This policy explains what personal data Chris D Projects Ltd collects, why, who we share it with, and the rights you have over it under UK data protection law.
Last updated: 15 September 2026
1. Who we are
Chris D Projects Ltd is a web design, development and WordPress care studio in Cheltenham. For the purposes of UK data protection law we are the data controller for the personal data described in this policy.
Data controller: Chris D Projects Ltd
Company number: 10689176
Registered office: 48 Sedgley Road, Bishops Cleeve, Cheltenham, GL52 8DD
Email: info@chrisdprojects.co.uk
ICO registration: ZA910289
Our WordPress care plans are delivered under our trading name WP Site Warden. That is the same company and the same controller, and this policy covers data handled under either name. Our sister company No Problem Hosting Ltd is a separate controller with its own privacy policy.
2. The personal data we collect
Depending on how you deal with us, we may hold:
- Identity and contact data: name, business name, email address, phone number, postal or business address.
- Account and order data: your account on this site, the plans and products you have bought, orders, invoices and subscription history.
- Service data: the website(s) we look after or build for you, support requests, correspondence, and records of the work we have done.
- Access credentials: logins to your website, hosting, domain or other accounts that you give us so we can do the work. These are held securely and treated as strictly confidential.
- Billing and payment data: billing name and address and payment records. Card and PayPal payments are processed by Stripe and PayPal; we never see or store full card numbers.
- Enquiry data: whatever you send us by email or through the contact page.
- Technical data: IP address, browser and device information, and the pages you visit, collected by our hosting logs and the cookies described in section 6.
We do not ask for special category data such as health, ethnicity or political opinions. Please do not send it to us unless it is genuinely necessary for the work.
3. How we collect it
When you email us, use the contact page, buy a plan or product on this site, create or use an account, correspond with us during a project, or browse the site. We may also receive limited data from our payment providers, for example confirmation that a payment succeeded.
4. How we use your data and our lawful bases
| What we use it for | Lawful basis |
|---|---|
| Replying to enquiries and preparing quotes | Legitimate interests, and steps taken before entering a contract |
| Building, maintaining or supporting your website, and delivering plans you have bought | Performance of a contract |
| Processing payments, invoicing and keeping financial records | Performance of a contract, and legal obligation |
| Running your account on this site | Performance of a contract |
| Keeping the site and our systems secure and preventing fraud | Legitimate interests, and legal obligation |
| Keeping our own business records | Legitimate interests |
| Sending service messages about your plan, renewals or security | Performance of a contract, and legitimate interests |
| Sending marketing (see section 11) | Consent, or legitimate interests for existing clients |
Where we rely on legitimate interests we have considered whether they are outweighed by your rights and interests. Where we rely on consent you can withdraw it at any time.
5. Your website and the data on it
To build, maintain or rescue a website we are given access to it. That site may contain personal data belonging to your own customers, users or staff. For that data you are the controller and we act as your processor: we process it only on your instructions and only as far as the work requires, we keep credentials secure, we do not use it for our own purposes, and we help you meet your own obligations. A data processing agreement is available on request.
For a hacked site rescue we take a full copy of the site’s files and database before starting work, so that nothing is lost. That copy is deleted 30 days after the job is closed.
6. Cookies
This site does not run analytics or advertising cookies and does not track you across other sites. The cookies it sets are the ones WordPress and WooCommerce need to work:
| Cookie | Purpose | Lifetime |
|---|---|---|
woocommerce_cart_hash, woocommerce_items_in_cart, wp_woocommerce_session_* | Remember what is in your basket and keep your checkout session | Session, or up to 2 days |
wordpress_logged_in_*, wordpress_sec_*, wp-settings-* | Keep you signed in to your account | Session, or up to 14 days if you tick “remember me” |
sbjs_* | Record which page or link brought you to the site when you place an order, so we know where our work comes from | Up to 6 months |
You can block or delete cookies in your browser settings; the basket and account features will not work without the first two rows.
7. Who we share your data with
We do not sell personal data. We share it only with providers who help us run the business, under contracts that require them to keep it secure and use it only for our purposes:
- Hosting: No Problem Hosting Ltd, our sister company, which hosts this site and stores its database and backups on UK servers.
- Payments: Stripe and PayPal, who process card and PayPal payments.
- Email, files and off-site backups: Microsoft 365, including OneDrive, where our email runs and encrypted site backups are stored.
- Fonts: this site loads its typefaces from Google Fonts, which means your browser requests the font files from Google’s servers and Google sees your IP address in that request. Google’s privacy policy applies to that request.
- Accounting: our accounting software, for invoicing and bookkeeping.
- Professional advisers and authorities, such as our accountant, or a regulator or court where the law requires.
8. International transfers
We are a UK business and keep personal data in the UK wherever we can. Stripe, PayPal, Microsoft and Google may process data outside the UK. Where that happens the transfer is covered by safeguards recognised under UK GDPR, such as UK adequacy regulations or the International Data Transfer Agreement. Ask us if you want details of the safeguard that applies to a particular provider.
9. How long we keep it
- Client account, order and service records: for the length of our relationship and six years after it ends.
- Invoices and financial records: six years, as HMRC requires.
- Access credentials: removed or revoked as soon as they are no longer needed for the work.
- Enquiries that do not become work: 12 months.
- Site backups taken under a care plan: for the archive period stated for your plan, currently 30 days.
- Hacked site rescue copies: 30 days after the job is closed.
After that, data is deleted or anonymised.
10. How we keep it secure
Credentials and backups are stored encrypted, access is limited to the people who need it, data is encrypted in transit, and this site and its hosting are monitored and patched. No system is completely secure, but we work to protect your data and, if a breach ever affects you, we will tell you and the ICO where the law requires it.
11. Marketing
We do not run mailing lists. Where we do send marketing it will be with your consent, or to existing clients about services like the ones they already buy, and every message will include a way to opt out. Messages about your plan, invoices, renewals or the security of your site are service messages, not marketing, and are sent to every client.
12. Your rights
Under UK data protection law you have the right to:
- be told how your data is used (this policy);
- access the personal data we hold about you;
- have inaccurate or incomplete data corrected;
- have your data erased in certain circumstances;
- restrict or object to our processing in certain circumstances;
- receive your data in a portable format; and
- withdraw consent at any time where we rely on it.
Email info@chrisdprojects.co.uk to exercise any of these. We will respond within one month, there is normally no charge, and we may need to confirm your identity first.
13. Children
Our services are for businesses and are not directed at children. We do not knowingly collect data from anyone under 13. If you think we have, tell us and we will delete it.
14. Changes to this policy
When this policy changes we will update the date at the top. Significant changes will be brought to the attention of clients on a plan.
15. Contact and complaints
Chris D Projects Ltd (Company No. 10689176)
48 Sedgley Road, Bishops Cleeve, Cheltenham, GL52 8DD
info@chrisdprojects.co.uk
You also have the right to complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. We would appreciate the chance to put things right first.