Privacy policy
Last updated 29 August 2026
Privacy Policy: Pink Cowz
Template drafted with AI assistance. Have a solicitor review before relying on it.
Last updated: 29 August 2026
The short version
We are a small web design studio. This site has no cookie banner because it sets no tracking cookies. We do not use Google Analytics, advertising pixels, or any third-party tracker. The only personal information we collect is what you type into our contact form or send us by email, and we use it only to reply to you and to run a project if you become a client. We never sell it.
If you want it deleted, email joseph@pinkcowz.com and we will delete it.
1. Who we are
Pink Cowz is the trading name of Pink Cowz Ltd, a company registered in England and Wales, company number 17421159, with its registered office at 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom.
We are the data controller for the personal information described in this policy.
- Registered office: 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom
- Email: joseph@pinkcowz.com
If you have any question about privacy or your data, email us at joseph@pinkcowz.com. It comes straight to a person, not a ticket queue.
We are not required to register with the Information Commissioner's Office for the limited processing described here, but we comply with the UK GDPR and the Data Protection Act 2018 regardless.
2. What we collect
2.1 When you use our contact form or email us
- Your name
- Your email address
- Your phone number (only if you choose to give it)
- Your business name and website (only if you choose to give them)
- The message you write, and anything you attach or link to
That is the entire list. We do not ask for, and you should not send us, payment card details, health information, or any other sensitive personal data through the form.
2.2 When you become a client
If we work together, we will also hold:
- Billing details: invoicing address, company or trading name, VAT number where relevant, and a record of payments made. Card payments are handled by our payment provider; we never see or store your full card number.
- Project correspondence: emails, WhatsApp messages and notes about your project.
- Access credentials you choose to share: for example domain or hosting logins. We store these securely and delete them when they are no longer needed.
- Content you send us for the website: text, images, and any personal data inside them.
2.3 Automatically, when you visit this site
Our hosting provider keeps standard server logs for security and reliability. These may include your IP address, browser type, the pages requested and the time of the request. They are generated by the hosting infrastructure, not by us, and we do not use them to build a profile of you or to identify you.
We do not run analytics software, advertising pixels, session recording, heatmaps, fingerprinting, or any social media tracking on this site.
3. Cookies and similar technologies
This website sets no analytics cookies, no advertising cookies and no third-party tracking cookies. That is why you are not being nagged by a consent banner.
We may use strictly necessary browser storage, for example remembering a light or dark theme preference, or a language choice, using localStorage on your own device. This is not shared with anyone, is not used to track you across sites, and can be cleared at any time in your browser settings. Under the Privacy and Electronic Communications Regulations, storage of this kind does not require consent.
If we ever embed something from another company (a map or a video, for example), we will load it only after you click to accept it, so nothing is sent to that company until you choose it.
4. Why we use your information, and our lawful basis
| What we do | Why | Lawful basis (UK GDPR) |
|---|---|---|
| Reply to your enquiry, send a quote or proposal | You asked us to | Legitimate interests: responding to someone who contacted us; or steps prior to entering a contract at your request |
| Run a project we have agreed | To deliver what you are paying for | Performance of a contract |
| Send invoices and take payment | To get paid | Performance of a contract |
| Keep accounting and tax records | HMRC requires it | Legal obligation |
| Keep our site and systems secure (server logs) | To prevent abuse and fix faults | Legitimate interests: security and reliability |
| Send you occasional updates about our services, if you are already a client or asked to hear from us | To stay in touch | Legitimate interests, or consent where required. Every message has an unsubscribe option. |
We do not use your data for automated decision-making or profiling. We do not sell, rent or trade your personal data to anyone, for any purpose, ever.
Marketing. We will not add you to a mailing list just because you filled in the contact form. If we ever start a newsletter it will be opt-in only.
5. Who we share it with
We share personal data only with the small number of service providers we need to run the studio, and only as far as necessary:
| Type of provider | What they see |
|---|---|
| Website hosting | Server logs, and form submissions in transit |
| Email provider | Anything you email us |
| Form or database provider | Contact form submissions, stored securely |
| Accounting software and payment processor | Billing and payment details |
| Occasional subcontractors (for example a translator or photographer) | Only what is needed for their part of your project, under a duty of confidentiality |
Each of these acts as our processor: they may only use the data to provide their service to us, under a written contract.
We will also disclose information where we are legally required to, for example to HMRC, a court, or a regulator, or where it is necessary to establish or defend a legal claim.
We never sell your data, and we never share it for anyone else's marketing.
International transfers
Some of our providers operate outside the UK, including in the EEA and the United States. Where data leaves the UK we rely on UK adequacy regulations or the International Data Transfer Agreement / UK Addendum to the EU Standard Contractual Clauses, so your data keeps an equivalent level of protection. You can ask us for details of the safeguards in place.
6. How long we keep it
| Data | Retention |
|---|---|
| Enquiries that do not become projects | 24 months from your last contact, then deleted |
| Client project files and correspondence | 6 years after the project ends, so we can support the site and defend any claim |
| Invoices and accounting records | 6 years after the end of the relevant tax year (HMRC requirement) |
| Credentials you shared with us | Deleted as soon as the project or plan ends |
| Server logs | Kept for a short period by our host, typically under 90 days |
When a retention period ends we delete the data or anonymise it so it can no longer identify you.
You can ask us to delete your enquiry sooner. Just email us.
7. Your rights
Under the UK GDPR you have the right to:
- Be informed: which is what this policy is for.
- Access a copy of the personal data we hold about you.
- Rectification: have inaccurate data corrected.
- Erasure: have your data deleted ("the right to be forgotten"), where we have no overriding reason to keep it (tax records, for example, we must keep).
- Restrict processing: ask us to pause using your data while a dispute is sorted out.
- Data portability: receive data you gave us in a common machine-readable format.
- Object to processing based on our legitimate interests, including any direct marketing. If you object to marketing, we will stop, no questions asked.
- Withdraw consent at any time, where we relied on consent.
How to exercise them: email joseph@pinkcowz.com. We will respond within one month. It is free. We may ask you to confirm your identity so we do not hand your data to the wrong person.
8. Keeping it secure
We take sensible precautions: encrypted connections (HTTPS) across the site, access limited to those who need it, strong unique passwords with two-factor authentication on our accounts, encrypted devices, and secure storage for any credentials clients share with us.
No system is perfectly secure, and we cannot guarantee the security of information sent to us over the internet. If a breach occurs that is likely to risk your rights and freedoms, we will report it to the ICO within 72 hours and tell you without undue delay.
9. Children
This site is aimed at business owners. We do not knowingly collect personal data from anyone under 18. If you believe a child has sent us personal data, email us and we will delete it.
10. Other websites
Our site and our portfolio link to other websites, including sites we have built for clients. This policy does not cover them. When you follow a link, read that site's own privacy policy.
11. Complaints
If you are unhappy with how we have handled your data, please tell us first at joseph@pinkcowz.com. We would like the chance to fix it.
You also have the right to complain to the UK supervisory authority:
Information Commissioner's Office (ICO) Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF Helpline: 0303 123 1113 Website: https://ico.org.uk/make-a-complaint/
If you are based in the EU, you may also complain to your local data protection authority.
12. Changes to this policy
If we change this policy we will update the date at the top and publish the new version here. If the change is significant and affects clients, we will email you about it.
Questions? Email joseph@pinkcowz.com. A real person will reply.