PRIVACY AND COOKIES
Privacy and Cookie Policy
SPA Web Design respects your privacy and is committed to protecting your personal information. This policy explains what information is collected when you use this website, contact me or download a plugin, how that information is used and protected, and the choices available to you.
It also explains how this website uses cookies and similar technologies, including Google Analytics.
Last updated
Last updated: July 2026
Who we are
SPA Web Design Limited is a company registered in England and Wales that provides WordPress website design, development, support, plugin development, and design and print services.
For data-protection purposes, SPA Web Design Limited is the data controller responsible for the personal information described in this policy.
Company details
SPA Web Design Limited
Company number: 04655978
VAT registration number: GB 812 6494 30
ICO registration number: ZA914675
Registered office:
1623 Warwick Road
Knowle
Solihull
England
B93 9LF
Correspondence address:
52 Warwick Road
Southam
Warwickshire
England
CV47 0HW
Email: contact@spawebdesign.co.uk
Telephone: 01926 888 981
The information I may collect
The information collected depends on how you use this website and whether you contact SPA Web Design, request support or download a plugin.
Information you provide directly
When you complete a contact or plugin-support form, send an email or contact me by telephone, I may collect:
- Your name
- Business or organisation name
- Email address and telephone number
- Your website address
- Details about your proposed project, existing website or support request
- Information contained in correspondence between us
- Files, screenshots or other information you choose to provide
Please avoid submitting confidential information, passwords or sensitive personal information through the website forms.
Plugin download information
When you follow a link to download a free plugin, the download may be provided through GitHub. GitHub may collect technical and usage information in accordance with its own privacy policy. SPA Web Design does not require you to create an account or provide personal information to download the Free version.
If paid plugins are introduced, additional information may be collected to process purchases, create customer accounts, issue licences and provide updates and support. This policy will be updated before those services are introduced.
Information collected automatically
When you visit the website, certain technical information may be collected automatically, including:
- IP address
- Browser and device type
- Operating system
- Pages visited and time spent on the website
- Referring website or search engine
- Approximate geographical location
- Cookie preferences
- Website security and server-log information
Google Analytics does not log or retain individual IP addresses from UK users, although it may use an IP address temporarily to determine approximate location before discarding it. Google Analytics privacy information
How and why your information is used
SPA Web Design only uses personal information where there is a clear business need and a lawful basis for doing so.
Responding to enquiries
Information submitted through a contact or support form, by email or by telephone is used to:
- Respond to your enquiry
- Discuss your requirements
- Prepare quotations and proposals
- Provide requested information or support
- Maintain a record of our correspondence
The lawful basis is normally taking steps at your request before entering into a contract or SPA Web Design’s legitimate interest in responding to business enquiries.
Providing services and support
If you become a client or plugin customer, your information may be used to:
- Provide the services, products or support you request
- Manage projects and ongoing client relationships
- Communicate about your website, hosting, maintenance or plugin
- Maintain business and support records
- Send important service, security or product information
The lawful basis is normally the performance of a contract, taking steps before entering into a contract, or legitimate interests where appropriate.
Processing plugin purchases
WooCommerce is used to manage plugin purchases, including orders, customer accounts, licences, downloadable files and purchase records. Information collected during the purchasing process may include:
- Your name and business name
- Billing address
- Email address and telephone number
- Order and transaction details
- Account and licence information
- Download and support history
Payments are processed securely by Stripe. Your payment information is submitted directly to Stripe for processing. SPA Web Design does not receive or store your complete payment-card number.
WooCommerce retains the information required to process and administer your order, while Stripe processes payment information in accordance with its own Privacy Policy.
This information is used to:
- Process payments and complete orders
- Create and manage customer accounts
- Provide access to plugin downloads
- Issue and administer software licences
- Deliver plugin updates and customer support
- Send order confirmations, invoices and essential service messages
- Maintain accounting, taxation and transaction records
- Prevent fraud and resolve payment disputes
The lawful bases for this processing are the performance of a contract, taking steps at your request before entering into a contract, compliance with legal obligations and, where appropriate, SPA Web Design’s legitimate interests in preventing fraud and administering its products and services.
