Privacy Policy

Last updated: June 2026

The Digital Workshop Co. ("we", "us", "our") is committed to protecting your personal data. This policy explains what information we collect, how we use it, and your rights under the UK GDPR and Data Protection Act 2018.

1. What data we collect

We collect the following categories of personal data:

• Contact information — name, email address, phone number, and business name provided via our enquiry or onboarding forms.
• Account credentials — email address and hashed password for client portal access.
• Project and business details — information you share during the project brief, including brand assets, copy, and preferences.
• Payment information — billing address and payment method details processed securely via Stripe (we never store full card numbers).
• Usage data — basic analytics about how you use our client portal, collected to improve the service.

2. How we use your data

We process your data on the following lawful bases:

• Contract performance — to deliver the agreed website design, build, and hosting services.
• Legitimate interests — to manage our client relationships, send project updates, and improve our services.
• Legal obligation — to comply with tax and financial record-keeping requirements.

We do not sell, rent, or trade your personal data to third parties for marketing purposes.

3. Who we share data with

We use the following trusted sub-processors to deliver our services. Each operates under a data processing agreement and provides appropriate safeguards:

• Supabase — database hosting and authentication. Data is stored in EU data centres.
• Stripe — payment processing. Subject to PCI DSS compliance.
• Resend & Postmark — transactional email delivery (account, billing and notification emails).
• Vercel — website and application hosting infrastructure.
• OpenAI & Anthropic — AI processing used to generate website drafts, copy and logos from the prompts you provide. We do not send these providers your billing details, and we do not permit them to train their models on your content where an opt-out is available.
• Google — Google Analytics 4 (marketing-site analytics, only after you consent) and the Google PageSpeed and Places APIs (used by our website-audit tool).

3a. International data transfers

Some of our sub-processors (including Stripe, Vercel, OpenAI, Anthropic, Postmark and Google) are based in, or process data in, the United States or other countries outside the UK/EEA. Where personal data is transferred outside the UK/EEA, we rely on appropriate safeguards — such as the UK International Data Transfer Agreement (IDTA), the EU Standard Contractual Clauses, or an adequacy decision — to ensure your data receives an equivalent level of protection.

4. Your rights

Under UK GDPR you have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate or incomplete data.
• Erasure — request deletion of your personal data where there is no compelling reason for continued processing.
• Portability — receive your data in a structured, machine-readable format.
• Objection — object to processing based on legitimate interests.
• Restriction — ask us to pause processing while a complaint is resolved.

To exercise any of these rights, contact us at sam@thedigitalworkshopco.com. We will respond within 30 days. You also have the right to lodge a complaint with the ICO at ico.org.uk.

5. Data retention

We retain client data for the duration of our working relationship and for up to 7 years afterwards to meet legal and financial obligations. Account data is deleted within 30 days of a written cancellation request, except where retention is legally required.

6. Cookies

We use essential cookies to maintain your login session, and — only if you consent via our cookie banner — Google Analytics cookies to understand how visitors use our marketing site. See our Cookie Policy for the full list.

7. Contact

The Digital Workshop Co.
Email: sam@thedigitalworkshopco.com