Privacy Notice Overview
Last updated: 2 January 2026
This privacy notice tells you what to expect us to do with your personal information. It applies to visitors, prospective clients, and clients who interact with Velvet Dinosaur.
Key points summary
• We only collect information needed to deliver services, run the business, and meet legal duties.
• We use trusted suppliers and share only what is necessary for them to provide their services.
• We keep information for defined periods and delete it when it is no longer needed.
• You have clear rights over your data, and we respond to requests within one month.
Who We Are
Velvet Dinosaur is the data controller for the personal information we hold.
Business address
16 Holloway Lane
Minster Lovell
Witney
Oxfordshire
OX29 0AU
Contact Details
+44 7438 460437
privacy@velvetdinosaur.com
Personal Information We Collect
We collect or use personal information to provide our services, to run our business, and to meet legal obligations.
Information you provide
• Names and contact details (for example, email address and telephone number).
• Postal addresses (where needed for invoicing or contractual documents).
• Business details (such as company name and role).
• Enquiry and correspondence information (including emails and messages sent to us).
• Purchase or service history (such as the services you have requested from us).
• Content you provide to us for a project (for example, copy, images, and other materials).
• If we accept card payments, payment-related information needed to take payment. We do not store full card details.
Information collected automatically
• Website and technical data (such as IP address, device information, and server logs used for security and troubleshooting).
Why We Use Your Information
We use personal information to provide our services, to run our business, and to meet legal obligations.
• Responding to enquiries, providing quotes, and preparing proposals.
• Delivering website projects and ongoing support.
• Invoicing, payments, and accounting.
• Managing our relationship with you, including communications and updates.
• Maintaining security, preventing fraud, and troubleshooting technical issues.
• Meeting legal, regulatory, and tax obligations.
Lawful Bases for Processing
Under UK data protection law, we must have a lawful basis for collecting and using your personal information. Our lawful bases are:
• Contract: to enter into or carry out a contract with you (for example, to deliver website services).
• Legitimate interests: to run and improve our business (for example, responding to enquiries, preventing fraud, maintaining security, and improving our services).
• Legal obligation: to comply with legal requirements (for example, keeping accounting records).
• Consent: where you have given clear permission (for example, for marketing communications or optional cookies/analytics where used).
Your Data Protection Rights
Your data protection rights include the right of access, rectification, erasure, restriction, objection, and data portability. You also have rights in relation to automated decision-making and profiling.
If you make a request, we will respond without undue delay and in any event within one month.
Who We Share Information With
We use trusted suppliers (data processors) to help us deliver our services. Where we share data, we only share what is necessary and we require appropriate security measures.
Hosting & infrastructure (Hetzner)
We host our website and systems with Hetzner. This may involve processing names, contact details, and technical logs needed to operate and secure our services.
Backups (Hetzner Storage Box)
We store encrypted backups using Hetzner Storage Box (or equivalent Hetzner backup storage).
Domain registration & DNS (Spaceship)
We use Spaceship as our domain registrar (and, where applicable, DNS provider). This may involve processing domain registration details and contact information required to manage domains.
Email delivery & inbound processing (Postmark)
We use Postmark to send transactional emails (for example, form notifications) and to process inbound emails where this is part of the service provided. This may involve processing email content and metadata necessary to deliver and route messages.
Business communications (WhatsApp)
If you contact us via WhatsApp, messages are processed by WhatsApp Ireland Limited and/or Meta Platforms as part of providing that service. Please avoid sharing sensitive information via WhatsApp.
Payments (Stripe, if applicable)
If we accept card payments, payments are processed by Stripe. We do not store full card details. Stripe processes payment details on our behalf as a data processor. We share with Stripe the information needed to take payment (such as your name, email address, billing details, and transaction information).
Analytics (Google, if enabled)
We do not currently use analytics cookies. If we add analytics (such as Google Analytics) in future, we will update this notice and provide a cookie banner and choices to collect consent where required.
International Transfers
Some suppliers may process personal information outside the UK. Where this happens, we rely on appropriate safeguards such as UK adequacy regulations, the UK Extension to the EU-US Data Privacy Framework (where applicable), and/or standard contractual clauses.
Where We Get Personal Information From
• Directly from you (for example, when you contact us, request a quote, or become a client).
• From your use of our website and systems (for example, technical logs).
• From our suppliers (for example, payment confirmation from a payment provider, or delivery metadata from an email provider).
How Long We Keep Information
We keep personal information only for as long as necessary for the purposes set out in this notice, to provide our service, and to meet legal, accounting, or reporting requirements.
Type of information | Typical retention period
Enquiries and consultation requests | Up to 12 months
Client project communications (email/phone/WhatsApp) | Up to 24 months after project completion
Client project files and website content | For the duration of the service, and up to 12 months after the end of the contract (unless you request earlier deletion)
Backups | Rolling backups retained for up to 30 days
Invoices and accounting records | 6 years
Security logs | Typically 30-90 days (unless needed to investigate an incident)
How to Complain
If you have any concerns about our use of your personal information, you can make a complaint to us using the contact details above.
If you remain unhappy with how we have used your data after raising a complaint with us, you can also complain to the ICO.
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Helpline: 0303 123 1113
Website: ico.org.uk