Skip to content
webfixed

Privacy notice

Last updated: 21 September 2026

1. Who we are

WebFixed is a trading name of Webgro Ltd, a company registered in England and Wales with company number 10889889. Our registered office is 13-14 Longshot Lane, Bracknell, Berkshire, RG12 1RL.

This notice explains what personal data we collect when you use webfixed.co.uk and our website support service, why we collect it, who we share it with and what rights you have. Webgro Ltd is the controller of this data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. If you have any questions, email us at help@webfixed.co.uk.

2. The data we collect

We collect the following information.

  • Contact details: your name, email address and, if you give it, your business name.
  • Website details: the address of your website and the platform it runs on.
  • Requests and messages: what you tell us when you send a request, answer our follow-up questions or message our team or the Chat assistant, including any screenshots or files you attach.
  • Access details: the collaborator access, application passwords or invites you give us so we can work on your website.
  • Payment records: what you have paid, when, and for what. Payments are handled by Stripe. We never see or store your full card number.
  • Usage and security logs: basic technical information such as your IP address, browser type, the pages you visit and when you sign in. We use this to keep the service running and secure.
  • Advertising information: if you reach our website from a Google advert, we record the campaign details in the web address (known as UTM parameters) and the Google Ads click identifier, so we can tell which adverts lead to requests.

While working on your website we may be able to see personal data that belongs to your own customers, such as order details. We only look at this where it is needed for the work you have asked for. For that data, you are the controller and we act on your instructions.

3. How we use your data and our lawful bases

UK data protection law requires us to have a lawful basis for each way we use your personal data. We rely on the following.

  • Contract. We use your contact details, website details, requests, messages and access details to reply to your request, send you a quote, carry out the work, run your monthly plan and take payment. This is necessary to perform our contract with you, or to take steps you have asked for before entering into one.
  • Legitimate interests. We use usage and security logs to protect our service and our customers from misuse and fraud. We use advertising information to understand which adverts work so we can spend our budget sensibly. We use records of past requests to improve our service and to deal with any complaint or dispute. We have considered your interests in each case and believe these uses are ones you would reasonably expect.
  • Legal obligation. We keep payment and transaction records because tax and company law require us to.

We send you emails about your requests, quotes, payments and account. We will only send you marketing emails if you have agreed to receive them, and you can unsubscribe at any time.

4. Our use of AI tools

We use AI tools to help us understand requests. When you send us a request, its contents may be processed by an AI model to help write follow-up questions and summaries for our team. Our team reviews this work and makes the decisions about what happens next. We do not use AI to make decisions about you that have legal or similarly significant effects.

5. Who we share your data with

We do not sell your personal data. We share it only with service providers who help us run WebFixed. They act as our processors, which means they can only use your data on our instructions and must keep it secure.

  • Vercel, which hosts our website and application.
  • Neon, which provides the database where we store account and request data.
  • Resend, which sends our emails, including your sign-in links.
  • Stripe, which processes payments and, if you choose, saves your card for future payments.
  • Anthropic, which provides the AI model that helps write follow-up questions and summaries of requests.
  • Google, if we use Google Ads conversion tracking, which receives information about whether a click on one of our adverts led to a request or purchase.

We may also share information with our professional advisers, such as our accountants and lawyers, or where the law requires it, for example with HM Revenue and Customs or the police. If our business is ever sold or reorganised, your data may be transferred to the new owner, who would have to respect this notice.

6. International transfers

Some of our service providers store or process data outside the UK, including in the United States and the European Economic Area. When this happens, we make sure appropriate safeguards are in place, such as a UK adequacy decision, the UK International Data Transfer Addendum to the European Commission’s standard contractual clauses, or the UK Extension to the EU-US Data Privacy Framework. You can ask us for more information about these safeguards.

7. How long we keep your data

  • Account and request data is kept while your account is active and for 6 years after it closes, so we have records for tax purposes and in case of a legal claim.
  • Payment and transaction records are kept for 6 years after the end of the financial year they relate to.
  • Access details for your website are deleted or revoked when they are no longer needed for the work. You can also remove our access yourself at any time.
  • Security logs are kept for a short period, usually no more than 90 days, unless we need them to investigate a problem.

8. How we keep your data secure

We use encrypted connections throughout our service. We store WordPress application passwords encrypted, and only the people working on your request can see your access details. You sign in to your account using a link we email to you, so there is no WebFixed password that could be guessed or leaked. We ask you to give us limited access, such as a collaborator account, rather than your own login.

No system is perfectly secure. If a data breach affects you and is likely to put your rights at risk, we will tell you and, where required, the Information Commissioner’s Office.

9. Cookies

Some cookies are essential for the website to work, such as keeping you signed in and protecting forms against misuse. These do not need your consent and are always on.

With your consent, we also use Google Analytics and Google Ads cookies. They tell us how people find and use the website, and whether our adverts lead to requests and payments. Google sets these cookies and processes the information on our behalf. Nothing from Google loads until you choose Accept on the cookie message, and you can change your choice at any time using the Cookie settings link at the bottom of every page.

If you arrive from one of our adverts, we keep the advert’s campaign details and click reference with your request, so we can tell which adverts work. We do this whether or not you accept cookies, because it is stored with your request rather than in a cookie.

10. Your rights

Under UK GDPR, you have the right to:

  • ask for a copy of the personal data we hold about you;
  • ask us to correct data that is inaccurate or incomplete;
  • ask us to delete your data, where we have no good reason to keep it;
  • ask us to restrict how we use your data in certain circumstances;
  • object to our use of your data where we rely on legitimate interests, and to object at any time to direct marketing;
  • ask us to transfer data you have given us to you or another organisation, in a commonly used format;
  • withdraw your consent at any time, where we rely on consent.

To use any of these rights, email help@webfixed.co.uk. We may need to confirm your identity before we act on a request. We will reply within one month, and there is normally no charge.

11. Complaints

If you are unhappy with how we have handled your personal data, please contact us first and we will try to put it right. You also have the right to complain to the Information Commissioner’s Office, the UK regulator for data protection, at ico.org.uk or by calling 0303 123 1113.

12. Changes to this notice

We may update this notice from time to time. The date at the top shows when it was last changed. If we make a significant change, we will tell you by email or on our website. Our terms of service explain how our service works.