PrivacyPolicy

1. Who We Are

X3WEB provides website design, e-commerce, advertising management, hosting, and related digital services to businesses. We are a remote-first agency: our registered office and most of our team are in South Africa, with team members in Europe. We do not have an office in the United Kingdom.

For the personal data described in this policy, X3WEB is the controller: the organisation that decides how and why it is used.

Registered office: 4 Edmonton Alley, Northcliff, Johannesburg, South Africa

Email: info@x3webdesign.com

Phone: +27 68 906 3369

Our role when we work with client data

This policy describes the personal data X3WEB collects for its own business. We also host and support websites and email for our clients. When we do, any personal data held in those systems (for example, a client's website form submissions or mailboxes) is handled on the client's behalf and on the client's instructions. In that situation the client is the controller and X3WEB is its processor. The client decides what is collected and why, and is responsible for its own privacy notices. If your question is about data held by one of our clients, please contact that business directly.

Existing clients manage their services and log support requests in a separate client portal, which has its own sign-in.

2. The Personal Data We Collect

What we collect depends on how you use the Services.

A. Information you give us

• Enquiry forms: your full name, company name, phone number, email address, town or city, postcode (optional), the service you are interested in, and an optional message
• Communications: the content of emails, calls, messages, and meeting requests you send us, including attachments
• Client records: if you become a client, the contact, billing, and project details we need to deliver and invoice the work, along with any content or account access you give us for that purpose

Our enquiry forms do not ask for special category data (such as health information), bank or card details, or passwords. Please do not include them in your message.

B. Information collected automatically

• Campaign information: if the link you arrived through carried campaign parameters (utm_source, utm_medium, utm_campaign), they are saved with your enquiry so we can see which marketing brought you to us
• Spam-control data: a daily-rotating hash of your IP address is stored with each form submission and, when Google reCAPTCHA is enabled, so is the spam-risk score it returns
• Device and usage data: like most websites, our web server records technical details such as IP address, browser and device type, the pages requested, and the date and time of your visit. If you accept analytics cookies, our analytics tools record similar details about how you use the website
• Cookies and similar technologies: see section 4

C. Information from other sources

We may receive information from the service providers and platforms we use to run the Services, such as advertising and analytics platforms (for example, campaign and conversion reports from Google, Meta, and Microsoft) and payment processors (for example, confirmation that an invoice has been paid).

3. How We Use Personal Data and Our Lawful Bases

UK data protection law requires us to have a lawful basis for each use of your personal data. These are the ones we rely on:

• Responding to enquiries, preparing quotes and proposals, and arranging meetings: taking steps at your request before entering into a contract, or our legitimate interest in responding to a business that has contacted us
• Providing, hosting, maintaining, and supporting the services you engage us for, and sending invoices and service notices: performing our contract with you
• Keeping accounting and tax records: complying with our legal obligations
• Protecting our website and forms against spam, fraud, abuse, and security incidents: our legitimate interest in keeping our systems, and the information in them, secure
• Understanding which marketing brought an enquiry to us (the campaign details saved with your form): our legitimate interest in knowing which of our marketing works
• Analytics and advertising cookies, and reporting an enquiry to Meta from our server: your consent, which you give or refuse in our cookie banner and can withdraw at any time
• Sending information about our services to business contacts: our legitimate interest in staying in touch with businesses that have enquired or bought from us, or your consent where the law requires it. You can opt out at any time
• Enforcing our terms and establishing, exercising, or defending legal claims: our legitimate interests, and complying with our legal obligations

Where we rely on legitimate interests, you have the right to object (see section 9). We do not use your personal data to make solely automated decisions that have a legal or similarly significant effect on you.

4. Cookies and Similar Technologies

Our website uses the following cookies and similar technologies:

• Strictly necessary cookies — A session cookie, a security (CSRF) cookie that protects our forms, and a cookie that remembers your cookie choice. These are needed for the website and its forms to work and are always set.
• Google reCAPTCHA v3 (when enabled) — Runs on our forms to help tell real visitors from automated submissions. Google's script collects device, browser, and interaction information to do this.
• Analytics and advertising tags (only with your consent) — Google Analytics 4, Google Ads conversion tracking, the Meta Pixel, and Microsoft Advertising UET, where each is in use. None of these loads unless you choose "Accept" in our cookie banner. They set cookies or similar identifiers and send information about your visit to those companies so we can measure how our website and advertising perform.
• Meta Conversions API (only with your consent) — If you have accepted advertising cookies and then send us an enquiry form, our server also reports that enquiry to Meta so we can measure our advertising. The report contains a hashed (scrambled) copy of your name, email address, phone number, town or city, and postcode, together with your IP address, your browser type, any Meta cookie identifiers your browser holds, the page you sent the form from, and the service you asked about. It never includes your message.
• Google Fonts — The fonts on our pages load from Google's servers, so your browser sends Google your IP address and basic browser details when it requests them.

