Privacy Policy

Oxford Web Services Ltd ("we", "us", or "our"), registered in England and Wales (company no. 12499236, registered office: 115 Magdalen Road, Oxford OX4 1RQ), is the data controller for this website. We are committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website or use our services.

This policy explains what we collect, why, and the choices you have. Where we rely on your consent — for analytics or embedded content — we ask for it explicitly rather than assuming it.

We use the information we collect to:

• Respond to your enquiries and provide customer support
• Deliver and manage the services you have requested
• Send you relevant information about our services (with your consent)
• Improve our website and services
• Analyse website usage and trends
• Comply with legal obligations
• Protect against fraudulent or illegal activity

Under the UK GDPR, we process your personal data on the following legal bases:

• Consent: Where you have given explicit consent for a specific purpose
• Contract: Where processing is necessary to perform a contract with you
• Legitimate interests: Where we have a legitimate business interest that does not override your rights
• Legal obligation: Where we need to comply with a legal requirement

We do not sell, trade, or rent your personal information to third parties. We may share your information with:

• Cloudflare, Inc. (US): Hosting, CDN, security (Turnstile bot protection), short-lived IP-based rate limiting, and cookieless Web Analytics.
• Resend (US): Delivery of emails generated by our contact and tool forms.
• Calendly (US): Booking calendar, loaded on the contact page only with your consent.
• Google (US): The embedded location map on the contact page (loaded only with your consent), and the PageSpeed Insights API, which receives the website address you submit when you run one of our free scanning tools.
• Professional advisers: Lawyers, accountants, and other advisers where necessary.
• Legal requirements: When required by law or to protect our rights.

All processors are required to maintain the confidentiality and security of your personal information and may only use it for the purposes we specify.

We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction. These measures include:

• SSL/TLS encryption for data in transit
• Secure hosting with reputable providers
• Regular security assessments
• Access controls and authentication
• Staff training on data protection

We retain your personal information only for as long as necessary to fulfil the purposes for which it was collected, including:

• Enquiry data: 2 years from last contact
• Client data: Duration of relationship plus 6 years (legal requirement)
• Free tool reports: if you ask for a report by email, we keep your email address and results so we can send them and follow up — for up to 2 years, or until you ask us to stop
• Tool scans: results (including a page screenshot) are cached for around 5 minutes to serve your session, and scanned addresses appear in rate-limit logs for about an hour
• Analytics: We use Cloudflare Web Analytics, which is cookieless and aggregate — it holds no personal data about you
• Rate-limiting: Your IP address is held briefly (typically under an hour) to prevent form abuse, then discarded

Under UK data protection law, you have the right to:

• Access: Request a copy of the personal data we hold about you
• Rectification: Request correction of inaccurate or incomplete data
• Erasure: Request deletion of your personal data in certain circumstances
• Restriction: Request restriction of processing in certain circumstances
• Portability: Request transfer of your data to another organisation
• Objection: Object to processing based on legitimate interests
• Withdraw consent: Withdraw consent at any time where processing is based on consent

To exercise any of these rights, please contact us at info@oxfordwebservices.com

Some of our processors are based in the United States (Cloudflare, Resend, Calendly, and Google), so your information may be transferred to and processed there. Where this occurs, we rely on appropriate safeguards, such as:

• The UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses
• Transfers to countries covered by UK adequacy regulations

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the "Last updated" date.

We encourage you to review this Privacy Policy periodically for any changes.