Privacy notice
Last updated: 23 October 2026
This notice explains what personal data we use, where it comes from, why we use it, who else sees it, how long we keep it and what rights you have. It follows the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Who is responsible
Asil Aydemir and Shahir Bashiri, trading in partnership as Calder Web, 19 Wheatley Gardens, Enfield, London N9 9UE. Email: hello@calderweb.co.uk. We are the controller for the data described here. You deal directly with the people who build your site.
2. When you visit this website
Cloudflare delivers this site and protects it from attacks. To do that it processes technical data such as your IP address, browser type, the page you asked for and the time. We use this only to run the site securely. Lawful basis: legitimate interests (Article 6(1)(f)), namely a working and safe website.
We use no analytics and no advertising trackers.
The website preview on our home page
What you type into the preview (business name, trade, town) and any logo you choose stay in your browser. Nothing is uploaded or sent to us. We read your logo's colours on your device, and the logo is gone when you close the page. The details you typed appear in the part of the web address after the # sign, so you can save or share the preview. Browsers do not send that part to any server, so it does not reach us or our logs. If you press "Send me this draft", the contact form opens with those details filled in, and we receive them only if you send the form (section 3).
3. When you send an enquiry
If you use the form or email us, we receive your name, business name and town, email address, your phone number if you give it, your message and the page you sent it from.
- Why: to reply to you and prepare your free draft.
- Lawful basis: steps you asked for before a possible contract (Article 6(1)(b)), and our legitimate interest in answering enquiries (Article 6(1)(f)).
- Where: form enquiries are stored in Cloudflare's database service and deleted automatically after one year.
The form uses Cloudflare Turnstile to keep out spam. Turnstile checks signals from your browser and device to tell people from bots. Lawful basis: legitimate interests (keeping the form free of spam).
4. Businesses we contact
We look for trades businesses that may need a website and contact them once with a personal offer. If you received a letter or email from us, this section explains where your details came from.
Which data
- business name, company number, registered office address and industry code (SIC code)
- names of company directors as published on the Companies House register
- business email addresses and phone numbers that the business publishes itself
- whether the business has a website and whether it works
- when we contacted you, your reply and our notes about it
Where it comes from
The public Companies House register, public trade registers and directories, and the business's own website or public social media page. We check automatically whether a website loads.
Why, and on what basis
To offer you a website for your business. Lawful basis: legitimate interests (Article 6(1)(f)). Our interest is finding businesses that may benefit from a website. We keep the effect on you small: we use only data published for business purposes, we contact each business personally rather than in bulk, we never sell or share the data, and you can tell us to stop at any time.
How we contact businesses
By email only to limited companies and LLPs, and only at a business address on the company's own domain, never at a personal address such as Gmail. Sole traders and partnerships we contact only by post. Every message says who we are and how to opt out.
Personal preview links
A letter or email from us may contain a link that opens a preview of a website with your business name, trade and town already filled in. We build that link from the data listed above, mostly the Companies House register. The details sit after the # sign in the link, so opening it sends them to no server, including ours. The preview is an example made from your public details, not a website we have already built for you.
Your right to object
Reply "stop" or email hello@calderweb.co.uk, and we will never contact you again. To make sure of that, we keep only your business name and the address we used on a do-not-contact list.
How long we keep it
If you do not reply, or you are not interested, we delete your details within 3 months of our last contact, except the do-not-contact entry.
5. Clients
If you become a client, we use your contact, billing and project details to deliver the website and the monthly service. Lawful basis: the contract (Article 6(1)(b)) and our legal duties to keep business records (Article 6(1)(c)). We keep contracts and invoices for 6 years after the contract ends, the time in which contract claims can be brought in England, or longer where HMRC requires it (records must be kept for at least 5 years after the 31 January tax return deadline of the tax year they belong to).
When we host your website or run its forms, we also process the enquiries your own visitors send through it. For that data we act as your processor under the data processing terms in section 15 of our terms of service.
6. Who else sees the data
- Cloudflare, Inc. (USA): hosting, form storage, DNS and spam protection.
- Lark Technologies Pte. Ltd. (Singapore): our email and team messages, including a copy of each free draft request.
We do not sell personal data and do not pass it to anyone for their own marketing.
7. Data outside the UK
We are based in London. Part of our team works from Switzerland, which the UK recognises as giving adequate protection to personal data. Cloudflare processes data in the USA and elsewhere; transfers to the USA rely on Cloudflare's certification under the UK Extension to the EU-US Data Privacy Framework, and on standard contractual clauses where that does not apply. Lark stores data on servers in Singapore, the USA and Japan; transfers rely on the EU standard contractual clauses with the UK International Data Transfer Addendum, which are part of Lark's data processing terms.
8. How long we keep data
| Data | Kept for |
|---|---|
| Form enquiries | 1 year, then deleted automatically |
| Emails about an enquiry that did not lead to a contract | 1 year |
| Business contact data (section 4) | 3 months after our last contact |
| Do-not-contact list | As long as we contact businesses |
| Client contracts and invoices | 6 years after the contract ends, longer if HMRC requires it |
| Cloudflare technical logs | As set by Cloudflare in its privacy policy; we cannot change this |
9. Your rights
You can ask us for a copy of your data, to correct it, to delete it, to restrict its use, or to send it to you in a common format. You can object to any use based on legitimate interests. You can always object to direct marketing, and we will stop. Email hello@calderweb.co.uk. We reply within one month and charge nothing.
10. Complaints
Please tell us first, so we can put it right. You can also complain to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint, phone 0303 123 1113.
11. Cookies and storage
This site sets no cookies for tracking or advertising, so there is no cookie banner. Cloudflare may set strictly necessary security cookies, such as __cf_bm or cf_clearance, to tell people from bots, including when the form's spam check runs. They hold no tracking or advertising data and expire after a short time. Details are in Cloudflare's cookie list.
12. Changes
We update this notice when what we do changes. The date at the top shows the latest version.