Velvet Dinosaur - Privacy Notice

Last updated: 25 August 2026

This privacy notice tells you what to expect us to do with your personal information. It applies to visitors, prospective clients, and clients who interact with Velvet Dinosaur.

Key points summary

• •We only collect information needed to deliver services, run the business, and meet legal duties.
• •We use trusted suppliers and share only what is necessary for them to provide their services.
• •We keep information for defined periods and delete it when it is no longer needed.
• •You have clear rights over your data, and we respond to requests within one month.

Velvet Dinosaur Web Design Ltd, trading as Velvet Dinosaur (“Velvet Dinosaur”, “we”, “us”). Registered in England and Wales.

Company number 17419510

Registered office: 16 Holloway Lane, Minster Lovell, Witney, Oxfordshire OX29 0AU, UK

General enquiries: hello@velvetdinosaur.com

Data protection: privacy@velvetdinosaur.com

Phone: +44 7962 705433

We collect or use personal information to provide our services, to run our business, and to meet legal obligations.

Information you provide

• •Names and contact details (for example, email address and telephone number).
• •Postal addresses (where needed for invoicing or contractual documents).
• •Business details (such as company name and role).
• •Enquiry and correspondence information (including emails and messages sent to us).
• •Purchase or service history (such as the services you have requested from us).
• •Content you provide to us for a project (for example, copy, images, and other materials).
• •If we accept card payments, payment-related information needed to take payment. We do not store full card details.

Information collected automatically

• •Website and technical data (such as IP address, device information, and server logs used for security and troubleshooting).

We use personal information to provide our services, to run our business, and to meet legal obligations.

• •Responding to enquiries, providing quotes, and preparing proposals.
• •Delivering website projects and ongoing support.
• •Invoicing, payments, and accounting.
• •Managing our relationship with you, including communications and updates.
• •Maintaining security, preventing fraud, and troubleshooting technical issues.
• •Meeting legal, regulatory, and tax obligations.

Under UK data protection law, we must have a lawful basis for collecting and using your personal information. Our lawful bases are:

• •Contract: to enter into or carry out a contract with you (for example, to deliver website services).
• •Legitimate interests: to run and improve our business (for example, responding to enquiries, preventing fraud, maintaining security, and improving our services).
• •Legal obligation: to comply with legal requirements (for example, keeping accounting records).
• •Consent: where you have given clear permission (for example, for marketing communications or optional cookies/analytics where used).

Your data protection rights include the right of access, rectification, erasure, restriction, objection, and data portability. You also have rights in relation to automated decision-making and profiling.

If you make a request, we will respond without undue delay and in any event within one month.

We use trusted suppliers (data processors) to help us deliver our services. Where we share data, we only share what is necessary and we require appropriate security measures.

Hosting & infrastructure (Hetzner)

We host our website and systems with Hetzner. This may involve processing names, contact details, and technical logs needed to operate and secure our services.

Backups (Hetzner Storage Box)

We store encrypted backups using Hetzner Storage Box (or equivalent Hetzner backup storage).

Domain registration & DNS (Spaceship)

We use Spaceship as our domain registrar (and, where applicable, DNS provider). This may involve processing domain registration details and contact information required to manage domains.

Email delivery & inbound processing (Postmark)

We use Postmark to send transactional emails (for example, form notifications) and to process inbound emails where this is part of the service provided. This may involve processing email content and metadata necessary to deliver and route messages.

Business communications (WhatsApp)

If you contact us via WhatsApp, messages are processed by WhatsApp Ireland Limited and/or Meta Platforms as part of providing that service. Please avoid sharing sensitive information via WhatsApp.

Payments (Stripe, if applicable)

If we accept card payments, payments are processed by Stripe. We do not store full card details. Stripe processes payment details on our behalf as a data processor. We share with Stripe the information needed to take payment (such as your name, email address, billing details, and transaction information).

Analytics (Google, if enabled)

We do not currently use analytics cookies. If we add analytics (such as Google Analytics) in future, we will update this notice and provide a cookie banner and choices to collect consent where required.

The business reviews page uses Google Maps Platform. Google review content is requested only after you choose to show it. We store the business's Google Place ID, but we do not store the review text, reviewer profile, rating, or other Places content returned for that request. Google processes information under the Google Privacy Policy: https://policies.google.com/privacy.

Tripadvisor listing links take you to Tripadvisor. An official Tripadvisor widget will load third-party content only if the site is eligible, the feature has been enabled, and you choose to show it. Tripadvisor may then process technical data and use cookies under its own privacy and cookie terms.

Some suppliers may process personal information outside the UK. Where this happens, we rely on appropriate safeguards such as UK adequacy regulations, the UK Extension to the EU-US Data Privacy Framework (where applicable), and/or standard contractual clauses.

• •Directly from you (for example, when you contact us, request a quote, or become a client).
• •From your use of our website and systems (for example, technical logs).
• •From our suppliers (for example, payment confirmation from a payment provider, or delivery metadata from an email provider).

We keep personal information only for as long as necessary for the purposes set out in this notice, to provide our service, and to meet legal, accounting, or reporting requirements.

Type of information | Typical retention period

Enquiries and consultation requests | Up to 12 months

Client project communications (email/phone/WhatsApp) | Up to 24 months after project completion

Client project files and website content | For the duration of the service, and up to 12 months after the end of the contract (unless you request earlier deletion)

Backups | Rolling backups retained for up to 30 days

Invoices and accounting records | 6 years

Security logs | Typically 30-90 days (unless needed to investigate an incident)

We sometimes approach organisations directly to introduce our services.

Where we get the details: professional contact information published on business websites, public directories, and similar publicly available business sources. We do not buy marketing lists of personal contact details.

What we use: business names, business email addresses, business telephone numbers, and the address of the organisation's website. We use these only to make a relevant business-to-business approach about website design, hosting and maintenance.

Our lawful basis: legitimate interests — promoting a small business to organisations we reasonably believe would benefit. We keep this proportionate: a small number of relevant approaches, never high-volume or automated bulk mailing.

Your right to object: tell us to stop and we will, without argument. We record your details on a suppression list so you are not contacted again, and we keep only what is needed to honour that.

To object, or to ask what we hold, email privacy@velvetdinosaur.com.

If you have any concerns about our use of your personal information, you can make a complaint to us using the contact details above.

If you remain unhappy with how we have used your data after raising a complaint with us, you can also complain to the ICO.

Information Commissioner's Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

SK9 5AF

Helpline: 0303 123 1113

Website: ico.org.uk