Last updated: 24 September 2026
1. Who we are
This policy explains how CML Design Web Services Ltd (“CML Design”, “we”, “us”) collects and uses personal information when you visit cmldesign.co.uk, contact us, or work with us as a client.
We are the data controller for the personal information described here, except where we act for a client (see section 5).
- Company: CML Design Web Services Ltd, registered in England and Wales, company number 08283233
- Registered office: 12 Trident Park, Trident Way, Blackburn, BB1 3NU
- Trading address: 63 Duckworth Street, Darwen, BB3 1AT
- Email: sales@cmldesign.co.uk
- Phone: 01254 368523
We are not required to appoint a Data Protection Officer. Please send any privacy question or request to sales@cmldesign.co.uk.
2. What we collect and where it comes from
We collect only what we need to answer enquiries, deliver our services and run our business.
- Enquiries. When you use our enquiry form, email or phone us, we collect your name, email address, phone number, business name, website address and whatever you tell us about your project.
- Client and project information. When you become a client, we hold the names, job roles, email addresses and phone numbers of your contacts, your business details (such as name, address, opening hours and social profiles used for listings), project briefs, feedback, approvals, files you send us, and logins you share so we can work on your website or accounts.
- Emails. Copies of emails exchanged between us and you or your colleagues (see section 6).
- Billing. Billing contact details, invoices and payment records. We do not store card details.
- Client portal activity. When you use a link to your project page, we record the comments, approvals, uploads and requests you make there, with the date and time.
- Website visits. Your IP address, browser and device type, pages visited and the referring site, collected through server logs, security tools and, if you consent, analytics cookies (see section 7).
- From other people. A colleague may give us your details as a contact on their project, and we may look up public business information (such as Companies House or business directory listings) when doing work for a client.
We do not knowingly collect special category data (such as health or religious beliefs) and ask you not to send it to us. Our services are for businesses and are not aimed at children.
3. How we use it and our lawful basis
UK data protection law requires a lawful basis for each use of personal information. Ours are set out below.
| What we do | Lawful basis |
|---|---|
| Reply to your enquiry and prepare a quote | Steps you ask for before entering a contract; otherwise our legitimate interest in responding to people who contact us |
| Deliver our services: design, development, hosting, maintenance, SEO, listings, reviews, advertising and content | Performance of our contract with you or your business |
| Keep in touch with your colleagues named on a project | Our and our client’s legitimate interest in running the project |
| Keep a record of emails and portal activity so nothing is lost and decisions are traceable | Legitimate interests |
| Back up the websites we manage | Performance of our contract, and legitimate interest in protecting client data against loss |
| Invoicing, accounts and tax records | Legal obligation and performance of our contract |
| Keep our website and systems secure | Legitimate interests |
| Analytics cookies to understand how our website is used | Your consent, which you can withdraw at any time |
| Occasional emails about our services to existing clients | Legitimate interests under the PECR “soft opt-in”; you can opt out in any email or by contacting us |
Where we rely on legitimate interests, we have weighed them against your rights and kept the processing to what a business contact would expect. We do not sell personal information and do not use it for automated decisions that have legal or similarly significant effects on you.
4. Client portal and project records
We manage client work in a private system on our website (the CML Design Control Centre). It holds client and contact details, project briefs, sitemaps, designs, task lists, files, comments, job requests, reports and the emails described in section 6.
- Personal links. Clients and their colleagues reach their project pages through a personal link rather than a password. Anyone who has the link can open those pages, so please don’t share or forward it. If a link may have been seen by someone else, tell us and we will switch it off and issue a new one.
- What you see. Each link only shows the projects and information that person has been given access to.
- What we record. Comments, approvals, uploads and requests made through a link are saved against that person’s name with the date and time.
- Access. Only CML Design staff can see the full system, and only when they need it for their work.
5. When we act for our clients
When we build, host, maintain or back up a client’s website, that website may hold personal information about the client’s own customers, such as form entries or orders. In that case the client is the controller and we process that information only on their instructions, under our terms of business. Questions about it should go to the business that owns the website, and its own privacy policy applies.
6. Google services (Gmail and Google Drive)
Our Control Centre connects to CML Design’s own Google account through Google’s sign-in (OAuth). Only CML Design staff connect Google accounts to it; clients are never asked to.
- Gmail (read-only). The Control Centre reads messages in our mailbox and saves a copy of emails sent to or from our clients’ contacts, and of new enquiries, against the matching client, contact or project. It saves the sender, recipients, date, subject, message body and attachments. It never sends, deletes, labels or changes anything in the mailbox. Saved copies stay in the Control Centre even if the original is later deleted in Gmail, until removed under our retention rules (section 9).
