Privacy Policy

1. Who we are

Waltham and Lenton Digital is the data controller for personal data collected through this website and our contact forms.

To contact us about privacy matters, email [email protected].

2. What data we collect

Depending on how you interact with us, we may collect:

• Identity and contact details you submit (for example name, company name, email address, and phone number).
• Message content and any other information you choose to include in an enquiry.
• Technical data needed to run and secure the site (for example IP address, browser type, and security challenge results from Cloudflare Turnstile).
• Basic usage data if we use privacy-friendly analytics or similar tools in future (we will update this policy if that changes).

3. How we collect data

We collect data when you:

• Submit a contact form on our website.
• Email or phone us directly.
• Browse our website (limited technical and security data processed by our hosting and security providers).

4. Why we use your data (lawful bases)

We use personal data for the following purposes and lawful bases:

• Responding to enquiries and providing quotes or information you request — legitimate interests and/or steps prior to a contract (UK GDPR Article 6(1)(b) and 6(1)(f)).
• Operating, securing, and troubleshooting our website (including bot protection) — legitimate interests (Article 6(1)(f)).
• Complying with legal obligations where applicable — legal obligation (Article 6(1)(c)).
• Where we rely on consent (for example optional marketing in future), we will ask for it clearly and you can withdraw it at any time.

5. Contact form consent

When you send a message through our website forms, you must confirm that you agree to this Privacy Policy for the purpose of handling your enquiry. That confirmation is recorded with your submission so we can show we processed your request on a transparent basis.

Submitting the form is voluntary. If you prefer not to use the form, you can contact us by email or phone instead.

6. Who we share data with

We use trusted service providers to operate our site and deliver enquiries. They only process data on our instructions and where appropriate safeguards apply:

We do not sell your personal data.

• Cloudflare — website hosting (Cloudflare Pages), security (including Turnstile), DNS, and email routing.
• AhaSend — transactional email delivery for contact form notifications.
• Our email inbox provider (via Cloudflare Email Routing) to receive and reply to messages.

7. Cloudflare Turnstile

Our contact forms use Cloudflare Turnstile in Invisible mode to help distinguish people from bots and reduce spam and abuse. Turnstile may process limited technical signals from your browser for that security purpose.

As a condition of using Invisible Turnstile, we reference Cloudflare’s Turnstile Privacy Addendum, which explains how Cloudflare processes those signals: Cloudflare Turnstile Privacy Addendum.

Cloudflare’s broader privacy practices are also described in Cloudflare’s Privacy Policy at cloudflare.com/privacypolicy/.

8. International transfers

Some providers may process data outside the UK. Where that happens, we take steps to ensure appropriate safeguards are in place (for example UK adequacy regulations or standard contractual clauses), as required by UK GDPR.

9. How long we keep data

We keep enquiry data for as long as needed to respond to you and manage our business relationship, and for a reasonable period afterwards for record-keeping, dispute resolution, and legal compliance.

Typical enquiry records are reviewed within 24 months. We may retain correspondence longer if there is an ongoing project, legal claim, or statutory requirement.

Security logs may be retained for shorter periods according to our providers’ configurations.

10. Your rights

Under UK GDPR you may have the right to:

• Access your personal data.
• Rectify inaccurate data.
• Request erasure in certain circumstances.
• Restrict or object to certain processing.
• Data portability where applicable.
• Withdraw consent where processing is based on consent.

11. How to exercise your rights

Email [email protected] with your request. We may need to verify your identity before responding. We aim to respond within one month.

You can also complain to the Information Commissioner’s Office (ICO) at ico.org.uk if you are unhappy with how we handle your data.

12. Security

We use appropriate technical and organisational measures to protect personal data, including HTTPS, security headers, bot protection on forms, and keeping secrets off the public website. No method of transmission or storage is completely secure, but we work to reduce risk.

13. Children

Our website and services are aimed at businesses and adults. We do not knowingly collect personal data from children.

14. Changes to this policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top of the page will change when we do. Continued use of the site after updates means you should review the revised policy.