Privacy notice

1. Who is responsible for your data

The person or company named on the legal business details page operates Millwards Digital and millwards.shop and is responsible for deciding how personal information collected through this website is used. That page also gives the geographic service address. For privacy questions or requests, email support@millwards.shop.

2. Information collected

When you use the enquiry form, Millwards Digital receives the name, business name, email address, optional telephone number, current online presence, package interest and message that you provide. A copy is sent by email and stored securely so we can manage your enquiry, follow-up and project.

When you request a free website plan, Millwards Digital receives the name, business name, email address, business type, optional service area, current online presence, selected goals, visitor actions and features that you provide. It also records the resulting fixed-template plan and, when present in the page link, limited campaign labels such as source, medium and campaign. These details are stored securely, used to create and email the plan you requested, and shown in the private dashboard so the enquiry can be understood. The tailored plan is sent to the email address you provide rather than displayed on the website.

The optional email-list checkbox on the free planner and enquiry form is separate and starts unticked. If you select it, we record the applicable consent wording version, request time and source, then email a signed confirmation link. No marketing sequence is scheduled unless you actively confirm on the confirmation page. Confirmed subscribers receive website tips, examples and Millwards Digital service or package offers: the first three emails are scheduled over nine days, followed by no more than two occasional emails per month. Every marketing email provides an unsubscribe route. The requested plan or response to an enquiry is provided whether or not you select or confirm marketing.

Before you buy a listed package, the project brief asks for the contact and business details, services, up to three website goals, customer actions and requested features, optional public website contact details, branding, design preferences, reference links, notes, optional add-ons and required domain route that you provide. If you select managed business email, it also records the requested mailbox names and derives their addresses from the selected domain. If you say you have a logo, you can upload up to five PNG, JPG or WebP logo files; they are checked, stored outside the public website and attached to the private project brief. This information is used to prepare a useful first concept and organise the services you order without repeatedly asking for the same details.

If you use the domain search, the domain wording and extensions are sent to the domain provider for current availability and pricing. Your other project-brief answers are not included. A short-lived reference and the result may be stored with your brief so availability and price can be checked again before payment.

If you use a domain you already own, the checkout records the domain, where you manage it, your preferred connection route and whether domain-based email is already in use. A public DNS check may inspect the domain’s nameserver and mail records to suggest the current provider and help avoid interrupting email. If you select secure Hostinger access, it also records the Hostinger account email needed to request limited shared access. Millwards Digital does not ask for or store registrar passwords, payment details, API keys, recovery codes or two-factor authentication codes.

When you continue to pay, Stripe’s secure form is displayed within the Millwards Digital checkout and collects the billing address, email and payment information needed to take the initial payment and manage the selected recurring services. It does not ask for a project-contact telephone number or repeat the custom domain-owner questions. Millwards Digital receives order and customer details, Stripe customer, checkout, schedule, subscription and invoice identifiers, and payment or subscription status. Millwards Digital does not receive or store your full card number or card security code.

If you select a new domain, we collect the registrant type, authorised contact’s name, telephone number and region, the legal organisation name where applicable, and evidence that you accepted the Domain Registration & Renewal Terms. After payment is confirmed, we combine those details with the project contact email and billing address supplied through Stripe and send the information needed to Hostinger to register the domain. This creates the customer’s registration contact but does not create or provide access to Millwards Digital’s Hostinger account. We retain the project, registration, order, subscription and consent records needed to provide the service, but do not keep a separate copy of the Stripe billing address. Stripe and Hostinger retain information under their own privacy terms and legal duties.

The hosting service may also create routine technical logs containing information such as an IP address, browser type, requested page, time and basic error or security information. The enquiry and checkout forms use limited technical information to prevent spam, repeated submissions, misuse and security problems. These measures help keep the website reliable and secure.

The site also sends a small, first-party analytics message containing only the page path, calendar date, broad device category and referring website’s hostname, if available. When someone completes a free website plan, sends an enquiry or opens Stripe checkout, a separate aggregate message records the action, the Millwards Digital page where that visit began and a broad channel such as organic search, referral or direct. It does not contain the person’s name, email, form answers or payment details. To estimate unique visitors and visits without a cookie, the server immediately combines a shortened network range with a broad browser and operating-system category and transforms them using a private rotating key. Only the resulting pseudonymous code is stored; the raw IP address and user-agent string are not added to the analytics record. The code changes each month, is removed after 31 days and cannot be used to follow someone across websites. Requests expressing Global Privacy Control or Do Not Track are not counted. Routine hosting logs are separate from these visit counts.

3. How and why it is used

• To read, manage and respond to your enquiry.
• To create, store and email the free website plan you request.
• With confirmed consent, to send website tips, examples and Millwards Digital service or package offers within the frequency described when you sign up.
• To recommend a suitable service, prepare a quote or fulfil the package you order.
• To use your project brief, supplied logo files and domain choice to prepare the requested first concept and organise delivery.
• To identify, connect and maintain an existing domain through the safe connection route you selected, while protecting existing email where applicable.
• To take payments, administer monthly care, managed email and annual domain-billing subscriptions, send order confirmations and receipts, and manage billing issues.
• To set up and support selected business email mailboxes after the domain is active.
• To understand, in aggregate, which pages and referral sources lead to useful actions and improve the website.
• To prevent spam, misuse and security problems.
• To keep necessary business records and meet legal obligations.

