Privacy policy

1. Introduction

Salt & Pixel ("we", "us", "our") is committed to protecting your personal data and respecting your privacy. This policy explains what information we collect on saltandpixel.co.uk, why we collect it, and what rights you have over it.

We collect only what we need, we never sell your data, and we keep it only for as long as necessary. If you have any questions, the contact details at the end of this policy are the right place to start.

2. Who we are

Salt & Pixel is the data controller responsible for your personal data collected through this website. We are a web design agency based in the North West of England, serving small businesses across the UK.

For all privacy-related queries, please contact us at: hello@saltandpixel.co.uk

3. What data we collect and why

We collect only the minimum personal data necessary to respond to your enquiry or deliver the service you have requested. Specifically:

• Contact form submissions: your name, email address, and the message you send us. We use this solely to respond to your enquiry.
• Discovery call bookings (via Calendly): your name, email address, and chosen appointment time. We use this to schedule and conduct the call.
• Website analytics (via Google Analytics 4): anonymised usage data including pages visited, referral source, approximate geographic location (country/city level), device type, and session duration. We use this to understand how people use our site and improve it over time.
• Server logs (via Vercel): your IP address and browser information, retained briefly for security and abuse monitoring.

4. Legal basis for processing

We only process personal data when we have a lawful basis to do so under UK GDPR (UK General Data Protection Regulation). The bases we rely on are:

• Legitimate interest (Article 6(1)(f) UK GDPR) - for contact form enquiries and discovery call bookings. When you reach out to us, we have a legitimate interest in responding to and managing that request. We have considered this against your interests and rights and concluded it does not override them.
• Consent (Article 6(1)(a) UK GDPR) - for Google Analytics cookies. You can withdraw this consent at any time by adjusting your browser settings or using the Google Analytics opt-out add-on (see the Cookies section below).
• Legal obligation (Article 6(1)(c) UK GDPR) - where we are required to retain or disclose data to comply with applicable law.

5. Cookies and analytics

This website does not set first-party functional cookies. However, the following third-party cookies may be placed on your device:

• Google Analytics 4 cookies (_ga, _ga_*): these track anonymous usage statistics. They persist for up to 2 years. You can opt out using the Google Analytics opt-out browser add-on (available at tools.google.com/dlpage/gaoptout) or by enabling "Do Not Track" in your browser.
• Calendly cookies: when you interact with our booking widget, Calendly may set its own cookies. Please see Calendly's privacy policy at calendly.com/privacy for details.

6. Third-party processors

We share personal data only with the third-party service providers listed below, and only to the extent necessary to deliver the service you have requested. Each provider has been selected for their commitment to data protection.

• Resend (resend.com) - transactional email delivery. When you submit our contact form, your message is transmitted via Resend to our inbox. Resend is based in the United States; data transfers are covered by Standard Contractual Clauses.
• Calendly (calendly.com) - appointment scheduling. If you book a discovery call, your booking details are processed by Calendly. Calendly is based in the United States; data transfers are covered by Standard Contractual Clauses. See calendly.com/privacy.
• Google Ireland Ltd (google.com) - Google Analytics 4. Google acts as a data processor for analytics data. See policies.google.com/privacy.
• Vercel Inc (vercel.com) - website hosting. Vercel processes server logs, including IP addresses, for security purposes. See vercel.com/legal/privacy-policy.

7. Data retention

We keep your data only for as long as necessary for the purpose it was collected, or as required by law. Our standard retention periods are:

• Contact form enquiries: retained in our email inbox for up to 24 months from the date of last contact, then deleted.
• Discovery call records: retained for up to 24 months after the call, then deleted. Calendly's own retention is governed by their policy.
• Google Analytics data: subject to GA4's default retention period of 14 months.
• Vercel server logs: retained for approximately 30 days.

8. Your rights

Under UK GDPR, you have the following rights in relation to your personal data:

• Right of access: you can request a copy of the personal data we hold about you.
• Right to rectification: you can ask us to correct inaccurate or incomplete data.
• Right to erasure ("right to be forgotten"): you can ask us to delete your data where there is no compelling reason for us to continue processing it.
• Right to restriction: you can ask us to restrict processing of your data in certain circumstances.
• Right to data portability: you can ask us to provide your data in a structured, machine-readable format.
• Right to object: you can object to processing based on legitimate interest at any time. We will stop unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to withdraw consent: where processing is based on consent (e.g. analytics cookies), you can withdraw consent at any time without affecting the lawfulness of prior processing.

9. How to exercise your rights

To exercise any of the rights above, please email us at hello@saltandpixel.co.uk with a brief description of your request. We will respond within one calendar month as required by UK GDPR. We will not charge for reasonable requests.

We may ask you to verify your identity before fulfilling a request to protect against unauthorised access to your data.

10. Right to complain

If you believe we have not handled your personal data in accordance with UK GDPR, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection.

ICO website: ico.org.uk

ICO helpline: 0303 123 1113

We would always prefer the chance to address your concerns directly first, so please contact us at hello@saltandpixel.co.uk before escalating to the ICO.

11. We do not sell your data

Salt & Pixel does not sell, rent, trade, or otherwise transfer your personal data to third parties for their own marketing or commercial purposes.

Your data is shared only with the processors listed in section 6 above, and solely to deliver the service you have requested from us.

12. Children

This website is not directed at children under the age of 18. We do not knowingly collect personal data from minors. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

13. Changes to this policy

We may update this privacy policy from time to time. The "Last updated" date at the top of this page reflects when it was last revised. If we make material changes, we will update this page accordingly.

We encourage you to review this policy periodically to stay informed about how we protect your data.

14. Contact us

For any questions about this privacy policy or how we handle your personal data, please email us at hello@saltandpixel.co.uk. We aim to respond to all privacy enquiries within 5 working days.