Privacy policy

This policy explains how WE-DEV LTD (“WE-DEV”, “we”, “us”) collects and uses personal data when you visit we-dev.uk, contact us, buy a package or book hours, or work with us as a client. It is written to meet our obligations under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR).

Who we are

WE-DEV LTD is the controller of the personal data described in this policy.

• Registered in England and Wales, company number 15878974
• Registered with the Information Commissioner’s Office (ICO) as a data controller, registration reference ZC271018
• Address: Unit 6, Block 3, Woolwich Church Street, London SE18 5PQ, United Kingdom
• Email: info@we-dev.uk
• Phone: +44 (0)20 3918 3814

We are a small company and have not appointed a Data Protection Officer, because the law does not require us to. Questions about this policy or your data go to our founder, Danilo Fiorillo, at info@we-dev.uk.

When we build or maintain a website or app for a client and handle personal data on that client’s behalf (for example, the enquiries or orders their customers submit), the client is the controller and we act as their processor under a written agreement. This policy does not cover that processing; please read the client’s own privacy notice.

The personal data we collect

Information you give us

• Enquiries: your name, email address, phone number, company name and the details of your message when you use our contact form, email or call us.
• Bookings and orders: when you book hours or buy a package, your name, email address, phone number, billing address, whether you are buying as an individual or a business, company name and VAT number (if applicable), the service and hours chosen and any project details you provide.
• Client projects: contact details of the people we work with, meeting notes, project correspondence, and the access details you share so we can work on your website or systems.
• Account details: if we create a login for you on our site, your username, email address and password (stored in hashed form).

Information collected automatically

• Technical and security data: IP address, browser and device type, pages requested and the date and time of each request. Our hosting provider and our security tools (Wordfence and Limit Login Attempts) process this to keep the site available and protect it from attacks.
• Analytics data: only if you accept analytics cookies, Google Analytics 4 collects information about how you use the site, such as pages viewed, approximate location (country or city), device type and how you arrived. We also use Microsoft Clarity to capture how you use and interact with our website through behavioural metrics, heatmaps and session replay. Website usage data is captured using first- and third-party cookies. Anything you type into our forms is masked and is not recorded. For more information about how Microsoft collects and uses your data, visit the Microsoft Privacy Statement. See our cookie policy.

Payment data

Card payments are handled by Stripe. Your card details are entered into Stripe’s secure fields and go directly to Stripe. We never see or store your full card number. We receive a payment reference, the amount, the payment status and the last four digits and brand of your card.

We do not knowingly collect special category data (such as health information), and we ask you not to send it to us. Our services are aimed at businesses and adults; we do not knowingly collect data from children under 13.

How we use your data and our lawful bases

Where we rely on legitimate interests, we have balanced our interests against yours. You can ask us for details of that assessment. Where we rely on consent, you can withdraw it at any time.

We do not sell your personal data, and we do not use it for automated decision-making that has legal or similarly significant effects on you.

Who we share data with

We use carefully chosen service providers who process personal data only on our instructions and under contracts that require them to keep it secure. Services marked consent are only loaded after you accept the matching category in our cookie banner; nothing from them runs before that.

Stripe also acts as a separate controller for some purposes, such as fraud prevention and meeting its own legal obligations; see Stripe’s privacy policy. Google and LinkedIn act as separate controllers for some processing of advertising data; see their privacy policies. When you submit our quote form, and only if you have accepted marketing cookies, we share a hashed version of your email address and phone number with Google to measure the effectiveness of our advertising. Hashing turns them into a code that cannot be read back; Google can only match it against accounts it already holds. We may also share data with our accountant and professional advisers, with HM Revenue and Customs and other authorities where the law requires it, and with a buyer or successor if our business is ever sold or restructured.

