Privacy Policy
How Xpose Web Design collects, uses and protects your personal data. Covers cookies, contact forms, analytics and your rights under UK GDPR.
Last updated: 24 June 2026
This privacy notice explains how Xpose Web Design (“Xpose”, “we”, “us” or “our”) collects, uses and protects your personal data when you visit xpose.online or get in touch with us. It also sets out your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Who we are
Xpose Web Design is the data controller responsible for your personal data. You can reach us at:
- Xpose Web Design, Riverside Business Centre, 61-63 Riverside Road, Norwich NR1 1SR
- Email: start@xpose.online
- Phone: 01603 327147
We are not required to appoint a dedicated Data Protection Officer, but the contacts above are responsible for any data-protection questions.
The personal data we collect
We only collect data that you choose to give us, plus the limited technical data needed to run the website. We do not buy or sell personal data, and we do not use it for automated decision-making or profiling.
When you make an enquiry
Our contact and enquiry forms ask for your name, email address, phone number (optional) and the details of your message. We use this to reply to you and to discuss the work you’re interested in.
When you leave a review
Our review form collects your name, your business name (optional), your star rating and the words of your review. It also records whether you have given us permission to publish your review on this website.
When you use the Website Health Check
If you use our Website Health Check tool, you enter a website address to test. That address is sent to Google’s PageSpeed Insights service to generate the report, which is shown to you in your browser. We don’t need your personal details to run the check and we don’t store the results.
Analytics
If — and only if — you accept analytics cookies, Google Analytics 4 collects pseudonymous information about your visit: the pages you view, your approximate location (your IP address is anonymised), your device and browser type, and how you move around the site. This does not tell us who you are. If you decline, no analytics data is collected. See our cookie policy for the detail.
Technical data
As with most websites, our hosting provider keeps standard server logs (such as IP address and browser type) for a short period to keep the site secure and working correctly. We don’t use these logs for marketing.
How we use your data, and our lawful basis
Under the UK GDPR we must have a lawful basis for using your personal data. Our bases are:
- Responding to your enquiry and quoting for work — lawful basis: legitimate interests (to respond to people who contact us) and, where relevant, taking steps at your request before entering into a contract.
- Publishing a review you submit — lawful basis: consent, which you give by ticking the permission box on the review form. You can withdraw it at any time.
- Analytics — lawful basis: consent, given through the cookie banner. No analytics run until you accept.
- Keeping the site secure and available — lawful basis: legitimate interests (protecting our website and visitors).
Who we share your data with
We don’t sell your data. We share it only with the trusted providers that help us run the site, each acting under contract on our instructions:
- FormHam (app.formham.co.uk) — processes our website form submissions and delivers them to us by email at start@xpose.online.
- Google — provides Google Analytics 4 (only after you consent) and the PageSpeed Insights service behind our Website Health Check.
- Our hosting and email providers — store the website and the enquiry emails we receive.
We may also disclose data where we are required to by law.
International transfers
Some of our providers, including Google, may process data outside the UK. Where that happens, we rely on appropriate safeguards — such as a UK adequacy decision or the UK International Data Transfer Agreement / Addendum — so your data keeps an equivalent level of protection.
How long we keep your data
- Enquiries: kept while we deal with your enquiry and for a reasonable period afterwards (normally up to 24 months), or for the life of our working relationship if you become a client.
- Reviews: kept for as long as the review is published, or until you ask us to remove it.
- Analytics: retained by Google Analytics for up to 14 months, then automatically deleted.
Your rights
Under the UK GDPR you have the right to:
- be told how your data is used (this notice);
- access a copy of the personal data we hold about you;
- have inaccurate data corrected;
- have your data erased;
- restrict or object to how we use it;
- data portability; and
- withdraw consent at any time, where we rely on consent.
To exercise any of these, email start@xpose.online. We’ll respond within one month and won’t charge you in normal circumstances.
Cookies
This website uses a cookie-consent banner and a small number of cookies and similar technologies. Full details, including a table of every cookie, are in our cookie policy.
Children’s privacy
This website and our services are aimed at businesses and are not directed at children. We don’t knowingly collect data from anyone under 16.
Complaints
If you have a concern, please contact us first and we’ll do our best to put it right. You also have the right to complain to the UK’s data-protection regulator:
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.
Helpline: 0303 123 1113 · ico.org.uk
Changes to this notice
We may update this notice from time to time. The “last updated” date at the top shows when it last changed. Please check back occasionally.
Contact us
Questions about this notice or your data? Email start@xpose.online or call 01603 327147.
Any questions?
Get in touch and a real person will help.