WebPrivacy Policy
Last updated: 13 July 2026
1. Who we are
WebFirst ("we", "us") operates webfirst.co.uk. We're the data controller for the personal information described below. You can reach us at webfirst@webfirst.co.uk with any privacy question or request.
2. What we collect, and why
| When | What we collect | Why |
|---|---|---|
| You fill in the contact form | Name, business name, email, package interest, your message | To respond to your enquiry |
| You create an account | Name, email, a securely hashed password | To give you access to your account and order history |
| You place an order | Package chosen, amount, order status | To deliver and track your order |
| You pay for an order | Handled entirely by Stripe — we never see or store your card details | To process payment securely |
| You browse the site | A session cookie, only while you're logged in | To keep you signed in |
We don't use advertising or tracking cookies, and we don't collect any personal data just from you browsing the public pages of the site.
3. Our lawful basis for using your data
- Contract — processing your order, giving you account access, billing a Care Plan.
- Legitimate interest — responding to enquiries you've sent us through the contact form.
- Legal obligation — keeping financial records as required by UK law.
We don't rely on consent for anything covered above, since none of it involves marketing or tracking.
4. Who we share it with
We don't sell or rent your data to anyone. We share it only where it's genuinely needed to run the service:
- Stripe — processes payments. See Stripe's own privacy policy.
- Our hosting provider — stores the database that the site and your account run on.
- Web3Forms — may be used to email us a copy of contact form submissions.
None of these providers are permitted to use your data for their own purposes.
5. How long we keep it
We keep account and order data for as long as your account is active, plus a reasonable period afterwards for legal and accounting purposes. Contact form enquiries that don't turn into a customer relationship are kept for a reasonable period and then deleted. You can ask us to delete your data sooner — see your rights below.
6. Your rights
Under UK GDPR, you have the right to:
- Ask what personal data we hold about you, and get a copy of it
- Ask us to correct anything that's inaccurate
- Ask us to delete your data, where there's no legal reason we need to keep it
- Ask us to restrict or object to certain processing
- Ask for your data in a portable format
- Complain to the Information Commissioner's Office (ICO) if you think we've got something wrong
To exercise any of these, email webfirst@webfirst.co.uk — we'll respond within a month.
7. How we protect your data
Passwords are never stored as plain text — they're hashed using industry-standard methods. Access to the admin dashboard is restricted by role, so only admins can see customer data, and only the site owner can grant admin access. Payment details never touch our servers at all — that's handled entirely within Stripe's own secure systems.
8. Children's privacy
WebFirst's services are intended for business customers, not children. We don't knowingly collect data from children. If you believe a child has given us personal information, contact us and we'll remove it.
9. Changes to this policy
We may update this policy as the site changes. Significant changes will be reflected in the "last updated" date at the top of this page.
10. Contact
Questions about this policy or your data? Email webfirst@webfirst.co.uk.