Operating and protecting the website
Technical and server-log information may be used to:
- Maintain the security and availability of the website
- Detect malicious activity, misuse or technical problems
- Diagnose faults and improve performance
- Maintain backups and protect business systems
The lawful basis is SPA Web Design’s legitimate interest in operating a secure and reliable website and, where applicable, compliance with legal obligations.
Website analytics
Google Analytics is used solely to produce aggregate statistics about how visitors find and use this website. This helps SPA Web Design improve its content, navigation and performance.
SPA Web Design does not use analytics information for advertising, profiling visitors, tracking individuals across different websites or making decisions about particular individuals. Visitors are provided with a simple way to object to this use.
The statistical-purposes exception under the Privacy and Electronic Communications Regulations is relied upon for analytics storage and access. The lawful basis for processing any associated personal information is SPA Web Design’s legitimate interest in understanding and improving its website.
Accounting and legal requirements
Certain information may be retained and used to:
- Issue invoices and maintain accounting records
- Meet tax, company and regulatory obligations
- Establish, exercise or defend legal claims
- Prevent or investigate fraud
The lawful basis is compliance with legal obligations or SPA Web Design’s legitimate interests, depending on the circumstances.
The ICO requires a privacy notice to identify both the purpose of each use and its corresponding lawful basis. ICO lawful-basis guidance
Who may receive your information
SPA Web Design does not sell or rent personal information. Information is only shared where necessary to provide services, operate the website, process transactions, comply with the law or protect legitimate business interests.
Website hosting and email
The website, associated databases and business email accounts are hosted on servers managed through zFast. Information submitted through website forms and emails sent to SPA Web Design may therefore be processed and stored within this hosting environment.
Google Analytics
If you accept analytics cookies, information about your use of the website is processed by Google Analytics. Google provides SPA Web Design with aggregated reports that help measure website usage and improve the website.
Google may process information using infrastructure located outside the UK. Where applicable, appropriate legal safeguards are relied upon for international transfers.
Payments and online orders
Stripe processes payments made through the website. Information required to complete a transaction is shared with Stripe, but SPA Web Design does not receive or store your complete payment-card number.
WooCommerce is used within this WordPress website to manage orders, customer accounts, downloads and plugin licences. Relevant order and account information is stored in the website’s database.
GitHub and plugin downloads
Free plugin files may be distributed through GitHub. If you follow a download link, GitHub may collect technical or usage information under its own privacy terms.
Printing and delivery suppliers
Where you order design and print services, the information necessary to produce and deliver your order may be shared with trusted printing, production and delivery suppliers. This may include your name, delivery address, contact information and relevant order details.
Only the information needed to complete the order will be provided.
Professional advisers and authorities
Information may also be disclosed where reasonably necessary to:
- Accountants, legal advisers or other professional advisers
- Insurers
- Fraud-prevention or security providers
- Courts, regulators, law-enforcement bodies or public authorities
- Comply with a legal obligation or protect legal rights
Business changes
If SPA Web Design Limited is sold, reorganised or transferred, relevant information may be disclosed to professional advisers and prospective or actual purchasers, subject to appropriate confidentiality and data-protection safeguards.
How long I keep your information
Personal information is kept only for as long as it is reasonably required for the purpose for which it was collected, including satisfying legal, accounting and reporting obligations.
The following periods will normally apply:
General enquiries
Enquiries that do not result in a working relationship or purchase will normally be retained for up to two years after the last communication. They may be deleted sooner where there is no continuing business need to retain them.
Client and project records
Project correspondence, quotations, contracts, support records and other information connected with services provided by SPA Web Design will normally be retained for up to six years after the client relationship or relevant project ends.
Information may be retained for longer where ongoing website hosting, maintenance, support or another continuing service is being provided.
