Privacy notice

Converant is a web design studio. Our legal form and registered identity are not yet confirmed, so this notice does not describe Converant as a company, sole trader or partnership. For data-protection purposes, the controller of the information described in this notice is [TO CONFIRM — registered legal business name and legal form], trading as Converant.

• Registered/legal entity: [TO CONFIRM — registered legal business name and legal form]
• Company number: [TO CONFIRM — company registration number, if incorporated]
• VAT number: [TO CONFIRM — VAT registration number, if VAT registered]
• Registered address: [TO CONFIRM — registered postal address]
• ICO data-protection fee: [TO CONFIRM — ICO data-protection fee self-assessment outcome — not yet completed, so no registration is claimed]

Where we handle information on behalf of a client — for example content held in a website we build and maintain — that client is normally the controller and we act as a processor under our contract with them.

Privacy queries and data-protection requests: hello@converant.co.uk, or use the privacy request form.

Postal address: [TO CONFIRM — registered postal address]. We have not appointed a statutory Data Protection Officer unless stated here: [TO CONFIRM — DPO appointed? name and contact if so].

Information you provide directly, for example when you:

• send an enquiry through the contact form (name, email, business name, message);
• complete the project configurator (contact details, phone number if provided, business details, project requirements, budget range, uploaded briefs, images and documents, and anything else you choose to write);
• email, call or message us;
• submit a privacy request or complaint.

Please only include personal information about other people where you have a proper basis to share it with us.

When you visit this website, our hosting and application infrastructure processes technical information such as IP address, request time, requested URL, referrer, user-agent and error diagnostics. This is used to serve pages, keep the service available, and detect abuse.

Storage placed on your device is described in the cookie policy. You can change non-essential choices at any time via cookie preferences.

We may see business information from public or third-party sources — for example a company website, a public business listing, a search engine result, a public map listing, or a referral from an existing client. Where we use such sources, we record where the information came from.

Specific named sources in routine use: [TO CONFIRM — list the actual sources used, if any].

If we contact a business about our services, we typically process a business name, a publicly listed business contact address, a role, and notes about why the business may be relevant.

Where this applies, we rely on our legitimate interest in promoting our services to businesses, and we comply with the direct-marketing rules that apply to the channel used. Every outreach message includes a way to opt out, and we keep a suppression record so we do not contact you again.

Outreach channels actually in use: [TO CONFIRM — email / LinkedIn / phone / post].

Enquiries submitted through the contact form or the project configurator are stored in our systems and sent to our studio inbox so we can respond, prepare an estimate and, if you go ahead, deliver the work. Answering your enquiry does not require your consent — it is the step you have asked us to take. If you book a call through the website, the booking is made with Calendly (see “Processors and subprocessors”), and we receive your name, email address, chosen time and any answers you give so we can hold the call and follow up on it.

For client projects we hold contact details, project requirements, files you upload, feedback, approvals, status history, pricing and internal delivery notes. Internal notes are visible to our team only.

The client portal uses an account created with your email address. We store your account identifier, email address, display name where provided, authentication timestamps and the projects linked to your account. Authentication is provided by our backend platform; session information is stored in your browser and is strictly necessary for the portal to work.

If you sign in with a third-party identity provider, that provider tells us the account email and basic profile details you approve.

Payments are processed by Stripe. Card details are entered directly into Stripe's payment interface — we never receive or store full card numbers. We receive and keep transaction records such as amount, currency, status, payment or subscription identifiers, and dates, so we can confirm what has been paid and meet record-keeping obligations.

Depending on the activity, Stripe may act as our processor and/or as an independent controller for its own compliance and anti-fraud purposes, under its own privacy policy.

We keep correspondence with you — emails, form submissions, project messages and the delivery status of transactional emails we send (for example whether a quote or payment confirmation was sent, skipped or failed) — so there is an accurate record of what was agreed and communicated.

We record business-relationship activity: enquiry history, quotes and estimates, project status, follow-ups and outcome. This is used to manage the relationship and run the studio, not to profile individuals for advertising.

We use HubSpot as our CRM for contacts, companies, deals and sales activity, and n8n for internal workflow automation. The personal-data flows through our n8n workflows are still being documented, so this notice does not yet describe them in detail: [TO CONFIRM — documented n8n workflow data flows].