- Google Drive. We store encrypted backups of the client websites we manage in our Google Drive. The Control Centre only has access to the files and folders it creates there.
- Limited Use. CML Design’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide these features inside the Control Centre. We do not sell it, use it for advertising, or use it to train generalised AI or machine-learning models, and no person reads it except where needed for our client work, for security, or to comply with the law.
- Disconnecting. We can disconnect the Google account at any time in the Control Centre settings or at myaccount.google.com/permissions. If you want emails about you removed, contact us (section 11).
7. Cookies
Cookies are small files stored on your device. We use strictly necessary cookies to make the site work and, only if you agree, analytics cookies. The client portal links do not set any cookies of their own.
| Cookie | Provider | Purpose | Type | Lasts |
|---|---|---|---|---|
| wordpress_test_cookie, wordpress_logged_in_*, wp-settings-* | WordPress (this site) | Lets our staff log in to manage the site | Strictly necessary | Session to 1 year |
| Cookie consent cookie | CML Design (this site) | Remembers your cookie choice | Strictly necessary | Up to 1 year |
| _ga, _ga_* | Google Analytics | Counts visits and shows which pages are used, so we can improve the site | Analytics, set only with consent | Up to 2 years |
When you first visit, a pop-up asks whether you accept analytics cookies. You can change your choice at any time by clearing this site’s cookies in your browser, after which the pop-up will ask again. Refusing analytics cookies does not affect how the site works.
8. Who we share it with
We share personal information only with service providers who help us run our business, under contracts that require them to protect it and use it only on our instructions.
| Provider | What they do for us | Where |
|---|---|---|
| 20i | Hosts our website and Control Centre | UK |
| Google (Gmail, Google Workspace, Google Drive) | Email, documents and website backups | UK, EU and US |
| Zoho (Zoho Books) | Invoicing and accounts | EU or US |
| Clockify | Time tracking for client projects (names of clients and projects only) | EU or US |
| Droplr | Sharing screenshots and files with clients | US |
| BrightLocal | Business directory listings and review monitoring for clients who buy those services | UK and US |
| Google Analytics | Website statistics, only with your consent | US |
We may also share information with our accountants and professional advisers, with the platforms we manage on a client’s behalf (such as Google Business Profile or directory sites) when that is the job, and with authorities when the law requires it. If our business is sold or restructured, information may pass to the new owner under the same protections.
International transfers. Some providers process data outside the UK. When they do, we rely on UK adequacy regulations (for example for the EU, or US companies certified under the UK Extension to the EU-US Data Privacy Framework) or on the ICO’s International Data Transfer Agreement or Addendum.
9. How long we keep it
| Information | How long |
|---|---|
| Enquiries that don’t lead to work | 2 years from our last contact |
| Client, contact, project and portal records | For as long as you are a client, then 6 years |
| Saved emails | 2 years after the last email in a conversation, or sooner if the client relationship ends and you ask us to delete them |
| Invoices and accounting records | 6 years after the end of the financial year they relate to, as HMRC requires |
| Website backups | Daily backups for 30 days and weekly backups for 12 weeks |
| Website server and security logs | Up to 90 days |
When a client relationship ends, we remove their portal links straight away and delete or anonymise their records at the end of the periods above.
10. How we protect it
Our website uses HTTPS, the Control Centre is open only to logged-in CML Design staff, portal links are long random codes that we can switch off at any time, backups are encrypted before they leave the server, and our accounts use strong passwords and two-step verification. No system is completely secure, so if a breach puts your information at risk we will tell you and, where required, the ICO.
11. Your rights
Under UK data protection law you have the right to:
- ask for a copy of the personal information we hold about you
- ask us to correct information that is wrong or incomplete
- ask us to delete your information
- ask us to restrict how we use it
- object to our use of it where we rely on legitimate interests, including for marketing
- ask us to transfer information you gave us to another organisation
- withdraw consent at any time, where we rely on consent
To use any of these rights, email sales@cmldesign.co.uk. It is free, and we will reply within one month. We may ask you to confirm your identity first.
12. Complaints
If you are unhappy with how we have handled your information, please contact us first so we can put it right. You can also complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113.
13. Changes to this policy
We may update this policy when our services or the law change. The date at the top shows when it was last revised, and we will tell clients directly about any significant change.