Orders and payment records
WooCommerce orders, invoices, transaction records and related customer information will normally be retained for at least six years to meet accounting, taxation and legal requirements.
SPA Web Design does not retain complete payment-card details. Stripe retains payment information in accordance with its own retention policies.
HMRC generally requires VAT records such as invoices to be retained for six years. HMRC record-retention guidance
Customer accounts and plugin licences
Customer-account, plugin-licence and download information will be retained while the account or licence remains active. Relevant transaction and support records may continue to be retained for up to six years after the account or commercial relationship ends.
Support enquiries
Plugin and website-support enquiries will normally be retained for up to three years after the request is closed, unless they form part of an ongoing client relationship or are required for contractual or legal records.
Analytics information
Google Analytics information is retained in accordance with the retention settings configured for the SPA Web Design Analytics property. Aggregated reports that no longer identify an individual may be retained for longer.
Security and server logs
Website and server logs are normally retained for a limited period determined by operational and security requirements. Relevant records may be retained for longer if they are needed to investigate malicious activity, a security incident or attempted fraud.
Legal requirements and disputes
Information may be kept for longer where necessary to comply with a legal obligation, resolve a dispute, establish or defend a legal claim, or respond to an investigation by a regulator or public authority.
When information is no longer needed, it will be deleted, anonymised or securely destroyed.
The UK GDPR storage-limitation principle requires personal information not to be kept in identifiable form for longer than necessary. ICO storage-limitation guidance
How your information is protected
SPA Web Design takes reasonable technical and organisational measures to protect personal information against unauthorised access, alteration, disclosure, accidental loss or destruction.
These measures include, where appropriate:
- Secure website hosting and server management
- SSL encryption for information transmitted between your browser and the website
- Password-protected administrative accounts
- Restricted access to website, email and customer information
- WordPress security monitoring and protection
- Regular software and security updates
- Website and database backups
- Anti-spam and malicious-traffic protection
- Secure payment processing through Stripe
- Appropriate security measures for computers and other devices used to access business information
Access to personal information is limited to SPA Web Design and trusted service providers that require it to deliver their services.
Although reasonable precautions are taken, no website, email system or internet transmission can be guaranteed to be completely secure. You should not send passwords, complete payment-card details or other highly confidential information through ordinary contact forms or email.
If a personal-data breach occurs that is likely to present a risk to individuals, SPA Web Design will investigate it and notify the Information Commissioner’s Office and affected individuals where required by law.
Where your information may be processed
SPA Web Design is based in the United Kingdom, and its primary website and email services are managed through its UK hosting provider.
Some third-party services used by the website, including Google Analytics, Stripe and GitHub, operate internationally. As a result, personal information may be transferred to, stored in or accessed from countries outside the United Kingdom.
Where a restricted international transfer takes place, SPA Web Design takes reasonable steps to ensure that an appropriate legal safeguard is in place. Depending on the service and destination, this may include:
- A UK adequacy regulation
- The UK Extension to the EU–US Data Privacy Framework, where applicable
- The UK International Data Transfer Agreement
- The UK Addendum to approved EU Standard Contractual Clauses
- Another safeguard permitted by UK data-protection law
Third-party providers may also maintain their own international data-transfer arrangements, security measures and contractual safeguards.
You can find further information in the relevant provider’s privacy documentation:
For further information about the safeguards applying to particular information, contact contact@spawebdesign.co.uk.
The ICO explains the safeguards available for transfers of personal information outside the UK in its international-transfer guidance.
Your rights over your information
Depending on the circumstances and the lawful basis used, UK data-protection law may give you the right to:
- Be informed about how your personal information is collected and used
- Request access to the personal information held about you
- Request correction of information that is inaccurate or incomplete
- Request deletion of your information in certain circumstances
- Request restriction of how your information is used
- Object to processing based on legitimate interests
- Request data portability for certain information provided electronically
- Withdraw consent at any time where processing relies on consent
- Object to direct marketing at any time
- Challenge certain automated decisions that produce legal or similarly significant effects
These rights are not absolute and may not apply in every situation. For example, SPA Web Design may need to retain information to comply with legal or accounting obligations or to establish, exercise or defend a legal claim.