No third-party advertising or cross-site tracking technology is embedded in this website. Any analytics we use is listed on the cookie page, together with whether it is treated as requiring consent. Where consent is required, the technology is not loaded until the analytics category is allowed.

We count visits to this website with a small visitor counter that runs on our own server. It uses no cookies and stores nothing on your device. It does not store your IP address or browser details: each visit is turned into a one-way code that changes every day and is used only to count each visitor once per day. It respects the Do Not Track and Global Privacy Control settings in your browser, and it ignores automated bots. We use the totals to see how many people find the site.

No other analytics or product-monitoring tool is running on this website today. If we adopt others later, we will list them here and on the cookie page before they run.

We process technical and account information to protect the site and our clients: authentication events, access control, error and abuse diagnostics, and payment verification signals received from Stripe. We rely on our legitimate interest in keeping the service secure.

We may use AI-assisted tools in our own production workflow — for example drafting copy, generating imagery or summarising a brief. Where a tool is given project information, we choose tooling appropriate to the sensitivity of that information.

We do not make decisions producing legal or similarly significant effects about you by automated means alone. Quotes and project decisions involve a human.

AI tools used in delivery: [TO CONFIRM — named AI tools and whether client data is entered].

• Responding to enquiries and preparing quotes — steps taken at your request before entering a contract, and our legitimate interest in running the studio.
• Delivering projects and support — performance of our contract with you.
• Taking payment and keeping financial records — performance of a contract and our legal obligations.
• Account and portal access — performance of a contract.
• Security, abuse prevention and service reliability — legitimate interests.
• Business-to-business outreach — legitimate interests, subject to marketing rules and your right to object.
• Optional cookies and marketing emails to individuals — consent, which you can withdraw at any time.
• Handling rights requests and complaints — legal obligation.

Information may be shared with:

• service providers who operate parts of our platform on our instructions;
• our payment provider, for taking and reconciling payments;
• professional advisers (for example accountants or lawyers) where needed and proportionate;
• authorities or other parties where we are legally required to do so.

We do not sell personal information.

Controller. For our own business information — enquiries, prospects, client contacts, project administration, payments and our website — we decide why and how information is used, and this notice applies.

Processor. When we build, host, maintain or automate systems for a client, any personal information belonging to that client's own customers or contacts is handled on the client's instructions. The client is the controller and their own privacy notice applies. Those arrangements — processing instructions, confidentiality, security, subprocessors, assistance with rights requests, breach support, deletion or return at the end of the service, international transfers and accountability — are covered by our client contract and data-processing agreement rather than by this public notice: [TO CONFIRM — final client DPA terms].

The website and its client portal rely on the following categories of provider: application hosting, database and authentication, transactional email delivery, call scheduling, and payment processing.

Supabase — Processor

Application database, authentication, file storage and operational application data.

Our primary project is hosted in Ireland (AWS eu-west-1). We do not claim every Supabase backup, log, edge function or integration is limited to Ireland.

Stripe — Processor and/or independent controller, depending on the activity

Payment processing, the hosted payment window, and transaction administration. Card details are entered into Stripe and are not stored by us.

[TO CONFIRM — Stripe data-storage locations for our account]

HubSpot — Processor

CRM: qualified prospects, contacts, companies, deals and sales activity.

[TO CONFIRM — hosting region of our HubSpot account]

Resend — Processor

Transactional and production email delivery.

Resend states that customer data — including message content, delivery logs, webhook payloads and account records — is stored in the United States. A sending region may be selected for delivery, but that does not mean all Resend data is stored in that region.

Vercel — Processor

Application hosting and delivery of this website and the client portal, including the technical request logs a host needs to serve pages securely.

Calendly — Processor and/or independent controller, depending on the activity

Scheduling for the “Book a call” option. Nothing is requested from Calendly until you open the booking window. When you book, the name, email address and time you choose are provided to Calendly to make the booking, and Calendly sends you its own confirmation. We then receive the booking details from Calendly so we can prepare for the call. Calendly’s own privacy notice governs its use of your information.

Virtual private server hosting — Processor

Hosting for production services we operate ourselves. We do not publish infrastructure detail.

