specific purpose
• Contract: Where processing is necessary to perform a contract with you
• Legitimate interests: Where we have a legitimate business interest that does not override your rights
• Legal obligation: Where we need to comply with a legal requirement

In practice, we rely on consent for analytics, for embedded content, for keeping and answering what you send through the contact form, and for the optional follow-up email about your tool results. We rely on legitimate interests to keep the site and its forms secure and to email you the results you ask for from a free tool. We rely on contract and legal obligation for client work and the records we must keep.

We do not sell, trade, or rent your personal information to third parties. We may share your information with:

• Cloudflare, Inc. (US): Hosting, CDN, security (Turnstile bot protection), short-lived IP-based rate limiting, a cache of tool results that lasts about 5 minutes, and cookieless Web Analytics.
• Resend (US): Delivery of emails generated by our contact and tool forms. Resend handles the content of those emails, including your email address.
• Calendly (US): Booking calendar, loaded on the contact page only with your consent.
• Google (US): The embedded location map on the contact page (loaded only with your consent), and the PageSpeed Insights API, which receives the website address you submit when you run one of our free scanning tools. Our server makes that request, so Google does not receive your IP address from us.
• An AI service provider (US): Helps us process and compile the website scanner's PDF reports.
• Professional advisers: Lawyers, accountants, and other advisers where necessary.
• Legal requirements: When required by law or to protect our rights.

All processors are required to maintain the confidentiality and security of your personal information and may only use it for the purposes we specify.

We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction. These measures include:

• SSL/TLS encryption for data in transit
• Secure hosting with reputable providers
• Regular security assessments
• Access controls and authentication
• Staff training on data protection

We retain your personal information only for as long as necessary to fulfil the purposes for which it was collected, including:

• Enquiry data: 2 years from last contact
• Client data: Duration of relationship plus 6 years (legal requirement)
• Free tool reports: if you ask for a report by email, we keep the notice we receive (your email address, the tool, the website address you scanned, your score and the findings shown; for the website scanner, also your answers and the suggested next step, and the PDF we send you) for up to 2 years, or until you ask us to stop using it. We use it to send you a follow-up only if you ticked the follow-up box, and you can withdraw that at any time by replying to any email from us or writing to info@oxfordwebservices.com
• Tool scans: results (including a page screenshot) are cached for around 5 minutes so a repeat scan of the same address is answered quickly, and the domain of the address you scanned is held as a rate-limit counter for up to about two hours. The cache is keyed to the address scanned, not to you
• Analytics: We use Cloudflare Web Analytics, which is cookieless and aggregate. It holds no personal data about you
• Rate-limiting: a counter against your IP address (for IPv6, its first half) is held for up to about two hours to prevent form abuse, then discarded. It records how many times you have used a form or tool, not what you sent
• Form security tokens: when you open the contact page, a random security token for the form is held on our server for about an hour, then discarded
• Report rate-limiting: when you ask for a report by email, a hashed form of your email address is also held as a rate-limit key for about a day after your most recent request, so no single inbox can be sent too many reports, then discarded

Under UK data protection law, you have the right to:

• Access: Request a copy of the personal data we hold about you
• Rectification: Request correction of inaccurate or incomplete data
• Erasure: Request deletion of your personal data in certain circumstances
• Restriction: Request restriction of processing in certain circumstances
• Portability: Request transfer of your data to another organisation
• Objection: Object to processing based on legitimate interests, and to direct marketing at any time
• Withdraw consent: Withdraw consent at any time where processing is based on consent. You can change your cookie choices with the Cookie Settings link in the footer, and withdraw the follow-up email consent by replying to any email from us or writing to us

To exercise any of these rights, please contact us at info@oxfordwebservices.com

Some of our processors are based in the United States (Cloudflare, Resend, Calendly, Google and our AI service provider), so your information may be transferred to and processed there. Where this occurs, we rely on appropriate safeguards, such as:

• The UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses
• Transfers to countries covered by UK adequacy regulations

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the "Last updated" date.

We encourage you to review this Privacy Policy periodically for any changes.