Privacy policy, Devonic Web

1. Information we collect

We collect the personal data you provide directly when you contact us, request an audit, or subscribe to our newsletter, typically your name, email address, company name, and any project details you share. We also collect basic technical and usage data from your browser (IP address, user agent, referring URL, pages viewed) via cookieless analytics (Plausible), which needs no consent. With your consent, we additionally use Google Analytics, Microsoft Clarity, and Google Ads, which set cookies and collect usage data as described in the Cookies and tracking section below. If you do not consent, none of those load.

2. How we use your information

To respond to your enquiry, deliver any service you've requested, send you the content you've subscribed to, measure and improve our website, and, only with your consent, to measure the performance of our advertising and show you more relevant ads. We never sell your personal data, and we never share the details you submit in our forms with third parties for their own marketing.

3. Legal basis under UK GDPR

We rely on: (a) legitimate interest, when you contact us about a project and for essential, cookieless analytics; (b) consent, when you subscribe to our newsletter, request an audit, or allow analytics and advertising cookies; (c) contract, when you become a paying client. You can withdraw consent at any time, including through 'Cookie preferences' in the footer.

4. Sharing your information

We share data only with the third-party services needed to operate this site and, where you have consented, to measure it: our email provider (Google Workspace / Gmail), transactional email and newsletter service (Resend), hosting provider (Vercel), bot protection (Cloudflare Turnstile), cookieless analytics (Plausible), and, only with your consent, Google (Analytics and Ads) and Microsoft (Clarity). Some of these process data outside the UK and EU (for example in the USA) under appropriate safeguards such as Standard Contractual Clauses. All are listed in our data processing register on request.

5. Data retention

Project enquiries: 24 months from last contact. Audit requests: 12 months from delivery. Newsletter subscriptions: until you unsubscribe. Client records: 7 years (UK statutory minimum for company records). Analytics and advertising data is retained per the providers' own settings (typically 2 to 14 months for Google Analytics). We delete data sooner on request.

6. Cookies and tracking

We set strictly necessary cookies and equivalent local storage so the site works: your saved theme, your cookie choices, and form/security tokens. These need no consent. We only set analytics and advertising cookies if you opt in through our cookie banner; until then, and if you decline, none of them load and the site stays cookieless. Our day-to-day analytics (Plausible) is cookieless and used without consent. You can change or withdraw your choice any time through 'Cookie preferences' in the footer.

Cookie / storage	Provider	Purpose	Category	Stored
theme	Devonic Web	Remembers light or dark mode	Necessary	Local storage
consent record	Devonic Web	Stores your cookie choices	Necessary	Local storage
session / CSRF (admin only)	Devonic Web	Admin login and form security	Necessary	Session
_ga, _ga_*	Google Analytics	Tells visitors apart, measures usage	Analytics	Up to 2 years
_clck, _clsk	Microsoft Clarity	Session replay and heatmaps	Analytics	Up to 1 year
_gcl_au	Google Ads	Measures advert conversions	Advertising	90 days
(none)	Plausible	Aggregate traffic stats	Cookieless	No cookie

7. Your rights under UK GDPR

You have the right to: (a) request a copy of the personal data we hold about you; (b) ask us to correct inaccurate data; (c) ask us to delete your data; (d) restrict or object to our processing of your data; (e) data portability, receive your data in a structured, machine-readable format; (f) complain to the ICO. Email contact@devonicweb.co.uk to exercise any of these.

8. Security

All data is transmitted over TLS 1.3. Our hosting (Vercel) and email (Google Workspace) providers are ISO 27001 / SOC 2 certified. We review access regularly and limit it to the minimum people needed.

9. Third-party links

Our site may link to third-party websites, case studies, tool recommendations, source citations. We're not responsible for their privacy practices. Read their policies before sharing data with them.

10. Changes to this policy

We'll update this page when we change anything material, and update the 'Last updated' date above. Substantial changes will be flagged on the homepage for a fortnight before they take effect.

11. Contact us

Questions about this policy, or your data? Email contact@devonicweb.co.uk. We're the data controller. Our registered entities are Digital Fusion Hub Ltd (Companies House 15582985, England & Wales) and Devonic Web LLC (Wyoming, USA).