[TO CONFIRM — VPS provider and data location]

Providers we are only considering for future use are not listed and are not processing your information today. We will add a provider here before it goes into production.

Some providers may process information outside the UK. Where that happens, transfers must be covered by an approved safeguard, such as UK adequacy regulations or the International Data Transfer Agreement/Addendum.

Our primary application database project is hosted in Ireland. Our email provider, Resend, states that customer data including message content, delivery logs and webhook payloads is stored in the United States, so email-related information is transferred outside the UK. Other providers' data locations are still being verified and are shown as unconfirmed in the section above.

The specific safeguard relied on for each provider: [TO CONFIRM — transfer mechanism per provider].

We keep personal information only as long as it is needed for the purpose it was collected for, plus any period required by law. UK data-protection law does not set a single universal retention period, so we apply a purpose-based framework and review it as our structure is finalised.

Enquiries that do not become clients

Up to 12 months after the last meaningful interaction, unless a longer period is justified or you ask us to delete earlier where that applies.

Prospect and outreach information

Kept only while there is a genuine business outreach purpose. Records are reviewed periodically and deleted or anonymised when no longer needed.

Client and project operational records

Kept while the project or service is active and for an appropriate period afterwards where needed for support, contractual records, disputes, legal obligations or legitimate business records. [TO CONFIRM — final long-term period, pending our legal/accounting structure]

Financial and payment records

Kept for the period required by applicable tax, accounting and legal obligations. [TO CONFIRM — exact statutory period, pending our legal business structure]

Uploaded project files

Kept while needed to deliver your project and any contracted support or hosting service. After the service ends, files may be deleted in line with the project terms and this schedule. We do not offer permanent storage.

Account and client portal data

Kept while the account or service is active, then deleted or anonymised after an appropriate closure period, except where information must be kept for legal, security, payment or dispute reasons.

Security logs

Kept only for a reasonable period needed for security, abuse prevention, debugging and incident investigation.

Privacy requests and complaints

Kept in enough detail to show how the request or complaint was handled and to meet legal and accountability requirements.

Marketing suppression records

A minimal record is kept indefinitely so we do not contact you again by mistake. It is never used for marketing.

Cookie preference record

Kept for as long as needed to remember and evidence your current cookie choice. You can change it at any time.

We apply technical and organisational measures appropriate to the risk, including encryption in transit, access controls, least-privilege administration, server-side verification of payment amounts, and row-level database access rules. More detail is on the security page.

No online service can be guaranteed to be completely secure, and we do not claim any formal certification.

You can object to direct marketing at any time, with no reason needed, and we will stop. Use the unsubscribe control in any marketing message, email hello@converant.co.uk, or submit a marketing opt-out request.

Service messages about a project you have with us — quotes, payment confirmations, status updates — are not marketing and continue while the project is live.

When you opt out of, or object to, direct marketing, we remove you from active marketing and keep a minimal suppression record — normally just the contact detail you asked us not to use. This means we may not delete every trace of you: the record exists so we do not contact you again by mistake.

Suppression records are never used to market to you.

Subject to the conditions in UK data-protection law, you may ask us to:

• give you access to the personal information we hold about you;
• correct inaccurate or incomplete information;
• delete information where there is no longer a valid reason to keep it;
• restrict how we use information while a concern is resolved;
• object to processing based on legitimate interests, including profiling;
• provide portable information you gave us, where processing is based on consent or contract and carried out by automated means;
• withdraw consent where consent is the basis we rely on.

Use the privacy request form. We will respond within the statutory period — normally one month — and will confirm if we need to verify your identity first.

If you are unhappy with how we have handled your information, tell us first and we will investigate. Submit a complaint through the privacy request form (choose "Data-protection complaint") or email hello@converant.co.uk.

You can also complain to the UK Information Commissioner's Office. You do not need to contact us first, though it usually helps.

• Website: ico.org.uk/make-a-complaint
• Helpline: 0303 123 1113

Our services are provided to businesses and are not directed at children. We do not knowingly collect information from children. If you believe a child has given us personal information, contact us and we will delete it.

We update this notice when our practices or providers change. The date at the top shows the current version. Material changes will be highlighted on this page.

Questions: hello@converant.co.uk.