Privacy Policy

Last updated: September 2026

Who we are

Whitfield Enterprises Limited trades as Whitfield IT (whitfield.it). We are a web design, SEO, paid advertising, AI automation and analytics studio working with businesses across North Wales, the North West and the rest of the UK.

Company registration number: 08832399. We are the data controller for the personal data described on this page.

You can contact us about anything here at hello@whitfield.it or on 01244 565 666.

What we collect, and where it comes from

When you get in touch with us. If you fill in an enquiry, contact or intake form, run the free website audit, buy a service through our website, or email or call us, we collect what you give us: your name, email address, phone number, business name, website address, and whatever you tell us about what you need.

When you become a client. We hold the details needed to do the work and run the account: contact details, the services agreed, quotes, contracts, invoices and payment records, project notes, support tickets, messages sent through your client portal, and any files or logins you choose to share with us there.

When we research a business before contacting it. We contact limited companies we believe could benefit from a better website or from being found online. To decide who to contact, we look at information the business has already made public: its website, its Companies House record, its listings on social networks and directories, and how it appears in search results. We do not buy marketing lists.

When you visit our website. Standard technical information: pages viewed, the device and browser used, approximate location from your IP address, and how you arrived. See Cookies below.

Why we use it, and the legal basis

• To answer you and provide what you asked for, including running a free audit or sending a report. Basis: performing a contract, or the steps you asked us to take before one.
• To run our business relationship with you as a client: the work, the portal, invoicing, support. Basis: contract, and our legal obligations for accounting records.
• To contact businesses about our services. We send a small number of individually researched emails to limited companies, and we may telephone businesses. Basis: legitimate interests, as permitted for corporate subscribers under the Privacy and Electronic Communications Regulations. Every email carries an unsubscribe link, we screen telephone numbers against the Telephone Preference Service and the Corporate TPS before calling, and any request to stop is honoured immediately and permanently. We do not send marketing to sole traders or individuals without consent.
• To sort and summarise the messages we receive. We use AI tools to sort incoming enquiries and email replies, so the right one gets a quick answer, and to summarise recorded calls into short notes. A person reads and decides anything that matters. Basis: legitimate interests, answering you quickly and accurately.
• To suggest which of our services suits a business. We may use AI tools to suggest which of our services suits a business, from public information about the business and from what the business has told us. A person always makes the final decision. Basis: legitimate interests, offering each business the service that fits it.
• To understand and improve our website. Basis: legitimate interests, using analytics data that does not identify you.
• To meet legal obligations, for example keeping financial records. Basis: legal obligation.

We never sell personal data. We do not share it with anyone for their own marketing.

Recorded calls

We record some phone calls so we can make accurate notes for follow-ups:

• Calls to our business number. You hear “Calls to Whitfield IT are recorded so we can make accurate notes for follow-ups” before it rings.
• Follow-up calls to businesses we are already talking to, such as a demo or going through a proposal. We tell you during the call. We do not record a first call to a business that has not heard from us before.
• Calls with our clients, where our agreement with you says so. You hear a short message that the call is recorded before we are connected.

If you would rather we did not use a recording, say so, on the call or afterwards, and we delete it without transcribing it; if a note has already been made from it, we delete that too. You can also ask us never to record calls with you, and we will not.

Otherwise the recording is turned into text on our own computer in our office, the text is summarised into a short note on your record by an AI tool, and the recording is then deleted from Twilio, normally within the hour. We keep the transcript and the note for 12 months and then delete them. Basis: legitimate interests, keeping an accurate record of our conversations. You can object at any time, and ask for a copy or for deletion as described under Your rights.

Who else sees it

We use a small number of providers to run the business, each acting on our instructions under their own data processing terms:

• Google Workspace for email, and Google Analytics and Search Console for website and search data.
• Stripe for card payments and Direct Debit. We never see or store your card details.
• Brevo for delivering transactional emails such as receipts and portal notices.
• Twilio for our business telephone line. Calls are logged (who, when, how long), and some are recorded: see Recorded calls above. If you leave us a voicemail, it is recorded so we can listen to it and call you back.
• AI tools that sort messages, summarise call notes and suggest which of our services suits a business, acting on our instructions. They receive the text only, never a recording.
• Our web host in the United Kingdom, where our systems and your client portal run.
• Companies House and DataForSEO as sources of public business and search data used in research.

