Your privacy, plainly explained

Who we are

Jones Digital is a web design and brand identity studio working with businesses across South Wales and remotely in the UK. Jones Digital is a sole trader business, and for the purposes of UK data protection law the data controller responsible for your personal information is Jones Digital.

That means we decide what information is collected, why it is collected and how it is handled — and we are the people accountable for it. There is no separate parent company or group of companies involved.

This policy covers this website and any personal information you provide to us through it, by email, by phone, or in the course of discussing and delivering a project with us.

What we collect

We only collect what you choose to give us, plus a small amount of technical information that is recorded automatically. There is nothing on this site that gathers information about you without your knowledge.

In practice there are three routes: forms on this website, direct contact by email or phone, and analytics if you have accepted cookies.

Information you give us

When you use the contact form or the enquiry form to book a consultation, we collect:

• Your name
• Your business name
• Your email address
• Your phone number
• The service you are interested in
• Your message — whatever you tell us about your project

Of those, only your name, email address and message are required — everything else is optional, and you can send an enquiry without giving a phone number or business name if you would rather not.

If you email, call or message us

If you contact us directly rather than through the website, we hold whatever that conversation contains — your contact details, the contents of your emails or messages, and any files you send us such as logos, images, brand assets or written content for a project. Please only send us what we need; there is no reason to send us identity documents, financial details or anything sensitive.

If you leave a review

The review form collects your name, business name, email address, your role or job title, the project you worked with us on, a star rating and the text of your review. Reviews are published on this website with the name, business, role and project details you supply — so please only include information you are happy to see published. Your email address is never published.

You can ask us to amend or remove a published review at any time by emailing us, and we will do so promptly. We do not edit the substance of a review to change what it says.

Information collected automatically

We only collect information about your visit if you allow it. We use Google Analytics 4 to understand how visitors use this website — which pages are read, how people arrive, and where they tend to lose interest. It tells us nothing about who you are. Analytics is held back until permission allows it, and how the banner behaves depends on where you are: in the UK, the EEA and Switzerland, and in the US states that require it, nothing is collected until you actively agree. Elsewhere it may run with a standing option to opt out, which is always available in the footer.

If you refuse, nothing about your visit is recorded — not your pages, not your session, not even anonymously. Refusing costs you nothing, because no part of this site depends on analytics. Our servers do keep standard technical logs — such as the request made and the time it was made — for security and troubleshooting, and these are kept separately from anything that identifies you.

We have not enabled Google Signals or any advertising features within Analytics, so your data is not linked to a Google account or used to personalise adverts. It is reported to us in aggregate rather than as individual visitor profiles.

We do not collect special category information (such as health, religious or political data), we do not knowingly collect information from children, and we do not use any automated decision-making or profiling that would affect you.

How we use it

We use your information only to:

• Respond to your enquiry and arrange a free consultation
• Prepare a proposal, quote or scope of work for you
• Deliver and manage a project if you go on to work with us — including design work, copy, hosting setup and support
• Publish a review if you choose to leave one
• Understand how the website is used, so we can improve it
• Meet our legal and accounting obligations, such as keeping records of what we have invoiced

We do not sell your personal information, and we do not share it with anyone for marketing purposes. We do not use your information to build advertising profiles, and we do not run adverts on this site that track you across other websites.

If you become a client, we will hold the working information a project needs — briefs, content, feedback and files you share with us. That material is used to deliver your project and may be shown to you inside the Jones Digital Hub. We will not publish it, or use it as a portfolio example, without asking you first.

Our lawful basis

Under UK GDPR we must have a lawful basis for processing your information. The bases we rely on are:

• Consent — for analytics cookies, and for publishing a review you have submitted. You can withdraw consent at any time.
• Legitimate interests — for responding to an enquiry you have sent us, and for keeping the site secure and working.
• Contract — where you have engaged us to carry out work, to deliver that work and manage the project.
• Legal obligation — to keep records such as invoices where the law requires it.

Where we rely on legitimate interests, we have weighed our interest in running the business against your rights and expectations, and concluded that replying to someone who has contacted us is something they would reasonably expect. You can object to processing on this basis — see Your rights below.

Cookies & analytics

There are two kinds of cookie on this site. A consent cookie records what you decided, so you are not asked again on every page; it holds no personal information. Analytics cookies from Google Analytics 4 tell us which pages are being read. These are only set once permission allows it, and are switched off again if you withdraw your choice.

You can change or withdraw your decision at any time using the Cookie settings link in the footer of every page. We do not use advertising cookies, remarketing pixels, session recording or cross-site tracking, and nothing on this site follows you to other websites.

Some parts of the site load content from Google — fonts, the embedded videos and the booking link. When those load, Google may set its own cookies, which are outside our control. If you want to limit those, blocking third-party cookies in your browser is the most effective way.

We do not use advertising cookies, remarketing pixels, session recording or cross-site tracking, and nothing on this site follows you to other websites. If we reintroduce analytics, we will install a consent banner first and update this policy before any data is collected.

For a full breakdown of what is and is not set, including the third-party cookies that come from Google, see our Cookie Policy.

Who else sees it

We keep the number of third parties involved to a minimum. Where your information is handled by someone other than us, it is limited to what is necessary:

• Our website hosting and form provider, which processes form submissions on our behalf, stores them securely and delivers them to us by email. They act as a processor on our instructions and do not use your information for their own purposes.
• Google Calendar, if you book a consultation directly through the booking link. The appointment details you enter there are held by Google and shared with us so we know when to meet you.
• Our email provider, which transmits and stores the emails you send us.
• Our accountants, where records containing your details are needed for tax and statutory purposes.

