Last updated: 11th November 2026

I've written this in plain English so it's genuinely easy to understand — not to soften or water down what I'm actually committing to. These are the same protections and rights you're entitled to under UK GDPR, just explained clearly rather than buried in dense wording.

Who I am

I'm Philip Osborne, trading as Philip Osborne Design. We Love Websites is a product name for my website service, not a separate company — this site is operated and this policy is issued by me personally, as a sole trader.
This policy covers personal data I collect through welovewebsites.co.uk and from people who enquire about or become customers of We Love Websites. It doesn’t cover visitors to customers’ own websites. Each customer decides how data collected through their website is used, and their privacy policy explains it. I only handle that data on their behalf.
As a small, solo-run business, I don't have a formal Data Protection Officer — but I take these responsibilities seriously and I'm the person you'll actually reach if you contact me about them. Get in touch any time at ku.oc.setisbewevolew%40troppus or using the contact form on this website.

What I collect, and why

I only collect what I actually need for the reasons below — nothing is gathered "just in case."
● If you contact me (enquiry form, email, or phone): your name, email address, and whatever else you choose to tell me, so I can reply to you.● If you become a client: billing details needed to invoice you, and any project information you share so I can do the work.● If you sign up to my newsletter: your email address, and only after you've actively opted in.● If you browse the site: some technical information may be collected via cookies — covered in full in my separate Cookie Declaration, not repeated here since it changes independently of this policy.

Why I'm allowed to process this data

● Contract: to deliver work you've asked me to do, or reply to an enquiry you've made.● Legitimate interest: to run and improve the business — kept balanced against your right to privacy at every point.● Consent: for anything not covered above, like marketing emails — and you can withdraw that consent whenever you like.

Who I share it with

I don't sell or rent your data to anyone. I do use a small number of service providers to run the business day to day, each bound by their own data protection terms:

Each provider only receives what they need to do their specific job, and none of them are permitted to use your data for their own purposes.

How long I keep it

I keep personal data only for as long as it's actually needed for the reason it was collected — typically for the duration of a client relationship plus whatever period is needed for tax and accounting records, or until you unsubscribe or ask me to delete it, whichever applies.

Your rights

Under UK GDPR, you have the right to:
See what data I hold about youCorrect anything that's wrong or out of dateDelete your data, where I'm not required to keep it for another reasonRestrict how I use it, in certain circumstancesReceive a copy of it in a portable formatObject to how it's used, including for marketingWithdraw consent at any time, where consent is the basis for processing
To use any of these, just email ku.oc.setisbewevolew%40troppus. I'll respond as quickly as I reasonably can, and may need to verify who you are first, to keep your data secure.
You can also complain to the Information Commissioner's Office (ico.org.uk) if you're unhappy with how I've handled your data — though I'd always rather you spoke to me first so I can put it right.

Cookies

This site uses cookies and similar technologies. What's used, why, and how to change your preferences is covered in full in my Cookie Declaration — that page is kept up to date independently of this one, so it's the accurate source, not this policy.

Server logs

Like most websites, our server automatically logs technical information about each request, including your IP address, for security and operational purposes. This is standard server behaviour, not something we actively collect or analyse, and is retained only briefly.

Marketing emails

I'll only send you marketing emails if you've actively opted in. Every email includes a one-click unsubscribe, and you can opt out at any time — no need to explain why.

International data transfers

Most of the services I rely on are based in, or otherwise protected by, recognised UK/EU safeguards. FreeAgent's data is held in Ireland. GoCardless processes European payments on servers within the EEA. PayPal's European operations are run by its Luxembourg entity, under EU-approved Binding Corporate Rules. The platform provider’s hosting for this site runs on a major cloud provider’s infrastructure in Belgium. The document signing tool is hosted on servers in the EU.
A small number of transfers do take place outside the UK or EU, and each is covered by a recognised legal safeguard rather than happening unprotected. Google (Gmail and Google Analytics) is certified under the UK Extension to the EU-U.S. Data Privacy Framework. Tawk.to, which stores chat data in the United States, states that it also follows the UK Extension to the EU-U.S. Data Privacy Framework. Stripe’s European processing, run through its Irish entity, is backed by Standard Contractual Clauses for anything that reaches its US parent company.

Changes to this policy

If I make any significant changes to how I handle your data, I'll update this page and, where appropriate, let you know directly.

Questions?

Email me (ku.oc.setisbewevolew%40troppus) — I'm happy to talk through any of this.