Privacy notice.

1. Who we are

Wayforth is a one-person digital studio based in Helensburgh, Scotland, Scotland. For the purposes of UK GDPR and the Data Protection Act 2018, Wayforth is the data controller for any personal data submitted through this site.

Contact for privacy queries: contact@wayforth.uk.

2. What we collect

The only personal data we collect is what you give us via:

• The contact form at /contact — your name, business name, email address, phone number (optional), the package you're interested in, and any message you send.
• The quote tool at /quote — your answers to the five scoping questions, plus the same name / business / email / phone fields when you submit.
• Email correspondence — anything you send to us at contact@wayforth.uk.
• Booking data — when you book a discovery call via Cal.com, Cal.com collects your name, email and chosen time slot and passes it to us. Cal.com is the data controller for the booking widget itself; their privacy notice is at cal.com/privacy.

We do not collect special category data (health, beliefs, biometrics, etc.). Don't put that kind of information into the contact form — if your project genuinely needs us to handle special category data later in the build, we'll do a separate processing agreement first.

3. How we use it

Strictly to reply to your enquiry, scope your project, and — if you become a client — deliver the work. That's it. We don't run marketing campaigns, we don't build mailing lists, and we don't sell, share or trade your data.

Lawful basis under UK GDPR Article 6:

• 6(1)(b) — Pre-contractual steps for processing your enquiry into a quote and any work that follows.
• 6(1)(f) — Legitimate interest for responding to general enquiries, replying to email, and keeping a basic record of conversations so we don't lose context between threads.

4. Who we share it with (processors)

To run the site we use a small number of trusted third-party services. Each acts as a data processor on our behalf:

• Web3Forms — receives your contact and quote form submissions and forwards them to our inbox. Web3Forms is a US-based service; submissions are transferred to the US under UK GDPR adequacy and standard contractual clauses. Privacy notice: web3forms.com/privacy.
• Cal.com — handles discovery-call bookings. Privacy notice: cal.com/privacy.
• Cloudflare — provides DNS, site hosting, security, and email routing for the wayforth.uk domain. Cloudflare temporarily processes your IP address and request headers to deliver the site to you, and forwards mail sent to contact@wayforth.uk to our private inbox. Privacy notice: cloudflare.com/privacypolicy.
• Google Fonts — serves the typefaces this site uses. Your browser fetches fonts directly from Google's CDN; Google sees your IP address and request as part of normal CDN delivery. Privacy notice: policies.google.com/privacy.
• Our email host — incoming mail to contact@wayforth.uk is forwarded to a personal Google Workspace / Gmail inbox where we read and reply to it. That inbox is the canonical record of correspondence.

We will never share your data with anyone else without your explicit, prior consent.

5. International transfers

Web3Forms, Cal.com, Cloudflare and Google may store and process data outside the UK — typically in the US or the EU. Where that happens, transfers rely on the UK adequacy regulations, the UK International Data Transfer Agreement (IDTA), or standard contractual clauses approved by the ICO. We don't push data outside the UK ourselves.

6. How long we keep it

• Form submissions: up to 24 months from the date of enquiry, unless you ask us to delete sooner. We use this window so we can pick up dropped threads.
• Active client records: for the duration of the project plus seven years (HMRC retention requirements).
• Booking metadata in Cal.com: deleted in line with Cal.com's own retention schedule.
• Email correspondence: retained in our inbox indefinitely unless you request deletion. We do periodically prune very old threads.

7. Cookies and tracking

This site does not use analytics cookies, tracking pixels, advertising trackers, or session-replay tools. Cloudflare may set a strictly-necessary cookie (__cf_bm or similar) for bot management — this is essential for the site to function and is exempt from consent under PECR. If we ever add analytics in future, we'll publish a cookie banner first and update this notice.

8. Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you
• Rectify data that is wrong or incomplete
• Erase your data ("right to be forgotten") — subject to any HMRC retention requirements for active clients
• Restrict how we process your data
• Data portability — get a copy of your data in a portable format
• Object to processing on legitimate-interest grounds
• Withdraw consent at any time, where we relied on consent

To exercise any of these, email contact@wayforth.uk. We'll reply within one working day and complete the request inside the statutory one-month window.

9. How to complain

If we've handled your data badly, please tell us first so we can fix it — most issues are misunderstandings we can resolve in a single email. If you're still not satisfied, you can complain to the Information Commissioner's Office, the UK regulator for data protection:

• Website: ico.org.uk
• Helpline: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

10. Changes to this notice

We update this notice when we change a tool, add a service, or correct an error. The "last updated" date at the top of the page reflects the most recent material change. We'll never make this notice less protective without telling you.

11. Contact

Questions, requests, or anything that doesn't fit the boxes above — contact@wayforth.uk. Same person reads every message.