FloatWebGet a quote

Privacy policy

What we collect when you visit the site or work with us, and what we do with it.

Effective date: October 31, 2026

Who we are

FloatWeb is a trading name of Spencer Bullock and Mantas Statkevicius, who run it as a partnership. The two partners are the controller of the personal data described here, which means we decide how it is used and we are responsible for it. Postal address available on request. Email [email protected].

This policy covers floatweb.co.uk, our client portal and the emails we exchange with you. It does not cover websites we build for clients: each client is responsible for the privacy policy on its own site.

What we collect and why

When you use the contact form

  • What: your name, email address and message, plus your IP address and browser details, which we keep to stop spam and abuse.
  • Why and lawful basis: to reply to you and, if you ask, to prepare a quote. This is in our legitimate interests and is a step you ask us to take before a possible contract.
  • How long: up to two years after we last heard from you, unless you become a client.

When you email us

  • What: your email address, name and whatever you write or attach.
  • Why and lawful basis: to deal with what you have asked. Legitimate interests, or our contract with you if you are a client.
  • How long: up to two years after we last heard from you, or as long as client records below if you are a client.

When you sign up to the newsletter

  • What: your email address, your name if you give it, your IP address and when you signed up and confirmed.
  • Why and lawful basis: to send you the newsletter. We only send it after you click the link in our confirmation email. The basis is your consent, which you can withdraw at any time with the unsubscribe link in every issue.
  • How long: until you unsubscribe. After that we keep only your email address and the date you left, so we never email you again by mistake.

When you are a client

  • What: your name, business details, address, email, phone number, our agreement, invoices and payments, and the messages and files we exchange. If you have a client portal account, we also keep your login details (your password is stored only as a secure hash) and sign-in records such as IP address, device and time.
  • Why and lawful basis: to do the work and run our agreement with you (contract), to keep accounting and tax records (legal obligation), and to keep the portal secure (legitimate interests).
  • How long: agreements, invoices and payment records for six years after the end of the tax year they relate to. Other project records for six years after our work together ends. Sign-in and security records for up to 400 days.

When we contact a business

  • What: business names, addresses, phone numbers, websites and contact email addresses, taken from public business listings (Google Maps), the business's own website, web search results and Companies House.
  • Why and lawful basis: to find businesses that might want a website or an audit of their current one, and to get in touch with them. This is in our legitimate interests. You can tell us to stop at any time and we will.
  • How long: up to two years after we last contacted you. If you ask us not to contact you again, we keep only enough to make sure we never do.

Analytics and cookies

  • Analytics, only if you accept: we use Google Analytics to count visits and see which pages are useful. It sets cookies named _ga and _ga_ followed by an ID, which last up to two years, and it records the pages you visit, how you arrived, your device and browser, and your approximate location. Google does not store your IP address in Google Analytics. Google Analytics does not load at all until you click Accept, and Google keeps this data for no more than 14 months. The lawful basis is your consent.
  • Always on, because the site needs them: your cookie choice, stored in your browser so we do not ask again; a sign-in cookie, only if you log in to the client portal, which lasts no more than 7 days; and small settings stored in your browser, such as whether the site's sound is on.
  • You can change your mind at any time: . Rejecting removes the Google Analytics cookies.

Server and security logs

Like every website, ours receives your IP address and browser details when you visit, so that it can send you the page and block attacks. Our hosting and Cloudflare keep these in short-term logs, and the records we use to limit repeated attempts (such as too many contact form messages) are deleted after one day. The lawful basis is our legitimate interest in keeping the site working and secure.

Who we share it with

We do not sell your data or share it for anyone else's marketing. We use these providers to run the business, and they only handle personal data on our instructions:

  • Our hosting provider, which runs the servers for this site, the client portal and our database.
  • Cloudflare, which sits in front of the site to deliver it quickly and protect it from attacks.
  • IONOS, which hosts our email.
  • Google, for Google Analytics (only if you accept analytics cookies) and for the business listings we search.
  • Brave Search, which we search to find a public contact email for a business.

We may also share data with our professional advisers, or where the law requires it, for example with HMRC.

Data sent outside the UK

Some of these providers, including Google and Cloudflare, are based in the United States or process data there. Where that happens, the transfer is protected by the UK's data bridge with the United States for providers certified under it, or by the UK's approved contract terms (the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses). You can ask us for details.

Your rights

Under UK data protection law you have the right to:

  • ask for a copy of the personal data we hold about you;
  • have it corrected if it is wrong, or deleted;
  • ask us to limit how we use it, or object to how we use it;
  • object at any time to us contacting you for marketing, and we will stop;
  • withdraw your consent where we rely on it, for example for analytics or the newsletter;
  • receive the data you gave us in a common format, or have it sent to someone else.

Email [email protected] to use any of them. It is free, and we reply within one month. We do not make decisions about you by automated means alone.

Complaints

If you are unhappy with how we have used your data, please tell us first at [email protected]. You also have the right to complain to the Information Commissioner's Office (ICO), the UK regulator: ico.org.uk/make-a-complaint or 0303 123 1113.

Keeping it safe

Connections to the site are encrypted, passwords are stored only as secure hashes, and access to client data is limited to the two partners. No system is perfectly secure, but if something goes wrong that puts your data at risk, we will tell you and the ICO where the law requires.

Children

Our site and services are for businesses and adults. We do not knowingly collect data from children.

Changes to this policy

If we change how we use personal data, we will update this page and the effective date at the top. If the change matters to you as a client or subscriber, we will also email you.