Your data, handled with care.

Who we are

This policy explains how Website Unboxed ("we", "us") collects and uses personal data when you visit websiteunboxed.com, request a free redesign, request a quote, book a call or work with us.

For personal data covered by the UK and EU GDPR we act as the controller. Under India’s Digital Personal Data Protection Act, 2023 (DPDP Act) we act as the Data Fiduciary. When we build or run a website for a client, the client is responsible for its own visitors’ data and we act on its instructions as a processor.

What we collect

We only collect what we need:

• Details you give us: your website address, email, name, company, role, project goals, page count, timeline, brand asset links and notes, from our free redesign, quote and contact forms.
• Booking details: your name, email and chosen time when you book a call through Calendly.
• Usage data, with your consent where required: pages viewed, clicks on buttons, form starts, approximate location, device and browser, collected with Google Analytics 4 and Google Tag Manager.
• Advertising data, with your consent where required: whether you arrived from or converted on our Google Ads.
• Security data: IP address and request logs processed by Cloudflare to protect the site and stop spam, including Cloudflare Turnstile checks on forms.
• Project data: content, files and account access you share with us when we work together.

How we use it

• To make and send your free homepage redesign, quotes and written scopes.
• To reply to you, schedule calls and send one follow-up about your request.
• To deliver client projects, including work done with our partners.
• To understand which pages help visitors and to measure our ads.
• To keep the site and forms secure and free of spam.
• To meet legal, tax and accounting duties.

We do not sell your personal data. We do not use it to train AI models.

Legal bases (UK and EU)

• Contract or steps before a contract: redesign requests, quotes, calls and client work.
• Legitimate interests: one follow-up about your request, site security and spam prevention.
• Consent: analytics and advertising cookies in the UK and EU. You can withdraw it any time in Cookie settings.
• Legal obligation: keeping invoices and records.

In India we process your data with your consent, given through our forms and consent notice, or for legitimate uses allowed by the DPDP Act.

Cookies and consent

Our cookie banner adapts to where you are. In the UK and EU, analytics and advertising cookies stay off until you opt in, and Google Consent Mode v2 passes your choice to Google. In US states with privacy laws you can opt out, and we honour Global Privacy Control signals. In India we show a notice and ask for your consent. Strictly necessary cookies for security and remembering your choice are always on.

You can change your choice at any time from Cookie settings in the footer.

Partners and service providers

We share personal data only with providers that help us run the site and deliver projects, under contracts that limit how they use it. Some project work is delivered with our partners Waftr (analytics and measurement) and NexTranslate (translation). Website Unboxed stays responsible for that work.

We may also share data if the law requires it, or with a buyer if our business is sold, under the same protections.

International transfers

Some providers process data outside your country, including in India and the United States. Where UK or EU data leaves those regions, we rely on adequacy decisions, the EU Standard Contractual Clauses or the UK International Data Transfer Addendum.

How long we keep it

• Redesign and quote requests that don’t become projects: only as long as we need them to follow up on your request.
• Client project records and invoices: as long as tax and company law require.
• Analytics data: for the retention period set in Google Analytics 4.
• Booking data: as long as Calendly and our calendar keep it.

Your rights

Depending on where you live, you can ask to access, correct, delete or export your data, object to or restrict how we use it, and withdraw consent. Under the DPDP Act you can also nominate someone to act for you and raise a grievance with us. Residents of US states with privacy laws can opt out of the sale or sharing of personal data for ads and will not be treated differently for using their rights.

To make a request, contact us through the form on this site. We reply within one month, or sooner where the law requires. You can also complain to your local data protection authority, such as the UK ICO, your EU supervisory authority or the Data Protection Board of India.

Grievance officer (India)

To raise a grievance, contact us through the form on this site. We resolve grievances within the time the DPDP rules require.

Security

We use encryption in transit, Cloudflare’s firewall and bot protection, least-privilege access to accounts, and two-factor sign-in on the tools that hold your data. No system is perfectly secure; if a breach affects you, we will tell you and the regulators as the law requires.

Children

Our services are for businesses. We do not knowingly collect data from anyone under 18.

Changes and contact

We will update this page when our practices change and show the new date at the top. For questions, contact us through the form on this site.