Privacy Policy
Last updated: 29 September 2026
Web Wizard Agency (“we”, “us”, “our”) builds websites and runs digital marketing, advertising and lead-management services for trade and local service businesses. This policy explains what personal data we collect, why, how long we keep it, who we share it with, and your rights. It applies to our website webwizardagency.com, our services and our communications.
1. Who we are
The data controller for the personal data described in this policy is:
Web Wizard Agency
18 Broomlea Crescent
Edinburgh
EH12 7NR
United Kingdom
Email: info@webwizardagency.com
If you have any questions about this policy or your data, please email us at the address above.
2. The data we collect
When you visit our website:
- Technical data such as your IP address, browser and device type, pages viewed, time on site and how you arrived. This is collected through cookies and similar technologies (see section 8).
When you contact us or request a quote:
- Your name, email address, phone number, business name, website address and any details you include in your message.
When you speak to us by phone or video:
- Call details (number, date and duration). Where we tell you at the start of a call, a recording and transcript of the call, used for accuracy, training and record-keeping.
When you become a client:
- Contact and billing details, project information, content you supply (such as text, photos, videos and logos) and records of our communications.
- Login or access details for accounts you grant us access to, such as your website, Google Business Profile, Google Ads or Meta ad accounts.
When you subscribe to updates:
- Your email address and preferences. You can unsubscribe at any time.
When you pay us:
- Payments are handled by our payment providers, such as Stripe or PayPal. We do not see or store your full card details.
3. How and why we use your data (lawful basis)
- Replying to enquiries and preparing quotes: legitimate interests (responding to people who contact us), or taking steps at your request before entering a contract.
- Delivering and managing client services: performance of a contract.
- Invoicing, accounting and tax records: legal obligation.
- Recording and transcribing calls: legitimate interests (accuracy, quality and record-keeping). You will be told at the start of the call.
- Website analytics and improvement: consent, given through our cookie banner.
- Advertising and remarketing on Google and Meta: consent, given through our cookie banner.
- Email marketing: consent, which you can withdraw at any time.
- Protecting our business and resolving disputes: legitimate interests.
We do not make decisions about you based solely on automated processing.
4. Data we handle on behalf of our clients
When we run a client’s website, forms, advertising or lead-management system, we collect enquiries from that client’s customers (for example, a homeowner requesting a quote from a builder). In these cases our client is the data controller and we act as their data processor. We only process that data on our client’s instructions, to provide our services to them. Questions about that data should be sent to the business you contacted.
5. Google data (Google Ads API)
We use the Google Ads API, through our own internal tools, to manage and report on advertising accounts that our clients have authorised us to access through our Google Ads manager account.
- What we access: campaign settings, performance statistics and keyword planning data, such as search volumes and bid estimates.
- How we use it: only to provide advertising management, research and reporting to the client the account belongs to.
- Sharing: we do not sell this data. We share it only with the client it belongs to, and with no one else except where required by law.
- Storage and retention: it is stored securely and kept only for as long as we manage the client’s account, or as required by law.
- Compliance: our use of information received from Google APIs complies with the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.
6. Who we share data with
We share personal data only where necessary, with:
- Service providers who help us run our business, including website hosting, our CRM and communications platform (which handles enquiries, messaging and call recording), email, video calls, cloud storage, accounting and payment providers.
- Advertising and analytics platforms, such as Google (Analytics and Ads) and Meta (Facebook and Instagram), where you have consented to cookies.
- Freelancers and contractors working on a client project under our instruction and bound by confidentiality.
- Professional advisers, such as our accountant, and authorities where the law requires it.
All our service providers are required to keep your data secure and to use it only for the services they provide to us. We never sell or rent your personal data.
7. International transfers
Some of our service providers store or process data outside the UK, including in the European Economic Area and the United States. Where this happens, we make sure the transfer is protected by a UK adequacy decision (including the UK–US Data Bridge), the UK International Data Transfer Agreement or Addendum, or another safeguard approved under UK data protection law.
8. Cookies
We use cookies and similar technologies to keep our website working, to understand how it is used (Google Analytics), and to measure and improve our advertising (Google Ads and the Meta Pixel). Non-essential cookies are only set if you accept them through our cookie banner, and you can change your choice at any time.
9. How long we keep your data
- Enquiries that do not become clients: up to 2 years after our last contact.
- Client records, contracts and invoices: 6 years after the end of our work together, to meet UK tax and legal requirements.
- Call recordings and transcripts: up to 12 months, unless needed to resolve a dispute.
- Email marketing list: until you unsubscribe.
- Website analytics data: up to 14 months.
- Access to client accounts (Google, Meta, website): removed when our work for that client ends.
10. Keeping your data secure
We use appropriate technical and organisational measures to protect your data. These include encrypted connections (SSL), secure password practices, two-factor authentication where available, and access limited to those who need it. No system is completely secure, but we work hard to protect your data and will notify you and the Information Commissioner’s Office of any serious breach where the law requires.
11. Your rights
Under UK data protection law, you have the right to:
- access the personal data we hold about you
- have inaccurate data corrected
- have your data erased in certain circumstances
- restrict or object to how we use your data, including objecting to marketing at any time
- data portability (receiving your data in a usable format)
- withdraw your consent at any time, where we rely on consent
To use any of these rights, email info@webwizardagency.com. There is no charge, and we will respond within one month.
If you are unhappy with how we have handled your data, please contact us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk or on 0303 123 1113.
12. Children
Our services are intended for businesses and adults. We do not knowingly collect personal data from anyone under 18.
13. Changes to this policy
We may update this policy from time to time. The latest version will always be published on this page, with the date it was last updated shown at the top.
14. Contact us
Web Wizard Agency
18 Broomlea Crescent
Edinburgh
EH12 7NR
United Kingdom
info@webwizardagency.com