Customer Privacy Notice

This privacy notice tells you what to expect us to do with your personal information.

• Contact details

• What information we collect, use, and why

• Lawful bases and data protection rights

• Where we get personal information from

• How long we keep information

• How to complain

Contact details

Email: hello@townmousewrites.co.uk

What information we collect, use, and why

We collect or use the following personal information a) for service updates or marketing purposes and b) to collect the information to design and build a website for a client c) to issue invoices and collect payments d) to optimise and analyse the performance of our website

• Names and contact details (may include email, telephone, postal addresses, social media contact details) of clients, people making enquiries and people who sign up to receive marketing emails or engage with our social media

• Names and other identifying information of other people appearing on the website that is being built

• Photographs of people appearing on the website that is being built

Website Cookies

The website www.townmousewrites.co.uk uses cookies: small text files stored on your device when you visit. We use necessary cookies to keep the site functioning securely, and analytics cookies to understand how visitors use the site (see below). You can accept, decline, or manage your cookie preferences using the banner that appears when you first visit. You can also change your preferences at any time via the Cookie Preferences button in the footer of this website. You can see the cookies that Squarespace uses on their website.

Analytics

The website www.townmousewrites.co.uk collects personal information to power Squarespace Analytics, including:

• Information about your browser, network, and device

• Web pages you visited prior to coming to this website

• Your IP address

This information may also include details about your use of this website, including:

• Clicks

• Internal links

• Pages visited

• Scrolling

• Searches

• Timestamps

Payments

We use Mettle, including the accounting software FreeAgent, to issue invoices and collect and record payments. When you pay for our services by bank transfer, we collect your bank account details including account name, sort code and account number. We use this information solely for the purpose of receiving and reconciling payments.

Lawful bases and data protection rights

Under UK data protection law, we must have a “lawful basis” for collecting and using your personal information. There is a list of possible lawful bases in the UK GDPR. You can find out more about lawful bases on the ICO’s website.

Which lawful basis we rely on may affect your data protection rights which are set out in brief below. You can find out more about your data protection rights and the exemptions which may apply on the ICO’s website:

• Your right of access - You have the right to ask us for copies of your personal information. You can request other information such as details about where we get personal information from and who we share personal information with. There are some exemptions which means you may not receive all the information you ask for. Read more about the right of access.

• Your right to rectification - You have the right to ask us to correct or delete personal information you think is inaccurate or incomplete. Read more about the right to rectification.

• Your right to erasure - You have the right to ask us to delete your personal information. Read more about the right to erasure.

• Your right to restriction of processing - You have the right to ask us to limit how we can use your personal information. Read more about the right to restriction of processing.

• Your right to object to processing - You have the right to object to the processing of your personal data. Read more about the right to object to processing.

• Your right to data portability - You have the right to ask that we transfer the personal information you gave us to another organisation, or to you. Read more about the right to data portability.

• Your right to withdraw consent – When we use consent as our lawful basis you have the right to withdraw your consent at any time. Read more about the right to withdraw consent.

If you make a request, we must respond to you without undue delay and in any event within one month.

To make a data protection rights request, please contact us using the contact details at the top of this privacy notice.

Our lawful bases for the collection and use of your data

Our lawful bases for collecting or using personal information for service updates or marketing purposes are:

• Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:
  

1. Collecting from clients: names, contact details and photographs of people that clients have requested to appear on the website.
   

2. Collecting names and contact details of clients and other people involved in website creation projects in order to correspond with them regarding creation of a website
   

3. Collecting names and contact details of people who have signed up to receive marketing information (freebies and special offers)
   

4. Collecting names and contact details of people in order to respond to enquiries.
   

5. Collecting site analytics (described above) to learn about site traffic and activity and improve our website.
   

• Contract with you and compliance with legal obligations - we’re collecting or using your bank account details (account name, sort code and account number) to raise invoices, receive and reconcile payments made by bank transfer, and maintain financial records under HMRC requirements.

Third-Party Services and Data Processors

In operating our business, we use a number of third-party services that may process personal data on our behalf or as independent data controllers. We have carried out appropriate due diligence on each provider. The following sets out the relevant processors, the nature of data processed, and the legal basis for doing so.

Website Building – Squarespace

For websites created using Squarespace, the site created for the client  is hosted by Squarespace Ireland Limited (acting as a sub-entity of Squarespace, Inc., USA). Data may be transferred to servers in the United States; such transfers are subject to appropriate safeguards in accordance with UK GDPR Article 46, including Standard Contractual Clauses. Our lawful basis for this processing is our legitimate interests in creating a functional and secure website. For further information, please refer to Squarespace's Privacy Policy at www.squarespace.com/privacy.

Website Building  – Webador

For websites created using Webador, the site created for the client is hosted by Webador, a service provided by Webador B.V., a company incorporated in the Netherlands. As Webador B.V. is established in the Netherlands (an EU member state), transfers of personal data from the UK to Webador are subject to the UK's approach to international transfers; we rely on appropriate safeguards in accordance with UK GDPR Article 46, including Standard Contractual Clauses where applicable, to ensure your data remains protected. Our lawful basis for this processing is our legitimate interests in creating a functional, accessible, and secure website . For further information on how Webador processes data, please refer to Webador's Privacy Policy atwww.webador.com/privacy.

