This explains what personal data we hold, why, and what you can do about it. It is written to be read rather than to cover us, so if something here is unclear, ask us and we will fix the wording.
Who we are
BLOXSO.ME LTD, a company registered in England and Wales, number 17236668, with its registered office at 128 City Road, London, EC1V 2NX. We trade as Bloxso.me.
We are the data controller for the personal data described below. You can reach us at joe@bloxso.me or by post at the address above.
This website
This site sets no cookies, runs no analytics and loads no third-party scripts. Fonts are served from our own domain rather than a font network. We do not track you across the web, we do not build a profile of you, and there is no cookie banner because there is nothing to consent to.
Our hosting provider, Cloudflare, processes technical request data such as IP addresses to deliver the site and protect it from attack. That is standard infrastructure logging and we do not use it to identify individuals.
If you contact us
If you email us, we hold your email address, your name if you give it, and whatever you write to us, so that we can reply and keep a record of the conversation.
If you book a call, that runs through Cal.com, who process your name, email address and answers to the booking questions on our behalf. Their privacy policy governs what they do with it.
Lawful basis: our legitimate interest in responding to enquiries, and taking steps at your request before entering a contract.
If we contacted you first
We approach local businesses who may need a website. If you received an email or letter from us and had never heard of us, this section explains where your details came from.
We collect, from publicly available sources:
- Your business name, address, phone number and website, from Google's business listings
- An assessment of your existing website — whether it loads, works on a phone, and so on
- Whether your business is a registered company, from the Companies House public register
- A business email address, where one is published on your own website
We check the Companies House register specifically so that we only send marketing email to registered companies and LLPs. Sole traders and ordinary partnerships have stronger protection under the Privacy and Electronic Communications Regulations, and we do not add them to email campaigns.
Lawful basis: legitimate interests — promoting our services to businesses likely to want them. We have weighed that against your interests, which is why we use published business contact details rather than personal ones, keep volumes low, and stop immediately on request.
You can stop this at any time. Reply to any message, or email joe@bloxso.me, and we will remove you. We keep a record of your email address on a suppression list purely to make sure we never contact you again — that is the one thing we retain after an opt-out, and it exists to honour it.
Preview websites
As part of an approach we sometimes build a sample website for a business and send a link to it. Those previews are hosted at preview.bloxso.me, are blocked from search engines, and expire automatically.
When a preview is opened we record:
- Which preview was viewed, and when
- The browser's user agent string
- The country the request came from
- The referring page, if any
We do not store IP addresses against these records. We use them to know whether it is worth following up. If you would like a preview of your business taken down, ask and we will remove it the same day.
If you are a client
For clients we hold contact details, billing details, domain and hosting records, and the content you give us for your website.
Where we host a website for you, visitors to your site may submit enquiries through a contact form. We process that data on your behalf as a processor — you are the controller for it, and it is covered by our agreement with you rather than by this policy.
Payments are handled by our payment provider. We do not see or store your full bank details.
Lawful basis: performance of our contract with you, and our legal obligations for accounting records.
Who we share data with
We do not sell personal data. We share it only with providers who help us operate:
- Cloudflare — hosting for this site, client sites and previews
- Cal.com — call bookings
- Google — business listing data, and Business Profile management for clients who buy it
- Companies House — public register lookups
- Our payment provider, accountant, and email provider
We may also disclose data where the law requires it.
How long we keep it
- Enquiries: two years from our last exchange
- Prospect records where you never replied: twelve months, then deleted
- Preview sites: sixty days by default, then removed
- Preview view records: twelve months
- Opt-out suppression list: indefinitely, so we can honour the opt-out
- Client and billing records: for the contract, then six years for tax and accounting
Your rights
Under UK data protection law you can ask us to:
- Tell you what personal data we hold about you, and give you a copy
- Correct anything inaccurate
- Delete it
- Restrict what we do with it
- Provide it in a portable format
- Stop processing it where we rely on legitimate interests
You have an absolute right to object to direct marketing. That one is not a balancing exercise — if you tell us to stop, we stop, and we do not need a reason.
Email joe@bloxso.me. We will respond within one month, and it is free.
Complaints
If you are unhappy with how we have handled your data, tell us first and we will try to put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113.