Privacy Policy
Last updated: 15 October 2026
1. Who we are
BWAR Limited (“BWAR”, “we”, “us”) is a digital agency based in Stoke-on-Trent. We build and look after websites, host and manage client websites, and build software. For the personal information described in this policy we are the controller, which means we decide why and how it is used. The one exception is client website data, explained in section 10.
| Company | BWAR Limited, registered in England and Wales, company number 8933243 |
|---|---|
| Address | 51 Upper Huntbach Street, Hanley, Stoke-on-Trent, ST1 2BX |
| hello@bwar.co.uk | |
| Phone | 01782 906093 |
| Data protection contact | Craig Powell, Managing Director, at hello@bwar.co.uk |
2. What this policy covers
This policy explains what personal information we collect about you, why we use it, who we share it with, how long we keep it, and what rights you have. It applies to visitors to bwar.co.uk, to people who contact us or become our clients, and to people we meet or email while running our business. It does not cover our staff, who have a separate privacy notice.
We follow the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (as amended, including by the Data (Use and Access) Act 2025) and the Privacy and Electronic Communications Regulations (PECR). We use only the information we need, keep it accurate, keep it no longer than necessary, and protect it.
In this policy, “personal information” means anything that identifies you or can be linked to you, such as your name, email address or IP address.
3. The information we collect and why
The law says we need a lawful basis for every way we use your information. This table shows each, with the basis we rely on.
| Who you are | What we collect | Why we use it | Lawful basis |
|---|---|---|---|
| Someone who contacts us | Name, email, phone number, company, and what you tell us in a form, email or call | To reply, give you a quote and keep a record of the conversation | Legitimate interests (answering enquiries), or taking steps at your request before a contract |
| A client or prospect | Contact details, company details, project and website details, our correspondence, notes in our CRM | To provide our services and manage our relationship with you | Contract; legitimate interests |
| A client we bill | Billing name and address, invoices, payment status and history | To invoice you, take payment, keep accounts and meet tax rules | Contract; legal obligation |
| Someone we meet online | Meeting details (see section 4) | To arrange and run Teams meetings | Legitimate interests |
| A visitor to our website | IP address, device and browser type, pages viewed, how you reached us, and the information Google reCAPTCHA uses to check you are not a bot | To keep the site working and secure, protect our forms from spam, and understand how the site is used | Consent for analytics cookies; legitimate interests for security |
| A newsletter or marketing subscriber | Name, email address, preferences, whether you open or click our emails | To send you news and offers | Consent; legitimate interests for business-to-business contact (section 9) |
| A customer of our hosting or care plans | Support requests, account and login records, server and security logs | To host, support and protect your site | Contract; legitimate interests |
| Someone who phones or chats with us | Your voice and the recording of the call, the number you call from, chat messages and anything you tell us | To keep an accurate record, answer your questions, resolve disputes and train our team | Legitimate interests |
We do not use your information to make automated decisions about you that have legal or similarly significant effects. We do not sell personal information.
Some information may also come from other places: your employer when they appoint us, public sources such as Companies House, or a client who gives us your details so we can work with you on their website. We tell you if we receive your information this way.
4. Meetings, calls and chat with us
When we arrange a Microsoft Teams meeting with you, we keep a record of it. This includes the date and time, the joining link, your name and email address, and whether you accepted or declined the invitation.
We use this to arrange and run the meeting and to keep a record of our dealings with you. Our lawful basis is our legitimate interests in managing our client relationships.
The record is held in our own systems. Microsoft provides Teams and acts as our processor. We do not record meetings unless we tell you at the start and give you the chance to object. We keep meeting records for 12 months after the meeting ends, then delete them, unless they form part of a wider client record or we need them for legal reasons.
Calls and chat
We record phone calls and keep a transcript, so we have an accurate record of what was said and agreed, can resolve disputes and can train our team. We tell you at the start of a call that it is being recorded.
Our website and systems also use an AI chat assistant. We store what you type, and the provider that runs the assistant processes it on our behalf. Please do not put sensitive details, such as card numbers or passwords, into the chat. The assistant gives automated answers but does not make decisions about you that have legal or similarly significant effects, and you can ask to speak to a person at any time.
Our website also has a WhatsApp button. If you use it to message us, WhatsApp, which is owned by Meta, carries the messages under its own terms and privacy policy, and we keep the conversation as a record of our dealings with you.
We keep call recordings and chat transcripts for 12 months, unless we need them for longer to deal with a complaint or dispute.
5. Who we share your information with
We do not sell your information. We share it only with organisations that help us run our business, and only as far as they need to. Where they handle it on our behalf, they act as our processors and must follow our instructions and protect it.
| Who | What they do for us |
|---|---|
| Microsoft | Provides Microsoft 365 and Teams, which we use for meetings and some business documents |
| Our data centre and hosting providers | Supply the dedicated servers that host our websites, email and systems |
| Stripe, GoCardless and PayPal | Take card payments, direct debits and online payments |
| Xero | Holds our invoices and accounts |
| SendGrid | Sends our emails, including notifications and marketing emails |
| Provides Google Analytics, which shows us how our website is used, reCAPTCHA, which protects our website forms from spam, and Search Console, which shows us how our site appears in search results | |
| Trustindex | Displays our Google reviews on our website |
| WhatsApp (Meta) | Carries messages you send us through the WhatsApp button on our website |
| Other service providers | Tools we use from time to time to run our business, such as website, support, storage and communication services, working under our instructions |
| Our phone and AI chat providers | Run our phone system, record calls and power our AI chat assistant |
We may also share information where the law requires it, for example with HMRC, the police or a court, or to protect our rights, property or safety. If we sold or restructured our business, information could pass to the new owner, who would have to use it as described here.