International transfers

Some providers process data outside the UK. When they do, we rely on the safeguards UK law allows: UK adequacy regulations (for example, for the EU and EEA), the UK Extension to the EU-US Data Privacy Framework where the recipient is certified, or the International Data Transfer Addendum to the EU standard contractual clauses. You can ask us for more information about the safeguard used for a particular provider.

How long we keep data

• Enquiries that do not lead to work: up to 24 months after our last contact, then deleted.
• Client, booking, order and invoice records: six years after the end of the financial year in which the work ended, as required for accounting and tax purposes.
• Project files and access details: credentials you share are deleted or rotated when the work ends; project files are kept for as long as you remain a client and then for up to six years so we can support you and deal with any claims.
• Analytics data: Google Analytics retains event-level data for 14 months. Microsoft Clarity keeps session recordings for 30 days and heatmap and click data for 9 months.
• Security logs: kept for a short period, normally no longer than 90 days, unless needed to investigate an incident.
• Unfinished orders: 60 days, then deleted. If you ask us to stop these emails, we keep a scrambled record of your address so that we do not write to it again.
• Marketing: until you unsubscribe, after which we keep your email address on a suppression list so we do not contact you again.

How we protect your data

The site is served over HTTPS and protected by a web application firewall (Wordfence) and login-attempt limits. Admin accounts use strong passwords and two-factor authentication, access is limited to people who need it, and backups are encrypted. No system is completely secure, but if a breach occurs that is likely to put your rights at risk, we will notify the Information Commissioner’s Office (ICO) and, where required, you.

Your rights

Under UK data protection law you have the right to:

• ask for a copy of the personal data we hold about you (subject access);
• ask us to correct inaccurate or incomplete data;
• ask us to delete your data;
• ask us to restrict how we use your data;
• object to processing based on legitimate interests, and object at any time to direct marketing;
• receive data you gave us in a portable format, where processing is based on consent or contract and carried out by automated means;
• withdraw consent at any time, where we rely on consent.

To use any of these rights, email info@we-dev.uk or write to us at the address above. We may need to confirm your identity. We will reply within one month, which can be extended by up to two further months for complex requests; we will tell you if that happens. There is normally no charge.

Complaints

If you are unhappy with how we have handled your data, please contact us first at info@we-dev.uk so we can try to put it right. We will acknowledge your complaint within 30 days and respond without undue delay. You also have the right to complain to the Information Commissioner’s Office, the UK regulator for data protection: ico.org.uk, telephone 0303 123 1113, or Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

Cookies

We use strictly necessary cookies to run the site, take payments and keep it secure, and we use analytics and marketing cookies only if you agree. Full details, and how to change your choice, are in our cookie policy.

Discount codes

If you ask for a discount code on this site, we use the email address you give us to send the code and keep a record of which address each code was sent to, so that we can honour it. We do not add you to any mailing list unless you tick the box asking for occasional guides and offers, and you can stop those at any time by replying “unsubscribe” or emailing info@we-dev.uk. Unused codes and the addresses they were sent to are deleted within 12 months of the offer ending.

Unfinished orders

If you type your email address at our checkout and leave before paying, we save the contents of your basket with that address and send you one email about it, with a link back to your order and a way to ask for a call back. The checkout tells you this before you leave and gives you a box to refuse the email. We send one email only, we never send more than one such email to the same address in 30 days, and every email has a link to stop them for good. We keep these records for 60 days and then delete them. If you ask us to call you back, we use your phone number for that one call only.

The WE-DEV mobile app

Our app for Android and iPhone shows the same content as this website and gives clients a private area. Everything above applies to it. This section covers what is particular to the app.

