1. Who we are
Beacon Web Studio is a small web studio based in Fife, Scotland. We're the data controller for the information you share with us through this site.
You can reach us at hello@beaconwebstudio.uk.
2. What we collect
From the contact form. When you fill in the form on our contact page, you give us:
- Your name
- Your business name
- The kind of business you run
- Your email address
- Any message you choose to add (optional)
When you submit the form, we also automatically record your IP address and your browser's user-agent string. These help us spot spam and abuse; they sit in the same database row as the rest of your submission.
Server logs. Our network provider (Cloudflare) logs every request to the site at the edge — the URL you requested, your IP address, your browser's user-agent, and the time. Cloudflare uses these for security and bot filtering; we see an aggregated view to spot operational issues. We don't join them to anything else we hold about you. Cloudflare's own privacy policy covers these logs (cloudflare.com/privacypolicy).
If you email us. When you contact us directly at hello@beaconwebstudio.uk, that conversation lives in our mailbox on ProtonMail. We keep email threads as long as needed to handle them, then archive or delete.
When you browse the site. We run our own first-party analytics to understand how the site is used and improve it. For every page you view we record: the page address you visited (including any non-sensitive query parameters — we automatically redact values that look like tokens, codes, passwords or email addresses before storing), the address of the page you arrived from (without its query string), your approximate location (country, region and city, derived from your IP), your language, and your device, browser and operating system. We also store your IP address and your browser's user-agent string, and derive a pseudonymous identifier from them so we can recognise repeat visits and see the journeys people take through the site. This is cookieless — we set no cookies and read nothing else off your device — but it does let us recognise a returning visitor.
We don't set cookies for tracking, analytics, or marketing (see section 10), we don't build advertising profiles, and we don't sell your data or share it with ad networks. Our analytics is first-party — it stays with us and is used only to run and improve this site. If you'd rather we didn't record your visits this way, you can object — see section 7.
When you subscribe to our newsletter. If you sign up through our newsletter pop-up or the link in the footer, you give us your email address and (optionally) your name. We use double opt-in: we email you a confirmation link and don't add you to the list until you click it. As our record of your consent, we store the exact wording you agreed to, the date, and the IP address and browser the sign-up came from. When we send a newsletter, our email provider records whether the message was opened (via a small invisible image) and whether it bounced or was reported as spam — we use this only to keep the list clean and judge whether the newsletter is worth sending. We do not track which links you click.
3. What we do with it
We use what you send us to:
- Reply to your enquiry — lawful basis: steps prior to entering into a contract at your request, with a fallback of legitimate interest in keeping a conversation going if you don't end up becoming a client.
- Filter spam and abuse — lawful basis: legitimate interest in keeping our inbox usable.
- Measure and improve the site with our own first-party analytics — lawful basis: legitimate interest in understanding and improving our own website. You can object at any time (section 7) and we'll stop identifying you.
- Send you our newsletter, but only if you asked for it — lawful basis: your consent (UK GDPR Art. 6(1)(a)), as required for marketing email by the Privacy and Electronic Communications Regulations (PECR). You can withdraw it at any time (section 7).
Filling in the contact form does not subscribe you to anything — the newsletter is a separate, explicit opt-in. We don't sell or share your details with anyone for marketing or analytics, we don't show you ads, and we don't build advertising profiles.
4. Who else sees it
Your submission passes through a couple of processors before it gets to us:
- Cloudflare — provides our network, our serverless platform (Workers), and our database (D1) where your enquiry and our analytics records are stored. Cloudflare is acting as our processor.
- Resend — our email provider (US-based). It does two jobs. (1) When a new contact-form lead arrives it sends us a deliberately minimal alert — only your name and business name, not your message, email, or IP. (2) If you subscribe to the newsletter, it sends you the confirmation email and the newsletter itself, so for that it processes your email address, your name, and the content of those emails. Resend is acting as our processor.
No-one else sees your data — we don't share it with marketing tools, advertising networks, or third-party CRMs.
5. International transfers
The Resend email alert crosses into the United States. For that step we rely on the transfer mechanism in Resend's own Data Processing Agreement — in practice the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) as incorporated by Resend, together with the UK ICO's International Data Transfer Addendum (Version B1.0, in force from 21 March 2022) for the UK leg. The alert contains only your name and business, so very little of your submission leaves the UK. If you subscribe to the newsletter, your email address and our newsletter content also pass through Resend in the United States under the same safeguards. If you'd rather your enquiry didn't flow through Resend, email us directly at hello@beaconwebstudio.uk instead of using the form.
6. How long we keep it
- Form submissions — up to 2 years from your last contact with us, unless you become a client (in which case it lives under our client contract instead). After 2 years we delete it.
- Analytics records — kept for up to 14 months, then deleted automatically. We strip the raw IP address and user-agent from older records after 6 months, keeping only the coarse derived fields (such as country and device type) and a pseudonymous identifier. Ask us and we'll delete records linked to you sooner.
- Resend email alerts — Resend's own short transactional-email retention applies; we don't keep separate copies of the alert.
- Newsletter subscribers — we keep your details for as long as you're subscribed. If you never confirm a sign-up, we delete the unconfirmed record after 14 days. We strip the sign-up IP address and browser string after 6 months (your confirmation record stays as proof of consent). If you unsubscribe, we keep only a minimal note of your email on a suppression list so we don't accidentally email you again — ask us and we'll remove that too.
- Backups — Cloudflare keeps its own operational backups of D1; we don't control retention there.
If you'd like your data deleted sooner, just ask.
7. Your rights
Under UK GDPR you have the right to:
- See what we have about you (access)
- Get it corrected if it's wrong (rectification)
- Have it deleted (erasure)
- Have its use restricted
- Have it sent to you in a portable format (portability)
- Object to us using it under legitimate interests
- Not be subject to decisions made purely by automated processing (we don't do that)
- Withdraw consent you've given — for the newsletter, use the one-click unsubscribe link in any email we send, or ask us. Withdrawing doesn't affect anything we did lawfully before you withdrew.
To exercise any of these, email hello@beaconwebstudio.uk. We'll respond within one month.
8. Children's data
This site isn't aimed at children. We don't knowingly collect personal data from anyone under 18. If you're a parent or guardian and think we have data about a child, please email us and we'll delete it.
9. Complaints
If you think we've handled your data badly, please email us first — we'd like the chance to put it right. If you're still not happy, you can complain to the UK Information Commissioner's Office at ico.org.uk.
10. Cookies
This site sets no cookies for tracking, analytics, or marketing, so there's no cookie banner. Our analytics (section 2) is deliberately cookieless: it works from the request your browser already makes, not from anything stored on your device.
Our network provider (Cloudflare) may set short-lived strictly-necessary cookies for traffic filtering and bot detection (e.g. __cf_bm). These are used to keep the site up and don't identify or track you across other sites. Under UK PECR they don't require consent.
Our newsletter pop-up remembers in your browser's local storage that you've already seen or dismissed it, so it doesn't keep reappearing. That's a single on/off marker kept on your own device — no identifier, never sent to us — so under UK PECR it doesn't require consent.
11. Updates
If we change this notice in a way that affects you, we'll update the “Last updated” date at the top. Older versions are in our public git history.
12. Contact
Beacon Web Studio
Based in Fife, Scotland
hello@beaconwebstudio.uk