Privacy Policy

Last updated: September 2026

The Digital Workshop Co., a trading name of SVE Ventures Ltd (company no. 16822306) ("we", "us", "our"), is the data controller and is committed to protecting your personal data. This policy explains what information we collect, how we use it, and your rights under the UK GDPR and Data Protection Act 2018.

1. What data we collect

We collect the following categories of personal data:

  • Contact information — name, email address, phone number, and business name provided via our enquiry or onboarding forms.
  • Account credentials — email address and hashed password for client portal access.
  • Project and business details — information you share during the project brief, including brand assets, copy, and preferences.
  • Payment information — billing address and payment method details processed securely via Stripe (we never store full card numbers).
  • Usage data — basic analytics about how you use our client portal, collected to improve the service.

2. How we use your data

We process your data on the following lawful bases:

  • Contract performance — to deliver the agreed website design, build, and hosting services.
  • Legitimate interests — to manage our client relationships, send project updates, and improve our services.
  • Legal obligation — to comply with tax and financial record-keeping requirements.

We do not sell, rent, or trade your personal data to third parties for marketing purposes.

3. Who we share data with

We use the following trusted sub-processors to deliver our services. Each operates under a data processing agreement and provides appropriate safeguards:

  • Supabase — database hosting and authentication. Data is stored in EU data centres.
  • Stripe — payment processing. Subject to PCI DSS compliance.
  • Resend & Postmark — transactional email delivery (account, billing and notification emails).
  • Vercel — website and application hosting infrastructure.
  • OpenAI & Anthropic — AI processing used to generate website drafts, copy and logos from the prompts you provide. We do not send these providers your billing details, and we do not permit them to train their models on your content where an opt-out is available.
  • PostHog Inc. — cookieless website analytics, hosted on PostHog's EU Cloud (Frankfurt). Used only for aggregate site statistics (visits, pages, referrers, enquiries and sales counts); no cookie or device identifier is stored, IP addresses are anonymised, and web addresses are stripped of names, tokens and other query details before they are sent. Session recordings (with form fields masked) and error reports are only captured if you accept analytics cookies.
  • Google — Google Analytics 4 (marketing-site analytics, only after you consent) and the Google PageSpeed and Places APIs (used by our website-audit tool).

3a. International data transfers

Some of our sub-processors (including Stripe, Vercel, OpenAI, Anthropic, Postmark and Google) are based in, or process data in, the United States or other countries outside the UK/EEA. Where personal data is transferred outside the UK/EEA, we rely on appropriate safeguards — such as the UK International Data Transfer Agreement (IDTA), the EU Standard Contractual Clauses, or an adequacy decision — to ensure your data receives an equivalent level of protection.

4. Your rights

Under UK GDPR you have the right to:

  • Access — request a copy of the personal data we hold about you.
  • Rectification — ask us to correct inaccurate or incomplete data.
  • Erasure — request deletion of your personal data where there is no compelling reason for continued processing.
  • Portability — receive your data in a structured, machine-readable format.
  • Objection — object to processing based on legitimate interests.
  • Restriction — ask us to pause processing while a complaint is resolved.

To exercise any of these rights, contact us at sam@thedigitalworkshopco.com. We will respond within 30 days. You also have the right to lodge a complaint with the ICO at ico.org.uk.

5. Data retention

We retain client data for the duration of our working relationship and for up to 7 years afterwards to meet legal and financial obligations. Account data is deleted within 30 days of a written cancellation request, except where retention is legally required.

6. Cookies

We use essential cookies to maintain your login session, and — only if you consent via our cookie banner — Google Analytics cookies to understand how visitors use our marketing site. We also use PostHog in cookieless mode for aggregate site statistics, which stores nothing on your device. See our Cookie Policy for the full list.

7. Contact

The Digital Workshop Co., a trading name of SVE Ventures Ltd
Registered in England and Wales, company no. 16822306
Email: sam@thedigitalworkshopco.com

Terms of ServiceCookie PolicyHosting & Care Terms← Back to site