• Signing in. You sign in with your email address and a one-time code we email you. The app then keeps a sign-in token in your phone’s secure storage. There is no password.
• What you send us. Quote requests, hour bookings, support tickets, messages and any files you attach, with your name, email and phone number where you give them. We use them to reply and to do the work, exactly as we do for the forms on this site.
• Notifications. If you turn notifications on, we store a notification token for your device and whether it is an Android phone or an iPhone, linked to your email once you sign in. Notifications are delivered by Firebase Cloud Messaging, a Google service. We send messages about your own work (ticket replies, project updates, invoices) and, only if you leave “News and guides” on, an occasional guide or offer. You can switch either off in My area, under Notifications, or in your phone’s settings, and we then remove the device from our list.
• Payments. The app does not take card payments itself. It opens our secure payment page, where Stripe processes the payment. The app never sees your card details.
• Stored on your phone. The app keeps a copy of the pages you have opened so they load quickly and work offline. Private content is removed when you sign out, and everything is removed when you uninstall the app.
• What the app does not do. No advertising, no advertising identifiers, no analytics or tracking tools, and no access to your location, contacts, camera or microphone. It only opens the files you choose to attach to a ticket.

Deleting your app account and data

You can ask us to delete your account and personal data at any time, in either of two ways: in the app, open My area and choose “Delete my data”; or email info@we-dev.uk from the address you use with us, with the subject “Delete my data”. We confirm by email, remove your sign-in details and device tokens straight away, and delete the rest of your personal data within 30 days. The only exception is the records we are required to keep, such as invoices and payment records, for the periods listed under “How long we keep data”.

WE-DEV Studio

Studio is our online tool for building your own website. Everything above applies to it. This section covers what is particular to Studio.

• Before you have an account. You can try Studio without registering. The site you are building is then kept only in your own browser (local storage), not on our servers.
• Your account. To save a site or order it you create an account with your name, email address and a password, and optionally a phone number. We email you a link to confirm the address. We use these details to keep your site for you, to contact you about it and to deliver what you order. Lawful basis: steps taken at your request before a contract, and performance of the contract.
• What you put in your site. The words, photos, logo and settings of each site you build are stored on our server, with earlier versions so that you can go back. Our team can open your site to help you, to finish it if you ask, and to check it before it goes online. Please do not put other people’s personal data in a site unless you are entitled to publish it.
• Reminders. If you start a site and stop, we may send up to two reminder emails to your confirmed address. Every reminder has a link that stops them. Lawful basis: our legitimate interest in helping you finish something you started.
• Ordering and paying. A site bought with one payment or two goes through our normal checkout, described above. If you choose the monthly plan, the payment is taken on a page run by Stripe, which also stores your card and takes the monthly payments. We keep Stripe’s reference numbers for you and your plan, the state of the plan (for example paid, late or paused), the dates and the amounts, and the time at which you accepted the plan’s terms. We never see or store your full card details.
• Automatic translation. If you ask Studio to translate your site into a second language, the text of your pages is sent to MyMemory, a translation service run by Translated S.r.l. in Italy, and the translation comes back. Nothing is sent unless you press the button. Do not translate text that contains personal or confidential information.
• Photo search. When you search for free photos, the words you type are sent from our server to Openverse, a search service of the WordPress Foundation. Your name, email address and IP address are not sent.
• Websites we publish for you. When your site is online, messages that visitors send through its contact or booking-enquiry form pass through our server and are emailed to you; we do not use them for anything else. We also count page views of your site, as plain totals with no identifiers, so that you can see how many visits it has. You are responsible for what your own website tells its visitors about their data; the privacy and cookie pages that Studio adds to your site are a starting point for you to check.
• How long we keep it. A site you have not ordered stays in your account until you delete it, which you can do yourself, or until you ask us to close the account; we may delete unfinished sites that have not been opened for 12 months. Order, payment and plan records are kept for six years, as set out above. When a monthly plan ends, the website is taken offline and may be deleted 30 days later.

Links to other websites

Our site links to other websites, including our clients’ sites. We are not responsible for their privacy practices, so please read their policies.

Changes to this policy

We may update this policy when our services, providers or the law change. The date at the top shows when it was last updated. If we make significant changes that affect how we use data you have already given us, we will tell you directly where we can.

See also our terms of business and refund policy.