Privacy Policy

Who looks after your information

I'm Alex Wigmore, trading as Guwii in South Wales. I'm responsible for the personal information used to run this website, answer enquiries and manage my client relationships. You can contact me with a question about this notice or your information.

When I work within a client's systems on their behalf, the client may be responsible for that data. The agreed project terms and the client's privacy information apply to that work.

Enquiries and client work

The contact form asks for your name, email address, subject and message. Company and budget are optional. I use these details to understand what you need and reply. Without the required details, I cannot handle your enquiry through the form.

If we work together, I also use the correspondence, project information, billing details and materials needed to quote, deliver and support the agreed work. Please don't put passwords, access keys, bank details or sensitive personal information in the general contact form.

The website temporarily keeps entered details so you can correct a form error, and records accepted submissions and their delivery status privately. Security checks use a coded form of the connecting IP address to limit abuse; hosting and security services can separately receive IP addresses, request details and security logs. A coded identifier is still personal information, not anonymous data.

Sending an enquiry does not subscribe you to marketing. The form does not automatically send your message to an AI service, and I do not make decisions about prospective clients based solely on automated processing.

Published work

Case studies can include a client's business name, approved work and attributed feedback. I use these to explain the work I do, with confidentiality and permission considered before publication.

If a case study or attributed feedback concerns your personal information, you can ask me to review it.

Why I use personal information

I use information only where there is an appropriate lawful basis:

• Responding to a request or delivering work for you: taking steps you ask for before a contract, or fulfilling our contract.
• Working with a contact at a business: my legitimate interest in answering relevant enquiries and managing the business relationship.
• Protecting the website and resolving problems: my legitimate interests in preventing abuse, keeping services reliable and handling queries or disputes.
• Showing relevant work: my legitimate interest in explaining my services, taking account of the people involved and any agreed restrictions.
• Invoices and business records: meeting legal obligations, including applicable tax and accounting requirements.

Where a separate activity depends on your consent, I will explain it when asking. You can withdraw that consent without affecting what was lawfully done before withdrawal.

Payments

GoCardless handles Direct Debit authorisation and Stripe handles one-off card payments. You provide sensitive payment details to the payment provider, not through Guwii's contact form. This website does not store full card or bank account details.

I keep the information needed to administer an agreed payment: the selected hours and amount, payment or subscription references, status, dates, provider notifications and related correspondence. Provider notifications may include customer or mandate references and failure information. The providers also process payment and technical information for their own services, security and legal obligations. See the GoCardless privacy information and Stripe privacy policy.

Services that help me run Guwii

The main services used for this website and correspondence are:

• Cloudflare: website hosting, content delivery and security, including the private database used for form sessions and payment setup records. Cloudflare Email Sending delivers contact-form enquiries to my mailbox.
• Rackspace Email, managed through Cloudways: the mailbox used to receive enquiries and correspond with clients.
• GoCardless and Stripe: the payment services described above.

Relevant information may also be handled by the project or accounting services used for our work. Professional advisers or public authorities may receive it where needed for advice, legal obligations or protecting legal rights.

For client work, the tools and access arrangements depend on the project. Confidentiality and any processing of client-held personal data should be agreed before access is provided. Using AI-assisted development tools does not give permission to share a client's confidential or personal information indiscriminately.

These providers operate internationally, so information may be processed outside the UK, including through Cloudflare's global network and the email and payment services. Transfers need appropriate protection, such as UK adequacy regulations or applicable contractual safeguards. You can ask me about the services handling your information and request details or a copy of the relevant safeguards.

Cookies

Guwii does not add analytics or advertising tracking to ordinary website visits. Fonts and illustrations are served as part of the site, and videos and social profiles are links rather than automatically loaded external players or widgets.

Two necessary session cookies support the forms:

• guwii_cf_contact is set when you use the contact page. It supports the form's security checks, correction of errors and submission acknowledgement. It applies only to /contact/ on this website.
• guwii_cf_payment is set when you use the payment page. It protects payment setup and keeps track of the setup in your browser. It applies only to /pay/ on this website.

These are browser-session cookies with no fixed expiry date. Your browser's session-restore feature may keep them after a window closes. They are not used for advertising or to follow you across websites. You can remove or block them in your browser; ordinary reading will still work, but the forms need them to function.

These form cookies are restricted to this website, sent over HTTPS and unavailable to page scripts. The browser's cookie lifetime is separate from the server's form-session expiry.

Card payment options are not loaded on ordinary reading pages. When you choose a GBP or USD card option on the payment page, Stripe loads its payment interface and receives technical information such as your IP address and browser details. Its payment and fraud-prevention services may use their own cookies. GoCardless also processes information when you continue to its Direct Debit authorisation page. Check each provider's privacy and cookie information when using these services.

There is no site-wide tracking choice or cookie-preferences banner. Choosing a payment service is not permission for Guwii to use your information for marketing.

How long information is kept

I keep enquiry correspondence while dealing with the enquiry and any resulting work. Records may need to remain afterwards to provide agreed support, retain evidence of decisions or agreements, resolve a dispute or meet a legal obligation. Information that is no longer needed for those purposes should be deleted.

Billing and payment records are kept for applicable tax, accounting and payment-dispute requirements. Technical form and security records serve a shorter operational purpose, unless needed to investigate an incident. Backups, mailboxes and payment providers have their own retention arrangements; removing a website record does not remove those other copies immediately.

You can ask about the retention of a particular record using the contact form.

Keeping information safe

I use access controls and private storage for form and payment records, and limit access to what is needed for the work. No website, email service or storage system can be guaranteed completely secure. Please use an agreed secure method for sharing confidential files or account access.

Your rights

Depending on the circumstances, you can ask to access or correct your personal information, have it deleted, restrict its use or receive a portable copy. These rights have conditions and are not absolute; for example, some records may need to be retained to meet a legal obligation.

You have the right to object to processing based on legitimate interests because of your particular circumstances. You can raise an objection or another privacy request through the contact form. I may need enough information to verify your identity before disclosing or changing a record.

You can also make a complaint to the Information Commissioner's Office, the UK's data-protection regulator. You do not have to contact me first.

Changes to this notice

This page is updated when the website or the way I handle information changes. The version date appears at the top of the page.