Privacy policy
Last updated 14 October 2026
Who we are
Cherry Digital, a web studio in the United Kingdom. We decide how the personal data described here is used, which makes us its “controller” under UK data protection law. For anything about your data, email hello@cherrydigital.co.uk.
This policy covers people who visit our website, people who get in touch, and our clients. It does not cover visitors to the websites we build and host for clients: for those, the client is in charge of the data and we handle it on their behalf, under the data processing terms in our terms of service. Their own privacy policy applies.
What we collect, why, and on what basis
The law requires a reason, called a lawful basis, for each use of personal data. Here is ours for each.
If you get in touch
Your name, email address and whatever you write, plus your phone number, what your business does and its website if you give them. We use it to reply, or to ring you if you gave a number, and, if you want a website, to work out what you need. Basis: taking steps at your request before entering a contract, and our legitimate interest in answering people who contact us. Nothing is added to a mailing list.
If you become a client
Business contact details, billing information, domain and hosting configuration, the content you supply for your website, and our correspondence with you. Basis: performing our contract with you. We keep billing and accounting records because the law requires it. Basis: legal obligation.
When you visit this site
Like every website, ours receives technical information with each request: your IP address, browser type and the pages you ask for. It is recorded briefly in server and security logs so we can keep the site running and block attacks. Basis: our legitimate interest in keeping the site secure.
If you accept analytics cookies, we also collect aggregated information about which pages are visited. If you decline, no analytics runs at all. Basis: your consent, which you can withdraw at any time using Cookie settings at the foot of every page. See our cookie policy.
We self-host our fonts, so loading this site does not send your IP address to Google.
Where it lives
Your website, its content and its backups are hosted on servers inside the European Union. We do not host anything in the United States.
Some services we use are run by American companies, and we tell you so rather than let you find out afterwards:
- Cloudflare sits in front of every site we host, for speed and protection against attacks. It necessarily sees visitors’ IP addresses. Traffic is served from Cloudflare’s UK and European data centres, and we do not store client data with them.
- Microsoft runs our own business email, so messages you email us are held in Microsoft 365. It also runs your email as a client, unless you ask us to forward it to an inbox you already have instead.
- Discord is where messages sent through our contact form reach us, so your name, email address, message and anything else you put in the form are held there as well as on our own server.
- Google holds your Google Business Profile, in your own Google account, if you have one.
- Our payment processor handles card and bank payments and may process data outside the UK and EU.
Where personal data is transferred to, or can be accessed from, a country outside the UK, it is protected by the UK Extension to the EU–US Data Privacy Framework or by standard contractual safeguards approved for use under UK GDPR.
Who we share it with
Only the processors needed to run the service: our EU hosting provider, Cloudflare, Microsoft, Discord, our payment processor and our domain registrar. Each handles data only on our instructions and under a contract. We may also disclose data where the law requires it. We do not sell data, and we do not share it for advertising.
How long we keep it
- Enquiries that do not become clients: deleted after twelve months.
- Client records: for the length of the engagement, then billing and accounting records for six years, as HMRC requires. Everything else is deleted when the engagement ends, subject to the thirty-day grace period in our terms.
- Server and security logs: no more than thirty days.
- Backups: kept on a rolling basis and overwritten within thirty days.
Your rights
Under UK GDPR you have the right to:
- ask for a copy of the personal data we hold about you
- have it corrected if it is wrong
- have it deleted
- restrict how we use it
- object to our using it where we rely on legitimate interests
- receive data you gave us in a portable format
- withdraw consent at any time, where we rely on consent. This does not affect anything done before you withdrew it.
Email us to use any of these and we will respond within one month. We will not charge you. If you are unhappy with how we have handled your data, you can complain to the Information Commissioner’s Office at ico.org.uk, though we would appreciate the chance to put it right first.
We do not make decisions about you by automated means alone, and we do not profile you.
Changes to this policy
If we change how we use personal data, we will update this page and the date at the top. Clients will be told by email of any change that affects them.