What we do with your information.

Who we are

Rubber Duck Solutions makes and looks after websites for small businesses in the United Kingdom. We are the data controller for the personal data described in this notice.

Contact us about privacy at [email protected]. We answer every message about your data.

Ask us for our postal address and we send it to you.

What we collect

When you make an account

• Your e-mail address.
• Your first name and last name.
• Your password. We do not keep the password itself. We keep a one-way hash of it.
• The date you made the account.

When you sign in with Google, Microsoft or Facebook

We ask the provider for your e-mail address and your name only. We keep an identifier that the provider gives us for your account. We do not receive or keep your password for that provider.

When we work for you

We use the contact details and the content that you send us to design, build and look after your website.

When you send us a message with the contact form

The contact form is open to everyone. You do not need an account to use it. We keep:

• Your name, your e-mail address and your subject.
• The message that you write.
• The date and the time that you sent it.
• Your IP address. We keep it for a short time to stop abuse of the form.

We use your e-mail address to answer you. We also send you one automatic e-mail that confirms we received your message. We do not add you to a mailing list.

If you are signed in, we record which account sent the message.

When you use the site

Our server writes a log of each request. The log holds the page address, the result code and the time the request took. The log does not hold your IP address.

The contact form is the only part of the site that records your IP address.

We do not use analytics. We do not use advertising. We do not use third-party trackers. We do not build a profile of you and we do not make automated decisions about you.

Why we use your data, and our lawful basis

Purpose	Lawful basis
Make and manage your account	Contract
Sign you in and keep you signed in	Contract
Confirm your e-mail address and reset your password	Contract, and our legitimate interest in account security
Design, build and look after your website	Contract
Answer your questions and give support	Contract, and our legitimate interest in helping people who contact us
Receive and answer a message from the contact form	Our legitimate interest in answering people who write to us. Contract, if you write to us about work we do for you
Confirm to you that we received your message	Our legitimate interest in telling you that your message arrived
Stop abuse of the contact form	Legitimate interest in the security of our service
Keep the site safe and stop abuse	Legitimate interest in the security of our service
Keep records for tax and accounts	Legal obligation

We do not use your data for marketing.

Sign-in with another provider

You can sign in with Google, Microsoft or Facebook. This is optional. You can use an e-mail address and a password instead.

If you use one of these providers, your browser goes to the provider to sign in. The provider then tells us your e-mail address, your name and an account identifier. The provider decides what it collects while you are on its own pages. We do not control that. Read the provider's own privacy notice:

• Google Privacy Policy
• Microsoft Privacy Statement
• Meta Privacy Policy

We only ask each provider for your e-mail address and your basic profile. We do not ask for your contacts, your files or your posts. We do not write anything to your account with the provider.

Cookies

We use two cookies. Both are necessary to sign you in and keep you signed in. We do not use advertising or analytics cookies, so we do not ask for cookie consent.

The cookie notice gives the full detail.

Who else sees your data

We do not sell your data. We do not share it for advertising.

• Sign-in providers. Google, Microsoft or Facebook, but only if you choose to sign in with them.
• Our e-mail provider. We send account e-mails, such as your verification code, through an e-mail delivery service. We also send the e-mail that confirms we received your contact form message. It processes your e-mail address and your name to deliver the message.
• Our hosting provider. Our server and our database run on hosting infrastructure. The provider stores the data but does not use it.
• Professional advisers and authorities. We share data if the law tells us to.

We do not load fonts, scripts or images from other companies. Everything on our pages comes from our own server.

Where your data goes

We keep your data in the United Kingdom or the European Economic Area where we can.

The sign-in providers are United States companies and may process your data outside the UK. They use the UK extension to the EU Standard Contractual Clauses, or an equivalent safeguard, for these transfers. This applies only if you choose to sign in with them.

How long we keep your data

Data	We keep it for
Your account details	While your account is open. We delete it when you close the account.
An account you never confirmed	30 days. We then delete it automatically.
Sign-in sessions	90 days after you last use the session. We then delete it automatically.
E-mail verification codes	Until you use the code, or until we delete the unconfirmed account.
Password reset links	24 hours. We then delete them automatically.
Sign-in state tokens	10 minutes. We then delete them automatically.
Messages from the contact form	24 months after you send the message. We then delete them automatically.
The IP address with a contact form message	30 days. We then erase it automatically and keep the rest of the message.
Server request logs	Up to 30 days.
Records of work and payment	6 years after the end of the tax year. UK tax law requires this.

How we protect your data

• The site uses HTTPS. Your data is encrypted while it moves.
• We store passwords as Argon2 hashes. We cannot read your password.
• Session cookies are marked Secure, HttpOnly and SameSite=Lax.
• Only staff who need access to your data can get it.

No service is completely safe. If a breach puts your rights at risk, we tell you and we tell the Information Commissioner's Office.

Your rights

UK data protection law gives you these rights:

• Access. Ask for a copy of your data.
• Correction. Ask us to correct data that is wrong.
• Deletion. Ask us to delete your data. The data deletion page gives the steps.
• Restriction. Ask us to stop using your data while we check a problem.
• Portability. Ask for your data in a form you can move to another service.
• Objection. Object to use that we base on legitimate interest.

To use a right, send a message to [email protected]. We answer in one month. There is no charge.

You can also close your account from your account page.

How to complain

Tell us first. We try to put the problem right.

You can also complain to the Information Commissioner's Office, the UK data protection regulator.

• Website: ico.org.uk/make-a-complaint
• Telephone: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Children

Our service is for businesses. It is not for children. Do not make an account if you are under 16.

Changes to this notice

We can change this notice. The date at the top shows the last change. If a change is important, we tell you by e-mail or on the site.