Creating and sending a requested website plan, responding to an enquiry and preparing a requested quote are steps taken at your request before a possible contract. Marketing email relies on the separate consent you request and then confirm; you can withdraw it at any time without affecting the plan already sent. Order, payment and subscription information is used to enter into and perform the service contract you request. Cookie-free aggregate measurement, spam prevention, security and routine service administration rely on Millwards Digital’s legitimate interests in operating and improving a safe, useful website. Records that must be kept by law rely on the relevant legal obligation. Millwards Digital does not add an ordinary enquiry or customer to its marketing list automatically.

4. Who receives it

Information is shared only where needed to provide the service. Our email and hosting providers process requested plans, consent-confirmation messages, permitted marketing emails, enquiries, order confirmations, project briefs and uploaded files, which are held in access-controlled storage. Stripe processes checkout and billing information. Hostinger receives domain searches, registration details, access-request details and mailbox names when those services are requested; another current domain provider receives only the information needed for a secure delegated-access invitation or approved connection. Mailbox setup is completed after the domain is active. Cookie-free visit counts are collected directly by Millwards Digital rather than sent to an external analytics service.

Information may also be shared with professional advisers where necessary and public authorities where disclosure is legally required. Providers acting on Millwards Digital’s behalf are expected to protect the information and use it only for the agreed purpose.

5. International processing and automated checks

Stripe and Hostinger operate internationally and explain that information may be processed outside the United Kingdom. Where transfer safeguards are legally required, their published arrangements include adequacy decisions, approved contractual clauses with the UK transfer addendum, or another lawful transfer mechanism. You can read the current Stripe privacy policy and Hostinger privacy policy.

Millwards Digital does not use information collected by this site to make decisions with legal or similarly significant effects solely by automated means. Automated checks may be used for domain availability, payment or fraud screening, spam prevention and security. Stripe and domain providers operate some of those checks under their own terms; contact support@millwards.shop if a result appears wrong or you need it reviewed.

6. How long it is kept

Information is kept only for as long as needed for the purpose described above. A pending logo upload expires if it is not attached to a checkout attempt. Logo files attached to an incomplete, unpaid brief are ordinarily removed after 7 days, and the remaining incomplete brief is ordinarily deleted after 30 days. An enquiry or free website-plan lead that does not become a project will ordinarily be removed from our business records within 24 months of the last meaningful contact. An unconfirmed email-list request expires after 30 days. A confirmed subscriber record is kept while the subscription remains active; completed, cancelled and exhausted automated-delivery records are ordinarily removed after 12 months. When someone unsubscribes, pending emails are cancelled and a one-way keyed suppression code may be retained for as long as reasonably needed to honour that choice without retaining another marketing copy of the address. A brief linked to a paid project and its supplied assets are retained with the related customer and contract records for as long as needed to deliver and document that service. Contract, customer, payment and tax records may need to be kept longer where the law requires it. Pseudonymous visitor codes are kept for no more than 31 days; anonymous aggregate page and conversion counts are ordinarily kept for up to 24 months so longer-term trends can be compared.

To process orders, renewals and domain services reliably, we keep limited records of payment and registrar events, consent, order status and service details. These may include customer and subscription identifiers, name, email, business name, package, add-ons, mailbox names, existing-domain provider and connection status, amount, currency, status and event time. We do not keep full card details, raw Stripe event data, registrar credentials or a separate copy of your billing address. Registrar-agreement evidence and other records are kept for the periods described above or required by the registrar.

7. Cookies, analytics and local storage

The public website does not set analytics or advertising cookies and does not store an analytics identifier in your browser. Its first-party, cookie-free analytics estimates visitors and visits using the short-lived pseudonymous code described above and cannot be used to follow you between websites. Browser session storage remembers that the opening cinematic has already been shown and, for up to 30 minutes, keeps only the Millwards Digital starting-page label and broad channel used for aggregate conversion reporting. Those values do not identify you, are not shared with an advertising platform and disappear when the browser session ends. If non-essential tracking is introduced, this notice and any consent controls will be updated first.

8. Your rights

UK data protection law may give you rights to ask for access to your information, correction, deletion, restriction, objection or portability. These rights are not absolute and the response depends on the circumstances. To make a request, email support@millwards.shop.

You can object to direct marketing or withdraw email consent at any time by using the unsubscribe link in a marketing email or contacting support. Withdrawal does not affect the lawfulness of messages sent before it was received, and it does not prevent Millwards Digital from sending a plan or service message you specifically request later.

You may also complain to the UK Information Commissioner’s Office. Information about doing so is available at ico.org.uk/make-a-complaint.

9. Security and changes

Reasonable technical and organisational measures are used to protect information, but no internet service can promise absolute security. This notice may be updated when the website, providers or legal requirements change. The latest version will remain on this page with its update date.