SPA Web Design does not currently use personal information to make solely automated decisions that produce legal or similarly significant effects.
Exercising your rights
To exercise any of these rights, email contact@spawebdesign.co.uk or write to:
SPA Web Design Limited
52 Warwick Road
Southam
Warwickshire
England
CV47 0HW
Please provide enough information to identify you and the information concerned. Additional identification may be requested where reasonably necessary to protect your information from unauthorised disclosure.
There is normally no charge for exercising your rights. SPA Web Design will respond without undue delay and normally within the period required by data-protection law. The response period may be extended where permitted for a particularly complex request or several simultaneous requests.
How this website uses cookies
Cookies are small text files placed on your computer, tablet or mobile device when you visit a website. They help websites function correctly, remember preferences, maintain secure sessions and provide information about how visitors use the website.
This website may also use similar technologies, such as browser storage, pixels or scripts. References to cookies in this policy include these similar technologies where appropriate.
Strictly necessary cookies
These cookies are required for the website to operate securely and provide services requested by visitors. They may be used to:
- Remember cookie-consent choices
- Protect forms and prevent spam or malicious activity
- Maintain secure WordPress sessions
- Remember the contents of a WooCommerce basket
- Operate checkout and customer-account functions
- Process plugin purchases and downloads
Strictly necessary cookies cannot normally be disabled through the website’s cookie controls because the website may not function properly without them. They do not require consent, but visitors must still be informed about their use.
Analytics cookies
Subject to your consent, Google Analytics places cookies or uses similar technologies to collect information about how visitors use this website. This may include:
- Pages visited
- Time spent on pages
- Referring websites or search engines
- General device and browser information
- Approximate geographical location
- Interactions with links, downloads and other website features
This information helps SPA Web Design understand website usage and improve its content, navigation and performance.
Analytics cookies will not be activated unless you select Accept or otherwise provide consent through the website’s cookie controls.
Payment cookies
Stripe may use cookies and similar technologies during checkout to process payments securely, prevent fraud and recognise trusted devices. Cookies that are strictly necessary to complete a requested payment may operate without optional consent.
Stripe may also use other technologies according to the choices available through the website and its own privacy documentation.
Functional cookies
Functional cookies may remember choices or provide enhanced website features. If any non-essential functional cookies are introduced, they will only be activated after the appropriate consent has been obtained.
Marketing cookies
SPA Web Design does not currently use advertising or behavioural-marketing cookies.
If marketing services are added in the future, this policy and the website’s cookie controls will be updated before those cookies are used.
Managing your cookie choices
When you first visit the website, you will be given the option to:
- Accept optional cookies
- Reject optional cookies
- Review or customise your preferences
Rejecting optional cookies will not prevent you from accessing the main content of the website.
You can change or withdraw your consent at any time using the Cookie Settings link displayed on the website. You can also delete or block cookies through your browser settings, although doing so may affect features such as customer accounts, baskets and checkout.
The ICO requires non-essential cookies such as Google Analytics to remain disabled until the visitor has actively consented. ICO cookie guidance
The next subsection will be the cookie table, listing the individual cookie names, providers, purposes and durations. Its exact contents will depend on which cookie-consent plugin you install, because that plugin will add its own preference cookie.
