Privacy Policy

Last updated: 2026
Effective date: 2026

1. Who we are and how to reach us

Web Specification Studio is the controller of the personal data described in this policy. This means we decide why and how your personal data is processed.

Data Protection Officer. We have assessed our processing activities and determined that we are not required to appoint a Data Protection Officer under Article 37 of the GDPR. Direct all privacy enquiries to [email protected].

2. Scope of this policy

This policy applies to personal data we process when you visit our website, contact us through a form, email, or phone, subscribe to our newsletter, apply for a job with us, or engage us as a client.

Where we act as a processor, not a controller. When we build, host, or maintain a website or application for a client, we process end-user data on that client's instructions and under a written data processing agreement. In that context the client is the controller and their privacy policy governs. This policy covers only data we control ourselves.

3. Personal data we collect

3.1 Data you provide to us

• Name, email, phone, company name, project description when you submit a contact or quote form.
• Email address when you subscribe to our newsletter.
• Name, contact details, CV, cover letter, work history when you apply for a role.
• Billing contact, company details, payment information when you become a client.
• Contents of your correspondence with us.

3.2 Data collected automatically

IP address; browser type and version; operating system and device type; screen resolution; pages viewed and time spent; referring URL; approximate geographic location derived from IP (country/city level); and interaction events such as clicks and scroll depth. Details of the specific cookies and similar technologies used are in our Cookie Policy.

3.3 Data we do not collect

We do not knowingly collect special category data under GDPR Article 9 or sensitive personal information as defined by the CPRA, through this website. Please do not include such information in a contact form or email to us.

We do not collect payment card numbers directly. Payments are handled by our payment processor, which processes card data as an independent controller.

3.4 CPRA statutory categories (for California residents)

California law requires disclosure by statutory category. In the twelve months preceding the date of this policy, we have collected identifiers (name, email, IP), customer records (billing details), commercial information (transaction history), internet activity (pages viewed, interaction events), approximate geolocation, and professional information (if applying for a role).

Sale and sharing. We serve personalised ads through Google AdSense. In the preceding twelve months, we have shared personal information (internet activity, IP address, device information) for cross-context behavioural advertising. You can opt out of this sharing by clicking the "Do Not Sell or Share My Personal Information" link in our footer, or by using the Global Privacy Control signal in your browser. We do not sell personal information for monetary value, and we do not sell or share the personal information of minors under 16.

4. Why we process your data, and our legal basis

Under the GDPR and UK GDPR we must have a lawful basis for every processing activity. We process your data to respond to enquiries (prior to entering a contract), deliver contracted services (performance of a contract), meet statutory financial obligations (legal obligation), send marketing communications (consent or legitimate interest), and secure our site (legitimate interest).

Where we rely on consent, you can withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before you withdrew.

5. Who we share your data with

We share your data with processors acting on our instructions (hosting providers, email providers, analytics, payment processors) bound by written data processing agreements. We also share data with professional advisers or public authorities where legally required.

6. International transfers

Some providers process data outside the EEA and the UK. Where that happens, we rely on an adequacy decision, Standard Contractual Clauses, or another safeguard permitted by GDPR Chapter V.

7. How long we keep your data

We retain contact enquiries for 12 months, client records for statutory accounting periods (typically 7 years), analytics and server logs for up to 14 months, and cookie consent records for 12–24 months as required by law.

8. Your rights

You can exercise any right by emailing [email protected]. We will ask for enough information to verify your identity before we act.

Depending on your jurisdiction (e.g., GDPR, CPRA, PIPEDA, LGPD), you have the right to access, rectify, delete, restrict, or port your personal data. You also have the right to withdraw consent and object to processing based on legitimate interest.

California Residents: You have the right to know the specific pieces of information we collect, the right to delete, the right to correct, and the right to opt out of the sharing of personal information for cross-context behavioural advertising.

9. Security

We apply technical and organisational measures appropriate to the risk, including TLS encryption, encryption at rest for backups, role-based access control, and logging. No system is completely secure, but we take data protection seriously.

10. Automated decision-making and profiling

We do not make decisions about you based solely on automated processing that produce legal effects. However, our advertising partner (Google AdSense) uses automated processing of your internet activity to serve personalised ad selections. We do not build behavioural profiles ourselves, but we disclose your data to Google for this purpose when you consent.

11. Cookies

Cookies and similar technologies are covered in full by our Cookie Policy, which forms part of this policy.

12. Changes to this policy

We review this policy at least annually and whenever our processing changes materially. The "Last updated" date at the top always reflects the current version.