Privacy notice
Last updated: 31 October 2026
1. Who we are
Kofy Sites ("we", "us") is the controller of the personal data described here.
Contact for privacy matters: debi@kofysites.co.uk.
2. Whose data this covers
- Local business owners and staff we may contact about a website (prospects).
- Customers who buy our website and care services, and their contacts.
- Visitors to our website and people who contact us.
3. What we collect and where it comes from
| Data | Source |
|---|---|
| Business name, trading address, business phone, business email, business type, opening hours, public photos | Google Maps / Google Business Profile, OpenStreetMap, Food Standards Agency hygiene-rating data, the business's own social pages or directory listings |
| Company status, company number, registered office, and — for companies — officers' names | Companies House (public register) |
| Public rating and number of reviews | Google Maps |
| Your name, contact details and messages | You, when you reply to us, fill in a form, call us or buy from us |
| Billing details (name, billing address, payment reference) | You |
| Enquiry form details: business name, area, business type, your name, email, phone, message, an optional Google Maps link (used only to identify your business), how you heard about us, and your marketing choice | You, via our enquiry form |
| Photos you upload with a demo request, and the opening hours, services and prices you type in | You, via our demo request form |
| Attribution data: the campaign tags in the web address (UTM parameters), the referring website and the page you were on, read only at the moment you submit the form, plus your answer to "How did you hear about us?" | You, via our enquiry form (read at submission). It is attached to your enquiry |
Where we obtained your data from public sources rather than from you, this notice is our explanation to you of that collection (UK GDPR Article 14). We give a link to it in our first contact with you.
Cookies, analytics and tracking
Our public pages store nothing on your device, and we do not use analytics, advertising or tracking tools. Our private admin area, used only by us, sets one strictly necessary login cookie.
4. Why we use it and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Identifying local businesses that may benefit from a website, building a private preview demo, and contacting the business to offer it (B2B prospecting) | Legitimate interests (Art. 6(1)(f)): growing our business by offering a relevant service to businesses in their business capacity. We use only business contact information that is already public, contact businesses a limited number of times, and you can object at any time. Ask us for a summary of our assessment. |
| Contacting limited companies or LLPs by email at business addresses | Legitimate interests (as above) |
| Contacting sole traders and partnerships by email | Only with your consent (or where you are an existing customer and did not opt out). We never send these cold. |
| Keeping a do-not-contact list, and checking numbers against the Telephone Preference Service and Corporate TPS before any marketing call | Legal obligation (PECR) and legitimate interests |
| Providing the website and services you buy, invoicing, support | Contract (Art. 6(1)(b)) |
| Keeping accounting and tax records | Legal obligation (Art. 6(1)(c)) |
| Photos you upload, and the opening hours, services and prices you give us: to build the demo website you asked for, and to show it to you | Steps you asked us to take before a contract (Art. 6(1)(b)) |
| Your confirmation that you own the photos or may let us use them (what you ticked, wording version, date and time) | Legitimate interests (being able to show we had permission to use the photos) |
| Handling your enquiry, preparing your demo or quote, and replying to you | Steps at your request before a contract (Art. 6(1)(b)); for staff of companies, legitimate interests in responding to the business enquiry |
| Sending you occasional tips and offers by email, if you ticked the optional box | Consent (withdraw any time via the unsubscribe link or debi@kofysites.co.uk) |
| Understanding which of our marketing works, using the attribution data above | Legitimate interests. Nothing is stored on your device to collect this. |
| Handling complaints and legal claims | Legitimate interests |
Photos may show people. We rely on you to have their agreement, and we'll remove any photo on request.
We do not sell personal data. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
5. Who we share it with
We use these service providers (processors), who act on our instructions:
- Website hosting and enquiry storage: Cloudflare, Inc. Enquiries are stored with access restricted to us. Cloudflare encrypts data at rest, and the copy used in our admin area is additionally encrypted.
- Email forwarding: Cloudflare, Inc. (Cloudflare Email Routing), which forwards messages sent to our @kofysites.co.uk and @kofysites.com addresses to our mailbox, hosted by Google (Gmail).
- Sending email: Brevo (Sendinblue SAS, France), which delivers the emails we send from our @kofysites.co.uk addresses.
We may also disclose data where required by law or to a regulator.
6. International transfers
Cloudflare, Inc. and Google may process data in the United States. Both participate in the UK Extension to the EU-US Data Privacy Framework, so these transfers rely on the UK's adequacy regulations for the United States (the Data Protection (Adequacy) (United States of America) Regulations 2023, the "UK-US data bridge"). Brevo is based in the EU, which the UK recognises as adequate. Contact us for details of the safeguards.
7. How long we keep it
| Data | Retention |
|---|---|
| Prospects who do not become customers | Deleted 12 months after our last contact |
| Customers | For the contract term plus 6 years (tax and legal claims) |
| Do-not-contact / objection records | Kept indefinitely in minimal form (business name, contact identifier, date, channel) so we can keep respecting your request |
| Website enquiries (incl. attribution data) that do not lead to a sale | Deleted 12 months after our last contact |
| Marketing-consent record (what you agreed to, form version, date) | While you remain subscribed, plus 2 years after you unsubscribe or we last contact you, to prove consent; your unsubscribe itself goes on the do-not-contact list |
| Photos you upload and the details you give for your demo | Deleted with your enquiry (up to 12 months after our last contact) unless you become a customer, in which case they are kept for the life of your website. Photos uploaded with a form that was never sent are deleted within 24 hours. |
| Photo-permission record | Kept as long as we use the photos, plus 2 years |
Backups are kept for up to 35 days.
8. Your rights
You have the right to:
- object to direct marketing at any time. This right is absolute: if you object, we will stop using your data for marketing and add you to our do-not-contact list (we aim to act within 24 hours). Reply "STOP", use the unsubscribe link, tell us on a call, or email debi@kofysites.co.uk;
- object to other processing based on legitimate interests;
- access your personal data;
- have inaccurate data corrected;
- have data erased;
- restrict processing;
- data portability (where processing is by consent or contract and automated);
- withdraw consent at any time, where we rely on consent (this does not affect earlier processing).
We will respond within one month. There is normally no charge.
9. Complaints
Please tell us first at debi@kofysites.co.uk and we will try to resolve it. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint or on 0303 123 1113.
10. Changes
We will update this notice when our practices change and show the date at the top.