We do not sell, rent or trade your personal information, and we do not pass it to anyone for advertising. The only other circumstance in which we would share it is if we were legally required to — for example in response to a valid request from a public authority — or where it was necessary to establish or defend a legal claim.

This website also loads Google Fonts and embeds videos from YouTube. When those load, the provider may see your IP address and set its own cookies, over which we have no control. YouTube videos are embedded in a privacy-enhanced mode where available. Please see Google's own privacy policy for details.

Transfers outside the UK

Some of the providers listed above are based in, or store data in, countries outside the UK — most commonly the United States. Where that happens, your information is still protected.

Transfers are covered by appropriate safeguards recognised under UK data protection law, such as the UK International Data Transfer Agreement, the UK GDPR addendum to standard contractual clauses, or the UK–US Data Bridge where the provider is certified under it. Where a provider relies on safeguards of this kind, we have taken reasonable steps to confirm they are in place.

You can ask us for more detail about the safeguards used for a particular provider by emailing us at the address in the Contact us section below.

How long we keep it

We do not keep information longer than we need it. We would rather hold less than keep things “just in case”.

• Enquiries that do not lead to a project: kept for up to 24 months so we have context if you come back to us, then deleted.
• Enquiries that we decide are not a fit, or that are clearly spam: deleted within 30 days.
• Client project records, files and correspondence: kept for the duration of the project and for six years afterwards, in line with our accounting and legal obligations.
• Invoices and financial records: kept for six years, as UK tax law requires.
• Published reviews: kept for as long as they remain on the website, or until you ask us to remove them.
• Server and security logs: kept for a short period, typically no more than 90 days.

When a retention period ends, we delete the information or remove anything that identifies you from it. Where information sits with a provider on our behalf, we ask them to delete it or rely on the retention settings configured on our account.

Your rights

Under UK GDPR you have the right to:

• Access the personal information we hold about you — you can ask for a copy of what we have, and we will provide it free of charge.
• Ask us to correct anything that is inaccurate or incomplete.
• Ask us to delete your information, where we have no overriding legal reason to keep it. If we cannot delete something — an invoice we are required to keep, for example — we will tell you why.
• Object to how we use your information, where we rely on legitimate interests as our basis.
• Ask us to restrict processing — to hold information but stop using it — while a question about it is resolved.
• Withdraw consent at any time, where consent is our basis for processing. This applies to a published review — and, if we ever run analytics again, to that too.
• Receive your information in a portable, machine-readable format, or ask us to pass it to another organisation where that is technically possible.

None of these rights are absolute — they apply subject to conditions, and in some cases we may have a lawful reason to keep or continue using your information. If we refuse a request, we will explain our reasoning rather than simply declining.

To exercise any of these, email us at contactus@jonesdigital.co. We will respond within one calendar month. If your request is complex we may extend that by a further two months, and we will tell you if so. There is no charge. We may ask you to confirm your identity before we act, so that we do not hand information to the wrong person.

Marketing

We do not run a mailing list and we do not send marketing emails. If you send us an enquiry, we will reply to that enquiry and follow up about your project — we will not add you to anything.

If that ever changes, we will only contact you for marketing where you have actively opted in, every message will carry a clear way to unsubscribe, and opting out will not affect how we handle a project you have with us.

Security

We take reasonable technical and organisational measures to protect your information. In practice that means:

• Encrypted connections (HTTPS) across the whole website, so information you send us is not readable in transit.
• Access controls on the accounts and services that hold your information, including strong passwords and two-factor authentication where available.
• Collecting only the information we actually need, and deleting it when the retention period ends.
• Using established providers for hosting, email and analytics rather than running our own infrastructure.

No method of transmission or storage is completely secure, so while we take this seriously we cannot guarantee absolute security. Please bear that in mind when deciding what to send us — we will never need your bank details, passwords or identity documents as part of an enquiry.

If something goes wrong

If we became aware of a personal data breach that posed a risk to your rights, we would act quickly: contain it, assess what had happened and who was affected, and put it right.

Where the law requires it, we would report the breach to the Information Commissioner's Office within 72 hours of becoming aware of it, and where there was a high risk to you personally we would also tell you directly, explaining plainly what had happened and what you could do about it.

Complaints

If you are unhappy with how we have handled your information, please contact us first so we have the chance to put it right. We will acknowledge your complaint, look into it properly and come back to you with what we have found.

If you are not satisfied with our response, you have the right to complain to the Information Commissioner's Office (ICO), the UK regulator for data protection. You can do so at ico.org.uk or on 0303 123 1113. You do not need our permission to do so, and we will not treat it as a reason to stop working with you.

Changes to this policy

We may update this policy from time to time — for example if we introduce a new tool, change a provider, or if the law changes. When we do, we will update the “last updated” date at the top of this page.

Where a change is significant — a new category of information, a new third party receiving your data, or a change to what we are allowed to do with it — we will say so clearly rather than quietly amending the page. If you are an existing client, we will tell you directly.

This policy was last reviewed on 18 September 2026.

Contact us

For any question about this policy or about the personal information we hold, contact us at:

You can also use the contact page if you would prefer to write to us that way. For anything relating to your data — a request, a question, or a concern — email is the quickest route, because it gives us a written record to work from.