Cookies used on this website
The cookies used may change when website features or third-party services are updated. The following table describes the principal cookies expected to be used by this website.
| Cookie | Provider | Purpose | Duration | Category |
|---|---|---|---|---|
_ga | Google Analytics | Distinguishes visitors and helps produce website-usage statistics. | Up to 2 years | Analytics |
_ga_<container-id> | Google Analytics | Maintains information about a visitor’s Google Analytics session. The final part of the name varies according to the website’s Analytics property. | Up to 2 years | Analytics |
woocommerce_cart_hash | SPA Web Design/WooCommerce | Detects changes to the contents of the shopping basket. | Session | Strictly necessary |
woocommerce_items_in_cart | SPA Web Design/WooCommerce | Records whether the shopping basket contains any products. | Session | Strictly necessary |
wp_woocommerce_session_<hash> | SPA Web Design/WooCommerce | Assigns a unique identifier so WooCommerce can locate the visitor’s basket information in the website database. | 2 days | Strictly necessary |
woocommerce_recently_viewed | SPA Web Design/WooCommerce | Supports the recently viewed products feature, if enabled. | Session | Functional |
store_notice[notice-id] | SPA Web Design/WooCommerce | Remembers when a visitor dismisses a store notice, if that feature is used. | Session | Functional |
wordpress_test_cookie | SPA Web Design/WordPress | Checks whether the visitor’s browser supports cookies. | Session | Strictly necessary |
wordpress_logged_in_<hash> | SPA Web Design/WordPress | Recognises a signed-in customer or website user and maintains their logged-in session. | Session or login period | Strictly necessary |
wp-settings-<user-id> | SPA Web Design/WordPress | Stores interface preferences for registered users. | Up to 1 year | Functional |
wp-settings-time-<user-id> | SPA Web Design/WordPress | Records when registered-user interface preferences were set. | Up to 1 year | Functional |
| Stripe essential cookies | Stripe | Support secure payment processing, fraud detection and checkout functionality. Cookie names and durations may vary according to the Stripe service and checkout method used. | Varies | Strictly necessary |
| Cookie-preference cookie | SPA Web Design | Records whether optional cookies were accepted or rejected and remembers the visitor’s preferences. | To be confirmed when the consent system is installed | Strictly necessary |
Google documents the default GA4 cookies as _ga and _ga_<container-id>, both with a default expiry of two years. Google Analytics cookie documentation
WooCommerce documents its basket and session cookies and confirms that no personal information is stored directly inside those core cookies. WooCommerce cookie documentation
Stripe states that Stripe.js uses essential cookies to operate securely and detect and prevent fraud. Stripe cookie information
Website analytics
SPA Web Design uses Google Analytics to collect statistical information about how visitors use this website. This information is used solely to understand website usage and improve its content, navigation and performance.
Analytics information is used to produce aggregate statistics. SPA Web Design does not use it for advertising, profiling visitors, tracking individuals across different websites or making decisions about particular individuals.
Google Analytics may collect information such as the pages visited, time spent on the website, referring source, general device and browser information, approximate geographical location and interactions with website features.
You can accept, reject or subsequently change your analytics preferences using the website’s cookie controls.
Questions about your information
If you have a question about this policy, how your personal information is used or wish to exercise a data-protection right, contact:
SPA Web Design Limited
52 Warwick Road
Southam
Warwickshire
England
CV47 0HW
Email: contact@spawebdesign.co.uk
Telephone: 01926 888 981
SPA Web Design will investigate privacy concerns and try to resolve them promptly.
Complaining to the ICO
You also have the right to complain to the Information Commissioner’s Office if you are concerned about the way your personal information has been handled.
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Telephone: 0303 123 1113
Website: ico.org.uk/make-a-complaint
SPA Web Design Limited is registered with the Information Commissioner’s Office under registration number ZA914675.
Changes to this Privacy and Cookie Policy
This policy may be updated from time to time to reflect changes to:
- The services provided by SPA Web Design
- Website functionality or technology
- Plugins, payment services or third-party providers
- The ways personal information is collected and used
- Legal, regulatory or security requirements
The latest version will always be published on this page. Where a change is significant, an additional notice may be displayed on the website or provided directly to affected customers where appropriate.
You should review this page periodically to remain informed about how SPA Web Design uses and protects personal information.
Last updated: July 2026
This completes the Privacy and Cookie Policy. The next task should be installing and configuring Complianz, then checking its cookie scan against the table after Site Kit, WooCommerce and Stripe are active.