Document Storage and Collaboration – Google Docs (Google Workspace)

We use Google Docs, part of Google Workspace, provided by Google LLC, to create, store, and share business documents. Personal data contained within those documents (for example, client details, correspondence, or records) may be stored on Google's servers. Google acts as our data processor under a Data Processing Agreement. Data may be transferred outside the UK; Google relies on Standard Contractual Clauses as the transfer mechanism. Our lawful basis for this processing is our legitimate interests in maintaining efficient business operations or, where applicable, the performance of a contract with you. Further information is available in Google's Privacy Policy at policies.google.com/privacy.

Email Communications – Gmail (Google Workspace)

We use Gmail, part of Google Workspace provided by Google LLC, as our email platform. When you communicate with us by email, your name, email address, and the content of your correspondence will be processed and stored via Gmail. Google acts as our data processor under a Data Processing Agreement. Transfers outside the UK are subject to Standard Contractual Clauses. Further information is available in Google's Privacy Policy at policies.google.com/privacy.

Email Communications - Website Contact Forms

When you complete the Contact Form or Sign Up Form on this website, the information you submit - including your name and email address - is transmitted and processed by Squarespace Inc., the platform on which this website is built. Squarespace acts as a data processor on our behalf and stores form submissions securely on our behalf. Your details will only be used to respond to your enquiry and will not be shared with any third party or used for marketing without your consent.

When you complete the Sign Up Form on this website to receive resources and details of offers by email, your email address is collected and stored securely by Squarespace as above, and may be exported and held in a password-protected spreadsheet accessible only to The Town Mouse Writing Company and stored in our Google Workspace (see above). We do not share your email address with any third parties, and we will not use it for any purpose other than those described on the Sign Up Form.

Squarespace Inc. is a US-based company. For information on how Squarespace handles personal data and their data transfer safeguards, see the Squarespace Privacy Policy.

Our lawful basis for processing email correspondence is our legitimate interests in communicating effectively with clients and contacts, or the performance of a contract where the communication relates to services we are providing to you.

Social Media – Facebook and Instagram (Meta Platforms)

We operate official social media channels on Facebook and Instagram to share news, interact with our customers, and promote our products/services.

We maintain business pages on Facebook and Instagram, both operated by Meta Platforms Ireland Limited ("Meta"). When you interact with our pages, for example, by liking, commenting, following, or sending a direct message, Meta will process your personal data in accordance with its own Privacy Policy. In respect of our business pages, Meta and we are joint data controllers for certain processing activities (such as page insights and analytics). We receive only aggregated, anonymised insights data from Meta and do not access your individual profile data. Our lawful basis for maintaining these pages and engaging with followersis our legitimate interests in promoting our business and communicating with our audience. You should be aware that Meta may transfer data outside the UK under Standard Contractual Clauses. We encourage you to review Meta's Privacy Policy atwww.facebook.com/privacy/policy and Instagram's supplementary information for full details of how your data is used. If you send us a direct message via Facebook or Instagram, we will use the information you provide solely to respond to your enquiry and will not retain it beyond what is necessary for that purpose.

Invoicing and Payment Processing - Mettle Bank

We issue invoices and collect payments using Mettle, a business banking service provided by NatWest Group. When we raise an invoice or receive a payment from you, certain personal data, including your name, contact details, business details, and payment information, will be processed through Mettle in connection with our banking and payment activity.

Mettle is regulated by the Financial Conduct Authority and is subject to its own legal and regulatory obligations in respect of the personal data it holds. For further information about how Mettle handles personal data, please refer to Mettle's privacy policy at www.mettle.co.uk/privacy.

Accounting - FreeAgent accounting software

We use FreeAgent, provided by FreeAgent Central Ltd, to manage our accounting and financial records. When you make a payment to us or we raise an invoice in connection with our services, certain personal data, including your name, contact details, and payment information, will be stored within FreeAgent.

FreeAgent acts as a data processor on our behalf and processes your personal data only in accordance with our instructions. FreeAgent is based in the United Kingdom and your data is stored securely within the UK.

For further information about how FreeAgent handles personal data, please refer to FreeAgent's own privacy policy at www.freeagent.com/privacy.

The lawful basis for this processing is the performance of a contract with you and compliance with our legal obligations, including our obligations to maintain financial records under HMRC requirements.

A note on your rights

Regardless of which third-party platform is involved, your UK GDPR rights (access, rectification, erasure, restriction, portability, and the right to object) remain applicable to the extent we control your personal data. To exercise any of these rights, please contact us at hello@townmousewrites.co.uk. Where processing is carried out solely by a third party as an independent controller (e.g., Meta's own platform activity), you should exercise your rights directly with that organisation.

Where we get personal information from

• Directly from you

• You may provide personal information about other people who are to be included in the website (a Data Processing Agreement is included in our Terms of Business).

How long we keep information

The names, contact details and photographs of people appearing on the website are stored on the draft website and on Google Drive. They are stored until the date the website is transferred to the client’s ownership.

The names and contact details of clients will be retained until one year after transfer of the website to their ownership, unless there is ongoing correspondence, when details will be retained for one year after correspondence is complete.

The names and contact details of anyone making an enquiry by telephone or email will be kept for six months after the enquiry.

The names and contact details of anyone signing up for marketing emails will be kept until they unsubscribe (option to do this on each email)

We retain financial records including payment information for 5 years after the 31 January submission deadline of the relevant tax year, as required by HMRC. Email confirmations containing financial details are removed from our email system after reconciliation.

How to complain

If you have any concerns about our use of your personal data, you can make a complaint to us using the contact details at the top of this privacy notice. If you remain unhappy with how we’ve used your data after raising a complaint with us, you can also complain to the ICO.

The ICO’s address:  Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Helpline number: 0303 123 1113

Website: https://www.ico.org.uk/make-a-complaint

Last updated: March 2026