Who we are
Wilson's Websites is a trading name of Totomize Ltd, a company registered in England and Wales (company number 16345582), with its registered office at 3rd Floor, 86–90 Paul Street, London EC2A 4NE. In this policy, “we”, “us” and “our” mean Totomize Ltd.
For the personal information described here, we are the controller: we decide how and why it is used. We work with clients in the United Kingdom and Australia, so we follow the UK General Data Protection Regulation and the Data Protection Act 2018, and handle personal information in line with the Australian Privacy Principles.
What we collect
When you get in touch
If you use the contact form, we receive what you enter: your name, email address, business name, existing website, the services you are interested in, where you are, and your message. If you email or call us, we receive your contact details and whatever you tell us. An enquiry also records which page of our site it was sent from and, if you arrived by clicking one of our ads, which campaign that was (such as the campaign name and the ad click reference in the link), so we can tell which advertising works.
When you become a client
Your contact and billing details, the content and materials you give us for your project, our correspondence, and invoices and payment records. To work on your website, domain, email or other accounts you may also share login details or give us access to them.
When you visit this website
Our hosting provider automatically processes technical information needed to deliver the site and keep it secure, such as your IP address, browser type and the pages requested. We do not use this to identify you.
Only if you agree, we also collect information about how you use the site through Google Analytics: the pages you visit, how long you stay, how you found us (for example a search, a social post or an ad), your device and browser type, and your approximate location (town or country). When we run advertising, Google Ads and the Meta Pixel record whether a visit came from one of our ads and whether you then got in touch.
How we use it
| What we do | Lawful basis (UK GDPR) |
|---|---|
| Reply to enquiries and prepare quotes | Our legitimate interest in responding to people who contact us, or taking steps at your request before a contract |
| Design, build, host and look after your website, and provide our other services | Performing our contract with you |
| Invoicing, accounts and tax records | Legal obligation |
| Running this website securely | Our legitimate interest in keeping the site available and safe |
| Understanding how the site is used, so we can improve it (Google Analytics) | Your consent |
| Measuring whether our Google and Meta ads work, and showing our ads to people who have visited the site | Your consent |
| Occasional updates about our services | Your consent, or our legitimate interest for existing clients. Every message lets you opt out. |
We do not sell personal information, and we do not use it for automated decisions that affect you.
Cookies, analytics and ads
Cookies are small files a website stores in your browser. We only use cookies for analytics and advertising, and only after you agree. When you first visit, a banner asks whether you accept analytics, advertising, both or neither. Nothing from Google or Meta loads until you choose, and if you reject them, nothing loads at all. You can change your mind at any time with the Cookie settings link at the bottom of every page. Withdrawing consent deletes the cookies these tools have set on our site.
Advertising cookies are only used while we are running ads on Google or Meta. We use Google’s Consent Mode, which passes your choice on to Google’s tags.
| Name | Set by | What it does | Kept for |
|---|---|---|---|
| ww-consent-v1 | Us (stored in your browser, not a cookie) | Remembers your cookie choice so we don’t ask on every page. Essential. | Until you clear it |
| _ga | Google Analytics | Tells one visitor from another, so we can count visitors rather than page loads. Analytics. | 2 years |
| _ga_<ID> | Google Analytics | Keeps track of a visit, such as which pages were viewed in one session. Analytics. | 2 years |
| _gcl_au | Google Ads | Connects a click on one of our Google ads to an enquiry, so we know if the ad worked. Advertising. | 90 days |
| _fbp | Meta Pixel | Recognises your browser so Meta can measure our ads and show them to people who have visited. Advertising. | 90 days |
| _fbc | Meta Pixel | Records that you arrived by clicking one of our ads on Facebook or Instagram. Advertising. | 90 days |
Google and Meta may also use cookies on their own websites, under their own policies. You can control the ads you see in your Google My Ad Center and Meta ad preferences, and opt out of Google Analytics on every site with Google’s browser add-on.
Who we share it with
We only share personal information with organisations that help us run the business, and only what they need:
- Website hosting: Vercel Inc., which hosts this site.
- Analytics: Google, which provides Google Analytics, if you agree to analytics cookies.
- Advertising: Google (Google Ads) and Meta Platforms (Facebook and Instagram), if you agree to advertising cookies and while we are running ads. For information collected by the Meta Pixel, we and Meta are jointly responsible for collecting it and passing it to Meta; Meta is then responsible for how it uses it.
- Email and form delivery: our email provider, and a form-delivery service that passes contact form messages to our inbox.
- Accounting and payments: the software and payment providers we use for invoices and payments.
- Platforms used for your project: for example WordPress hosts, Shopify, Wix, Framer, Vercel or Supabase, which hold information you or your customers enter into your website.
- Professional advisers such as accountants and lawyers, and authorities where the law requires it.
International transfers
We work from the United Kingdom and Australia, so your information may be accessed from Australia. Some of our providers, including our hosting provider, are based in the United States. When personal information leaves the UK, we make sure the transfer is protected as UK law requires. Google and Meta, which provide our analytics and advertising tools, also process information in the United States. In each case we rely on recognised safeguards, such as the UK International Data Transfer Agreement or Addendum, or the UK Extension to the EU–US Data Privacy Framework where a provider is certified.
Data we handle for clients
When we build or look after a website that collects information about your customers, such as orders, bookings, enquiries or accounts, you are the controller of that information and we act as your processor. We only use it to provide our services to you, on your instructions, keep it secure and confidential, and help you respond to requests from your customers. We are happy to sign a data processing agreement on request.
How long we keep it
- Enquiries that do not lead to work: up to two years, then deleted.
- Client records, including contracts and invoices: six years after the end of the financial year they relate to, as UK company law requires.
- Logins and access to your accounts: only for as long as we need them. We remove our access when our work ends, or earlier if you ask.
- Website request logs: kept by our hosting provider for a limited period for security and troubleshooting.
- Google Analytics data: no longer than 14 months, then deleted automatically. Cookie lifetimes are listed in the table above.
Keeping it secure
We use well-established providers, encrypted connections, strong unique passwords, two-factor authentication where it is available, and limit access to the people who need it. No system is perfectly secure, but if we discover a breach that puts your information at risk, we will tell you and the relevant regulator where the law requires it.
Your rights
Under UK data protection law you can ask us to:
- give you a copy of the personal information we hold about you;
- correct anything that is wrong or incomplete;
- delete your information, where we have no good reason to keep it;
- restrict or object to how we use it, including stopping any marketing at any time;
- withdraw consent you have given, such as for analytics or advertising cookies, using the Cookie settings link at the bottom of every page;
- transfer information you gave us to another organisation, where that applies.
If you are in Australia, you can ask to access and correct the personal information we hold about you under the Australian Privacy Principles. Contact us using the details below. We will reply within one month, and there is no charge in most cases.
Changes to this policy
If we change how we handle personal information, we will update this page and the date at the top. For significant changes that affect clients, we will tell you directly.
Contact and complaints
Questions or requests about your information: email hello@wilsonswebsites.com, or write to Totomize Ltd, 3rd Floor, 86–90 Paul Street, London EC2A 4NE.
If you are unhappy with how we have handled your information, please tell us first so we can put it right. You can also complain to the UK Information Commissioner’s Office at ico.org.uk, or, in Australia, the Office of the Australian Information Commissioner at oaic.gov.au.
Wilson's Websites is a trading name of Totomize Ltd, registered in England and Wales, company number 16345582. Registered office: 3rd Floor, 86–90 Paul Street, London EC2A 4NE.