Privacy Policy

Who we are

Mortar & Pixel is the trading name of Jamie Walker, a sole trader based in Brighouse, West Yorkshire, England. We provide web design, website hosting, and related digital services.

For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, Jamie Walker is the data controller — the person responsible for deciding how and why your personal data is used.

Contact details:
Email: [email protected]
Phone: 07707 708422
Website: https://mortarandpixel.co.uk
ICO registration number: ZC171921

We do not have a Data Protection Officer. As a sole trader processing a limited volume of non-sensitive personal data, we are not required to appoint one under UK GDPR Article 37.

What personal data we collect and where it comes from

2.1 Data you give us directly

When you contact us, submit an enquiry, or engage our services, we may collect:

• Your name and business name
• Your email address
• Your phone number (if provided)
• Your location (town or city)
• Information about your project or business requirements
• Payment details for invoicing (we do not store bank card details; payments are made by bank transfer)
• Any other information you choose to share in correspondence

2.2 Data we collect automatically

When you visit our website, we may automatically collect certain technical data, including your IP address, browser type, pages visited, time on those pages, referring website, and device type. This data is collected via our website infrastructure (Netlify) and, where you have consented, via Google Analytics. It is used only in anonymised, aggregated form to understand how our website is used.

2.3 Data about third parties you provide

If you share information about other individuals during a project (for example, a team member's contact details or customer data for your own website), you confirm that you have the right to share that information and that those individuals are aware it may be shared with us for the purpose of the project.

2.4 Special category data

We do not knowingly collect or process any special category personal data (such as health information, racial or ethnic origin, political opinions, religious beliefs, or criminal records). We do not knowingly collect personal data from children under the age of 13.

Why we use your personal data

Our lawful basis for processing

Under UK GDPR, we must have a legal reason for processing your personal data. We rely on the following bases:

4.1 Contract (Article 6(1)(b))

Processing your data is necessary to perform the contract between us — communicating about your project, delivering the website, and managing payment. This is our primary lawful basis for processing client data.

4.2 Legal obligation (Article 6(1)(c))

We are required by law to retain certain records, including invoices and payment records, for a minimum of 6 years to comply with HMRC requirements.

4.3 Legitimate interests (Article 6(1)(f))

We rely on legitimate interests for responding to enquiries (it is in both parties' interests to communicate) and for general website improvement based on anonymised usage data. We have assessed that these interests are not outweighed by your rights, given the limited and expected nature of the processing.

4.4 Consent (Article 6(1)(a))

Where we use non-essential cookies (including Google Analytics), we rely on your consent via our cookie consent banner. You can withdraw consent at any time without it affecting the lawfulness of prior processing.

We do not use your data for automated decision-making or profiling.

Who we share your data with

We do not sell your personal data. We share it only in the following limited circumstances:

5.1 Netlify (hosting provider)

We use Netlify, Inc. to host websites we build and manage. Netlify processes visitor data (including IP addresses) as part of delivering the hosting service. Netlify is based in the United States — see Section 7. Netlify's privacy policy: netlify.com/privacy.

5.2 Google Analytics

With your consent, we use Google Analytics to collect anonymised data about how our website is used. Google processes this data on our behalf. Google LLC is based in the United States — see Section 7. Google's privacy policy: policies.google.com/privacy.

5.3 Professional advisors

We may share data with professional advisors (such as our accountant) where necessary for legal or financial purposes. These parties are bound by confidentiality obligations.

5.4 Legal requirements

We may disclose your data if required to do so by law, court order, or a regulatory authority such as HMRC or the ICO.

5.5 No other sharing

We do not share your data with any other third parties. We do not use your data to send unsolicited marketing communications, and we never sell, rent, or trade your personal data.

How long we keep your data

We keep your data only for as long as necessary for the purpose it was collected, or as required by law.

When data is no longer needed, we delete it securely. Digital data is permanently deleted; physical documents are cross-cut shredded.

International transfers of your data

Two of our service providers — Netlify and Google — are based in the United States. Some of your data may therefore be transferred to and processed in the US, which is outside the UK.

Both providers offer appropriate safeguards for UK GDPR-compliant international transfers:

• Netlify: Standard Contractual Clauses — see netlify.com/gdpr-ccpa
• Google: Standard Contractual Clauses and UK-US Data Bridge — see business.safety.google/gdpr

We do not transfer your data to any other countries outside the UK. If the legal basis for any international transfer changes materially, we will update this policy and notify affected clients.

Your rights

Under UK GDPR, you have the following rights. These apply in most circumstances but some have exceptions depending on the lawful basis we rely on.

8.1 Withdrawing consent

Where we rely on consent (for example, analytics cookies), you can withdraw it at any time via our cookie settings or by contacting us. Withdrawal does not affect the lawfulness of processing before withdrawal.

8.2 How to exercise your rights

Contact us at [email protected] or in writing to our business address (available on request). We will respond within one calendar month. We will not charge a fee unless a request is manifestly unfounded or excessive, in which case we may charge a reasonable fee or decline to respond, and will notify you of our decision.

8.3 Right to complain

If you are unhappy with how we have handled your data, you have the right to complain to the ICO:

Website: ico.org.uk/make-a-complaint
Phone: 0303 123 1113
Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

We would welcome the opportunity to resolve any concern directly before you contact the ICO.

Cookies

Our website uses cookies. Strictly necessary cookies are placed automatically; analytics cookies are only placed with your consent via our cookie banner. We do not use advertising, tracking, or social media cookies. You can change your preferences at any time using the Cookie settings link in our footer.

Full details are in our Cookie Policy.

Security and data breach notification

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, or damage, including secure encrypted connections (HTTPS/SSL), access controls, regular software updates, and daily backups.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will:

• notify the ICO within 72 hours of becoming aware of the breach, as required by UK GDPR Article 33;
• notify you directly without undue delay where the breach is likely to result in a high risk to your rights and freedoms, as required by UK GDPR Article 34;
• maintain a record of any breach and the steps taken in response.

While we take reasonable precautions, no system is entirely secure. You can reduce risk by using strong, unique passwords and informing us immediately at [email protected] if you suspect any unauthorised access to your account.

Changes to this policy and how to contact us

11.1 Changes

We may update this Privacy Policy to reflect changes in our practices, services, or legal requirements. The current version will always be at mortarandpixel.co.uk/privacy. We will notify active clients of material changes by email. The date at the top of this policy indicates when it was last updated.

11.2 Contact us

Email: [email protected]
Phone: 07707 708422
Trading name: Mortar & Pixel (Jamie Walker)
Location: Brighouse, West Yorkshire, England