Some of these providers process data outside the UK. Where they do, transfers are covered by the UK’s international data transfer agreement or an adequacy decision.

Your client portal

Clients get a login to a portal at whitfield.it/portal. It holds your projects, invoices, documents, messages and support tickets. If you choose to share a password with us through the portal’s vault, it is stored encrypted, only the team at Whitfield IT can retrieve it, and every time it is used you can see the date and whether it was copied or viewed. Remove anything you have shared whenever you like.

How long we keep it

• Enquiries that do not become work: up to 3 years, so we can pick up where we left off if you come back.
• Research on businesses we have not contacted or who have not replied: reviewed regularly and removed when it is no longer relevant.
• Client records, contracts, invoices and payment records: 7 years after the relationship ends, as required for accounting and tax.
• Recorded calls: the recording is deleted once the note is made, normally within the hour, or as soon as you ask us not to use it. The transcript and the note are kept for 12 months from the call, then deleted.
• Do-not-contact requests: kept permanently, because that is the only way to honour them.

Your rights

Under UK GDPR you can ask us to: tell you what personal data we hold about you and give you a copy; correct anything wrong; delete it, where we have no legal reason to keep it; restrict or object to how we use it, including objecting to marketing at any time; and give you your data in a portable form. Where we rely on consent you can withdraw it at any time.

Email hello@whitfield.it and we will respond within 30 days. If you are unhappy with our answer you can complain to the Information Commissioner’s Office at ico.org.uk.

Cookies

Google Analytics sets two cookies on this site, _ga and _ga_EK6GKDV791. They let us count how many people visit, which pages they read and how they found us. They do not tell us who you are. We do not use them for advertising: Google Signals and ad personalisation are switched off, both on our Analytics property and in the tag on the page, so your visit is not used to build an advertising profile of you.

Google discards the IP address of visitors from the UK, the EU and Switzerland before it is recorded. It is used to work out an approximate town and is then thrown away. We never see it.

We also count visits without cookies. Each page you open sends us the page address, the site that linked you here and any campaign tag in the link. We group one day’s page views with a code that cannot be traced back to you and changes every day, so it cannot follow you from one day to the next. We do not store your IP address. When you send a form, call, or accept a quote, we note which page and campaign led there, so we know which of our work brings people in. We never sell this or use it for advertising.

One other cookie is set, and only on the pages where you fill in a project brief. It is called PHPSESSID, it lasts an hour, and it holds nothing about you: it is there to protect the form against being submitted from somewhere else. The form cannot work without it, so it is not something you are asked to agree to.

You can turn analytics off. At the foot of every page there is a line telling you whether analytics is on, with a link to switch it. Turn it off and the Google Analytics script is never loaded at all, so no cookie can be set and nothing is recorded, and any Google Analytics cookie already on your device is deleted. We remember that choice in your browser’s local storage and in a small cookie named wit-analytics, which exists only to record it. The site works exactly the same either way, and you can turn it back on from the same link.

We rely on the statistical purposes exception in Schedule A1 of the Privacy and Electronic Communications Regulations, which is why you are reading this rather than clicking through a cookie banner.

You can also block or delete cookies in your browser settings at any time; the site will still work.

Security

Everything between your browser and our systems is encrypted. Access to client data is limited to the people who need it to do the work, protected by individual logins. Passwords shared with us are encrypted at rest. Backups are taken daily and kept off the server.

Changes

When this policy changes, the date at the top of the page changes with it. Material changes that affect clients are also mentioned in the portal.

Company details: Whitfield Enterprises Limited, registered in England and Wales, company number 08832399, registered office: Selby Towers, Princes Drive, Colwyn Bay LL29 8PE. Whitfield IT is its trading name.