Your choices: When you first visit, a banner asks whether you accept analytics and advertising cookies. You can change or withdraw your choice at any time using the "Cookie settings" link at the bottom of every page. Our Cookie Policy lists each cookie and explains the other controls available to you.

5. Who We Share Personal Data With

We do not sell your personal data.

Within our team

Enquiry form submissions are stored on our web server and emailed to our team so that we can respond to you.

Service providers

We share personal data with companies that help us run the Services: our web hosting and email providers; Google (reCAPTCHA, Google Fonts and, with your consent, Google Analytics and Google Ads); Meta and Microsoft (advertising measurement, with your consent); payment processors; and the tools we use to communicate and schedule meetings. Google, Meta, and Microsoft also handle the information their own tags collect under their own privacy policies.

Legal, safety, and rights

We may disclose personal data if required by law, court order, or lawful government request, or if necessary to protect our rights and property, enforce agreements, prevent fraud or security threats, or protect users or the public.

Business transfers

If we are involved in a merger, acquisition, restructuring, or sale of assets, personal data may be transferred as part of that transaction.

6. International Transfers

X3WEB is based in South Africa, with team members in Europe. The personal data you send us is therefore received, stored, and used outside the United Kingdom. Some of our service providers, including Google, Meta, and Microsoft, also process personal data in the United States and other countries.

Data protection laws in those countries may differ from the law in the UK. Where UK data protection law requires a safeguard for an international transfer, we use one that the law recognises, such as UK adequacy regulations or contractual clauses approved for use in the UK. Wherever your personal data is processed, we handle it as described in this policy, and you can contact us for more information about the safeguards that apply.

7. How Long We Keep Personal Data

We keep personal data only as long as necessary for the purposes described in this policy. How long that is depends on why we hold it:

• Enquiry submissions and related correspondence are kept while we respond and follow up with you
• Client and service records (such as contracts, invoices, and billing records) are kept for as long as we provide the service and afterwards as needed for accounting, tax, and business record-keeping
• Marketing preferences are kept while you remain subscribed, and a record of an opt-out is kept so that we can continue to honour it

You can ask us to delete your personal data at any time (see section 9). We may keep aggregated or anonymised information for longer.

8. Security

We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration, or disclosure. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Your Rights

Under UK data protection law you have the right to:

• Be informed about how we use your personal data, which is the purpose of this policy
• Access the personal data we hold about you and receive a copy of it
• Rectification: ask us to correct personal data that is inaccurate or incomplete
• Erasure: ask us to delete your personal data in certain circumstances
• Restriction: ask us to limit how we use your personal data in certain circumstances
• Object to our use of your personal data where we rely on legitimate interests, and to direct marketing at any time
• Data portability: receive personal data you gave us in a commonly used, machine-readable format, where we use it on the basis of consent or a contract
• Withdraw consent at any time where we rely on it, for example through "Cookie settings" at the bottom of every page. Withdrawing consent does not affect what was done before you withdrew it

To exercise any of these rights, email info@x3webdesign.com. Exercising your rights is free, and we will respond within one month. We may need to verify your identity first, and some information may have to be kept where the law requires or allows it (for example, billing records).

Complaints

If you are unhappy with how we have handled your personal data, please tell us first at info@x3webdesign.com. We will acknowledge your complaint within 30 days and respond without undue delay. You also have the right to complain to the UK's Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint or on 0303 123 1113.

If you live outside the United Kingdom, you may have similar rights under your local law, and you can contact us in the same way.

10. Children's Privacy

Our Services are intended for businesses and are not directed at children. We do not knowingly collect personal data from children. If you believe a child has provided personal data, contact info@x3webdesign.com and we will delete it.

11. Third-Party Links

Our Services may link to third-party websites or services. We are not responsible for their privacy practices. Please review their policies before providing personal data.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will post the updated version on this page and change the effective date above.

13. Contact Us

If you have a question about this Privacy Policy or want to exercise your rights, contact us:

X3WEB
Registered office: 4 Edmonton Alley, Northcliff, Johannesburg, South Africa
Email: info@x3webdesign.com
Phone: +27 68 906 3369