Privacy Policy

1. Introduction

Y & I Web Lab respects your privacy and is committed to protecting your personal data. This policy explains what we collect, why, how we use it, and your rights under the UK GDPR and Data Protection Act 2018.

2. Data Controller

The data controller is Y & I Web Lab, contactable at yi.web.lab@gmail.com. We operate as a small independent studio based in the United Kingdom.

3. What We Collect

We may collect the following types of information:

• Contact details — name, email address, phone number, business name, submitted via our contact form or by email.
• Project information — details about your business, brand preferences, content, and any other information you share to help us build your website.
• Website usage data — anonymous analytics about how visitors use our site (pages viewed, approximate location, device type).
• Payment information — handled directly by our payment provider; we do not store full card details.

4. How We Use It

• To respond to enquiries and provide quotes.
• To design, build, and deliver the agreed services.
• To send invoices and collect payment.
• To send project-related updates (proposals, progress, support).
• To improve our own website and services.

We do not sell, rent, or trade your personal data to third parties. We do not use your data for unsolicited marketing.

5. Legal Basis (GDPR)

• Contract performance— to deliver the services you've requested.
• Legitimate interest — to respond to enquiries and run our business.
• Legal obligation — to keep financial records for the legally required period (typically 6 years).
• Consent— where you've explicitly opted in (for example, to a newsletter, though we don't currently operate one).

6. Sharing & Third Parties

We use a small number of trusted third-party services to operate our business. These providers may process limited personal data on our behalf under their own GDPR-compliant terms:

• Vercel — website hosting and deployment.
• Google (Gmail) — for email correspondence.
• Firebase / Firestore — when used for client projects with databases.
• Payment processors — where used, to collect secure payments.

We never share data with third parties for their own marketing purposes.

7. Data Retention

• Enquiry details — up to 12 months after last contact.
• Active client records — kept for the duration of the working relationship.
• Financial records — kept for 6 years after the end of the financial year (legal requirement).
• Project files — archived for up to 2 years after project completion, then deleted unless a support agreement is in place.

8. Your Rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate data.
• Request deletion of your data (where legally possible).
• Object to certain kinds of processing.
• Request data portability.
• Withdraw consent where processing is based on consent.
• Lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

To exercise any of these rights, contact us at yi.web.lab@gmail.com. We respond within 30 days.

9. Cookies

Our website uses minimal, essential cookies required for basic functionality (such as session handling). We do not use third-party advertising or tracking cookies. If we introduce analytics in future, we will update this policy and, where required, request your consent.

10. Changes

We may update this policy from time to time. The “last updated” date at the top of this page shows when it was last revised. Material changes will be highlighted on our homepage or notified by email where appropriate.

11. Contact

For any questions or data requests, get in touch at yi.web.lab@gmail.com or by phone on 07748 597 146.