6. Transfers outside the UK
Some of our providers, including Microsoft, may handle information outside the UK. Where that happens we make sure it is protected in a way the law accepts. That means the country has UK adequacy regulations, or the provider is covered by an approved arrangement such as the UK-US data bridge, or we have a written contract using the ICO’s International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses.
Some of our developers and contractors work from outside the UK. Anyone who can access personal information is bound by the same duties of confidentiality and security as our UK staff, and we only give access through safeguards that the law accepts, such as written contracts and access controls.
You can ask us for details of the safeguards for a particular provider by writing to hello@bwar.co.uk.
7. How long we keep your information
We keep information only as long as we need it for the reason we collected it, and for any period the law requires. When the time is up, we delete it or make it anonymous.
| Information | How long we keep it |
|---|---|
| Meeting records | 12 months after the meeting ends |
| Enquiries that do not become a client | 3 years after the last contact |
| Client records and correspondence | 6 years after we stop working together |
| Invoices, payments and accounting records | 6 years from the end of the financial year, as tax law requires |
| Hosting, support and security logs | 12 months |
| Website analytics data | Up to 14 months |
| Newsletter subscribers | Until you unsubscribe, then only your email address on a suppression list, so we do not email you again |
| Call recordings and chat transcripts | 12 months after the call or chat |
If we need to keep something longer, for example because of a legal claim, we keep only what is needed for that purpose.
8. Cookies and similar technologies
Cookies are small files that a website saves on your device. We use a small number on bwar.co.uk, Strictly necessary cookies keep the site working and secure, and we set these without asking. For analytics cookies we ask for your consent first, through the cookie banner, and you can change your mind at any time.
| Type | What it does | Consent needed |
|---|---|---|
| Strictly necessary | Keeps the site working, protects our forms from spam with Google reCAPTCHA, remembers the state of the WhatsApp chat button, and keeps logged-in users signed in | No |
| Analytics | Google Analytics shows us which pages are visited and how people find us, so we can improve the site | Yes |
Our cookie policy lists the exact cookies in use, who sets them and how long they last. You can also block or delete cookies in your browser settings, but parts of the site, such as our contact forms, may stop working.
We do not use cookies to track you across other websites for advertising unless you have agreed to it.
9. Email and marketing
We only send you marketing emails if you have asked for them, or if the rules allow it. You can stop them at any time.
Newsletter and mailing list: we use your consent. You can withdraw it at any time using the unsubscribe link in any email, or by emailing hello@bwar.co.uk.
Existing clients: if you have bought from us or asked us for a quote, we may email you about similar services. You can opt out at any time, and we tell you how in every message.
Business contacts: we may email people at limited companies, partnerships and other organisations about relevant services, as PECR allows, and we always include a clear way to opt out.
Tracking in emails: our marketing emails may record whether you open or click them, to help us see what is useful. Our email provider, SendGrid, does this for us. You can avoid it by turning off images in your email program.
We will never share your email address with other companies for their own marketing. If you unsubscribe, we keep your address on a suppression list so we do not email you again by mistake.
Service emails are different. We will still send you messages you need, such as invoices, renewals, security notices and replies to your questions.
10. Websites we host or manage for clients
We host and look after websites for many clients. If you use one of those websites, for example by filling in a contact form or placing an order, the business that owns the site is the controller of your information. We act only as its processor, handling it on that business’s instructions to run and secure the site.
This means we do not decide what information the site collects or how it is used. Please read that business’s own privacy policy, and contact them first if you want to see, correct or delete your information. If you contact us instead, we will pass your request on to them.
Where we act as a processor, our contract with each client covers confidentiality, security, using sub-processors, and returning or deleting data when the contract ends.
11. Keeping your information secure
We protect your information with technical and organisational measures that suit the risk:
Encrypted connections (HTTPS) on our websites and systems
Access limited to staff and contractors who need it, with individual logins
Email authentication on our domains (SPF and DKIM) to reduce forged email
Regular software updates and backups
Confidentiality terms for everyone who can see personal information
No system is completely secure. If a breach puts your rights at risk, we will tell you and the Information Commissioner’s Office as the law requires.
12. Your rights
You can ask us to do any of the following, and we will reply within one month. It is free, unless a request is clearly unfounded or excessive.
| Right | What it means |
|---|---|
| Be informed | Be told how we use your information, which is what this policy does |
| Access | Get a copy of the personal information we hold about you |
| Rectification | Have inaccurate or incomplete information corrected |
| Erasure | Have your information deleted, in some circumstances |
| Restriction | Ask us to pause using your information, in some circumstances |
| Portability | Receive information you gave us in a usable format, or have it sent to someone else, where we use it under a contract or your consent |
| Object | Object to us using your information for our legitimate interests, and to direct marketing at any time |
| Withdraw consent | Withdraw your consent whenever we rely on it, without affecting what we did before |
| Automated decisions | Not be subject to a decision made only by automated means that has legal or similarly significant effects. We do not make these |
To use a right, email hello@bwar.co.uk, call 01782 906093, or write to us at 51 Upper Huntbach Street, Hanley, Stoke-on-Trent, ST1 2BX. We may ask for proof of who you are, to protect your information.
If you are unhappy with how we have handled your information, please tell us first so we can try to put it right. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk, or by phone on 0303 123 1113.
13. Children
Our services are for businesses and are not aimed at children. We do not knowingly collect personal information from anyone under 13. If you think a child has given us their information, please email hello@bwar.co.uk and we will delete it.
14. Changes to this policy
We may update this policy when our services or the law change. The date at the top shows when it was last updated. If we make a significant change, we will tell you, for example by email to our clients or a notice on our website. Where the law requires your consent to a change, we will ask for it.
