Privacy Policy

Who we are

Coreframe Digital is a web design and automation business based in Cardiff, Wales, UK. We operate as a sole trader. You can contact us at enquiries@coreframedigital.co.uk.

What data we collect

We collect information you provide and limited technical information needed to operate the website. This includes:

• Your name, email address, and phone number when you submit an enquiry or project-details form
• Your business name and project details (for example what you need, budget range, timeline, and any domain or hosting details you share)
• Technical data via analytics, and where your visit came from, only if you accept analytics cookies (see below)
• Your name, contact details and answers if you fill in a lead form on one of Coreframe Digital's own Facebook or Instagram adverts (see below)
• If we contact your business about our services: the business name, the contact email and any name published alongside it, the company's public record on Companies House, and notes on what we noticed about its public website or Google listing

We do not collect sensitive personal data, payment card details, or run any user accounts on this website.

How we use your data

Information submitted via our forms is used solely to:

• Respond to your enquiry
• Provide you with a quote or project information
• Follow up on your project if you become a client
• See which adverts and pages bring in enquiries, if you accepted analytics cookies

We do not sell your data to any third party. If you send us an enquiry, we won't add you to a mailing list unless you ask us to.

Businesses we contact about our services

Now and then we email a limited company or similar organisation to point out something specific we've noticed on its website or Google listing, and to offer to help. We only use contact details the business has published on its own website or listing, and we check Companies House first to confirm it's a limited company. We don't send these emails to sole traders, partnerships or private individuals, we don't buy contact lists, and we don't use tracking pixels.

Our lawful basis is legitimate interests: letting a local business know about a problem that's likely costing it customers, and offering to fix it. These emails are sent from our Google Workspace account and the records are kept in our own business files.

Every email tells you how to opt out. Reply "no thanks" or email enquiries@coreframedigital.co.ukand we won't contact you again. You have the right to object to direct marketing at any time, and we always honour it.

Enquiry processing and lawful bases

Our website processes enquiries through our own enquiry endpoint, stores them in our business administration system (hosted by Supabase in the EU) and uses Resend to send notification emails. Hosting and email providers process the information needed to provide these services.

When you send an enquiry with a message, we send the message and your answers about the service, budget, timing and business name to Anthropic, who provide the Claude API. It writes one short paragraph about which of our packages fits, for the automatic reply we email you. Your name, email address and phone number are not sent. Charlie still reads every enquiry and replies personally.

We process requested quotes and client work to take steps towards or perform a contract. We rely on legitimate interests to manage business correspondence, contact businesses about our services as described above, and protect the website from abuse, legal obligations for required financial records, and consent for optional analytics. Please do not include sensitive information or passwords in an enquiry.

Cookies and analytics

We use Google Analytics 4 to understand how visitors use this website, but only if you accept it. When you first visit, a banner asks whether you're happy for us to set optional analytics cookies. If you decline, or simply ignore the banner, no analytics cookie is set and Google Analytics does not run. Your choice is remembered in your browser and you can change it at any time by clearing this site's data in your browser settings.

When enabled, Google Analytics processes usage information such as pages visited, interactions and approximate location. Analytics identifiers can distinguish browser visits; this information should not be treated as completely anonymous.

Our booking picker uses Google Calendar availability and sends the details you submit to our server to arrange your call and confirmation. Where we offer an embedded Google Calendar instead, it loads only after you choose "Open the calendar". That embedded page may set Google cookies and processes booking details under Google's privacy policy.

Where your enquiry came from

If you accepted analytics cookies, your enquiry also records how your visit started: any campaign tags in the link you followed (such as which advert it was), any Google or Meta click ID, the first page you landed on, and the website that sent you. Your browser holds these only until you close the tab, and sends them with your enquiry. We keep them with the enquiry, for the same time, so we can see which adverts and pages bring in work. If you declined, none of this is recorded.

Facebook and Instagram lead forms

Some of Coreframe Digital's own adverts on Facebook and Instagram open a lead form, so you can enquire without leaving the app. Meta collects that form, and may fill in some details for you from your profile, under Meta's privacy policy. Make, an automation service, then passes your answers, such as your name, phone number and email address, from Meta to this website. From there your enquiry is handled in the same way as one sent through the website, as described above.

Once your enquiry arrives, Coreframe Digital is the controller for it. It is used to reply to you and arrange what you asked for, as steps you asked for before any contract. If the form asks whether you'd like the occasional tip or offer and you say yes, those messages rely on your consent, which you can withdraw at any time. Lead form details are never used to build Custom or Lookalike Audiences on Meta.

Meta and Make may process your details outside the UK, under their own transfer safeguards. Meta keeps its own copy of the form under its own policy. Coreframe Digital keeps your enquiry for the same time as any other enquiry (see Data retention below).

Your rights (UK GDPR)

Under UK data protection law, you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Object to or restrict processing of your data
• Object to direct marketing at any time, which we will always stop

To exercise any of these rights, email us at enquiries@coreframedigital.co.uk. We normally respond within one month. You can also complain to the Information Commissioner’s Office.

Data retention

Enquiry emails and project correspondence are retained for up to 3 years for business record-keeping purposes, then deleted. If you become a client, financial records are kept for the applicable statutory period. Other project records are retained only as long as needed to deliver the work, handle support or resolve disputes; tax rules do not require us to keep every project file.

If we contacted your business about our services and you didn't become a client, we keep that record for 12 months from our last contact and then delete it. If you ask us not to contact you again, we keep only your email address and business name on a do-not-contact list, so we can make sure we never email you again.

Changes to this policy

We may update this policy from time to time. The current version is always available at this URL. Material changes will be noted with an updated date at the top of this page.

Contact

Questions about this policy? enquiries@coreframedigital.co.uk