Best Web Design BY REPUTATION

Privacy policy

This website collects almost nothing. There is no contact form, no newsletter and no advertising. What little we do handle is set out in full below.

DATA PROTECTIONUK AND EU GDPR

LAST UPDATED 31 AUGUST 2026

1. Who we are

Best Web Design ("we", "us", "the studio") operates the website at bestwebdesign.lk. For the purposes of the UK General Data Protection Regulation and the EU General Data Protection Regulation, we are the data controller for personal data processed through this website and through correspondence with us.

You can reach us about anything in this policy, including any request to exercise your rights, at hello@bestwebdesign.lk.

2. What we collect

Correspondence

If you email us, we receive whatever you choose to put in that email: your name, your email address, your company, and whatever you tell us about your business. We also keep our replies. That is the only way we collect personal data directly, because this site has no contact form, no live chat and no telephone enquiry line.

Server logs

Our hosting provider records standard technical information when a page is served: IP address, browser type and version, operating system, the pages requested, and the date and time of the request. These logs exist for security and for diagnosing faults. We do not use them to build a profile of you.

Analytics

If analytics are enabled on this site, they are configured to collect aggregate usage data only. Where a cookie-based analytics tool is in use, you will be asked for consent before any non-essential cookie is set. If you are reading this and have not been asked, no such tool is running.

Fonts and third-party assets

This site loads its typefaces from Google Fonts. When your browser requests those files, your IP address and basic request headers are transmitted to Google, which may involve a transfer outside the UK and the EEA. Google acts as an independent controller for that request and its own privacy notice applies. If you would prefer this not to happen, the fonts can be self-hosted on request, and the site remains fully legible without them.

3. What we do not collect

  • We do not use advertising or retargeting pixels of any kind.
  • We do not sell, rent or trade personal data. There is no circumstance in which we would.
  • We do not buy contact lists, and we do not send unsolicited marketing.
  • We do not knowingly collect data from anyone under sixteen. This is a business-to-business studio site.

4. Why we process it, and on what legal basis

  • To answer your enquiry and research your market. Legal basis: legitimate interests, namely responding to someone who has approached us and deciding whether to take the work on. Where an engagement follows, the basis becomes performance of a contract.
  • To keep the site secure and working. Legal basis: legitimate interests in preventing abuse, diagnosing faults and maintaining availability.
  • To meet legal and accounting obligations. Legal basis: compliance with a legal obligation.
  • To set any non-essential cookie. Legal basis: your consent, which you may withdraw at any time.

Where we rely on legitimate interests, we have considered whether those interests are overridden by your rights, and concluded they are not. You may ask us for that assessment.

5. Who else sees it

We keep the circle deliberately small. Your data may be handled by:

  • Our hosting and email providers, acting as processors under written terms.
  • Professional advisers such as accountants and lawyers, where genuinely necessary.
  • A public authority, where we are legally required to disclose.

We do not share enquiry content with anyone outside the studio, and we do not discuss the substance of an enquiry with third parties. If you send a non-disclosure agreement with your first email, we will sign it.

6. International transfers

We operate from Sri Lanka and work with clients in several countries, so your data may be processed outside the UK and the European Economic Area. Where that happens, we rely on appropriate safeguards, which in practice means the UK International Data Transfer Addendum or the European Commission's Standard Contractual Clauses with our processors, together with any additional technical measures those clauses require. You may request a copy of the relevant safeguard.

7. How long we keep it

  • Enquiries that do not become engagements: up to twenty-four months, so that we recognise you if you come back, then deleted.
  • Client records: for the duration of the engagement and for seven years afterwards, which is the period our accounting and limitation obligations require.
  • Server logs: typically thirty days, as set by our hosting provider.

You can ask us to delete your correspondence earlier and we will, unless we are legally required to keep it.

8. Your rights

Under the UK and EU GDPR you have the right to:

  • Be told what personal data we hold about you, and get a copy of it.
  • Have inaccurate data corrected.
  • Have your data erased, where we have no overriding reason to keep it.
  • Restrict how we process your data while a question about it is resolved.
  • Receive your data in a portable, machine-readable format.
  • Object to processing carried out on the basis of legitimate interests.
  • Withdraw consent at any time, where consent is the basis we rely on.
  • Not be subject to a decision based solely on automated processing. We make no such decisions. Every judgement about your enquiry is made by a person.

Write to hello@bestwebdesign.lk and we will respond within one month. There is no charge unless a request is manifestly excessive, in which case we will tell you before doing anything.

If you are unhappy with how we have handled your data, you may complain to your national supervisory authority. In the United Kingdom that is the Information Commissioner's Office. In the European Union it is the authority for the country you live or work in. We would ask you to raise it with us first, but you are not obliged to.

9. Cookies

This site sets no cookies of its own. It stores nothing in your browser's local storage. If that ever changes, a consent banner will appear before any non-essential cookie is set, and this section will be updated to list every cookie, its purpose and its lifespan.

10. Security

The site is served over HTTPS. Access to correspondence is limited to the partners who need it, protected by multi-factor authentication. No system is perfectly secure, and we will not pretend otherwise, but if a breach occurs that is likely to result in a risk to your rights we will notify the relevant supervisory authority within seventy-two hours and tell you directly where the risk is high.

11. Changes to this policy

We will update this page when our practices change, and the date at the top will change with it. Material changes affecting people who have already written to us will be communicated by email.

12. Contact

Questions, requests and complaints about this policy all go to the same place: hello@bestwebdesign.lk.