Last updated: 29 September 2026
This policy explains what personal data I collect through omnisites.co.uk, when you contact me and when you’re my client. It covers what I do with that data, who helps me handle it, how long I keep it and what rights you have. It doesn’t cover visitors to the websites I build or host for clients (see “If I host or maintain your website”). I’ve tried to keep it clear and in plain English.
The short version
- This website doesn’t use analytics, advertising or tracking scripts, so there are no cookies for any of those.
- I don’t sell your data. I don’t send newsletters or marketing emails.
- My website, client portal and support system run on a server in London that I rent from DigitalOcean.
- A small number of service providers help me host, protect and back up the site, and send and receive email. They’re all listed below, and some of them process data outside the UK.
- You can ask to see, correct or delete the data I hold about you, or object to how I use it. Just email [email protected].
Who I am and how to contact me
I’m Jack Cooper and I run OmniSites on my own. I design, build, host and maintain websites for small businesses across the UK.
I’m the controller of the personal data described in this policy. That means I decide why and how it’s used, and I’m responsible for looking after it. The UK laws that apply are the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).
For anything to do with your personal data, email me at [email protected]. That includes questions about this policy and requests to use your rights.
If I host or maintain your website
When I host or maintain a client’s website, I may handle personal data about that website’s visitors and customers. For that data, my client is the controller and I’m their processor, which means I handle it only on their behalf. The agreement between me and my client covers this, not this policy.
If you visit or buy from one of my clients’ websites, please read that website’s own privacy policy, and contact that business about your data.
What personal data I collect and where it comes from
What I hold depends on how you deal with me.
If you visit my website
No website can work without your device sending it some technical information. When you visit omnisites.co.uk, the following is collected automatically from your browser or device:
- Server logs: my web server keeps access logs. They record your IP address, the date and time, the page you asked for, your browser’s user agent (which describes your browser and device) and the referring page (the page that linked you here, if there was one).
- Security and protection: every request to the site goes through Cloudflare, which protects it from attacks and abusive traffic. To do this, Cloudflare sees your IP address and browser information and may set security cookies (see the Cookies section below). Cloudflare may also ask your browser to report connection errors. This is called Network Error Logging, and it helps Cloudflare find and fix connection problems.
- Failed logins: if a login attempt fails, my security plugin records the IP address it came from. It may block IP addresses that behave abusively.
That’s all. The site has no analytics, advertising or tracking scripts, and no embedded videos, maps or social media widgets. Blog comments are switched off. My fonts are served from this website itself, so loading a page doesn’t send your details to a font provider.
If you contact me
- Contact form: your name, email address and message. The form also asks a simple maths question to stop spam, and your answer is only used for that check. Your message isn’t saved on the website. It’s emailed to me.
- Email: your email address, your name and anything you put in your message or attachments.
- WhatsApp: if you use the “Message on WhatsApp” button, I’ll see your phone number, your WhatsApp name and profile, and your messages.
All of this comes from you.
Contact form messages and other emails from my website are sent through Brevo, my email delivery service. All email to [email protected], including contact form messages, passes through Cloudflare, which forwards it to my Gmail inbox, where it’s stored. I reply from [email protected].
If you’re a client using the client portal
The client portal is only for clients. I create every account myself, and there’s no public sign-up. If you’re a client, I hold:
- Your portal account: your name, email address, username and password. Passwords are stored in hashed (scrambled) form, so I can’t read them.
- Client records: your name, email address and business name, plus your address and phone number if you give them to me. I also hold quotes, invoices, payment records, notes about our work together and a log of activity on your account.
- Support and change requests: what you send me through the portal, my replies, any files you upload, and details of anyone you name in a request.
- Login cookies: standard WordPress cookies that keep you signed in (see the Cookies section below).
Most of this comes from you, though I create some of it myself, such as quotes, invoices and notes. It’s stored in my website’s database on my server in London and managed with two plugins, Jetpack CRM (made by Automattic) and Fluent Support. Both run on my server, not on their makers’ systems, and the CRM doesn’t send your data to Automattic.
The database is backed up daily to Google Drive. Some of this data, such as support request notifications, is also sent by email. See “Who I share your data with” for details.
I’ve switched off open and click tracking in Jetpack CRM, so the emails it sends don’t contain tracking pixels.
The portal’s Website Status tab shows uptime figures for your websites, which my server fetches from UptimeRobot, a monitoring service. Nothing about you or your visit to the portal is sent to UptimeRobot.
If you’re named in a support request
Clients sometimes mention other people in support or change requests, such as a member of staff who needs a login or whose details should go on their website. If that’s you, I hold whatever details the client gives me about you, usually your name and contact details, along with the request itself.
This information comes from my client (the business that sent the request), not from you directly and not from public sources. I use it to provide the support my client asked for. I keep it for as long as I work with that client and then 6 years after, like their other records, in case of legal claims (see “How long I keep your data”). You have the same rights as anyone else under this policy, including the right to object.
Why I use your data and my lawful basis
Under UK GDPR, I need a valid reason, called a lawful basis, for each thing I do with personal data. This table shows what I use your data for and the basis I rely on.
| Purpose | Data | Lawful basis |
|---|---|---|
| Running the website and keeping it secure (Cloudflare, server logs, login protection) | IP address, browser and device details, pages requested, date and time, referring page, failed logins | Legitimate interests: keeping the site and its data secure and available |
| Replying to enquiries and giving quotes | Name, email address and message. For WhatsApp, your phone number, profile and messages. | Legitimate interests: replying to people who contact me. For quotes, it’s also steps you’ve asked me to take before a contract. |
| Providing my services to clients (portal, work, support, quotes, invoices, service emails) | Portal account, client records, quotes, invoices, support requests and attachments | Contract (or legitimate interests if the contract is with your business rather than you): providing the services you’ve asked for |
| Keeping financial records | Quotes, invoices, payment records and client contact details | Legal obligation: tax and accounting law requires me to keep financial records |
| Keeping records after we stop working together, in case of a dispute or legal claim | Client records, notes, portal account details, support requests and attachments, including details of anyone named in them | Legitimate interests: being able to establish or defend legal claims |
| Handling details of people named in support requests | Name, contact details and anything else my client gives me | Legitimate interests: providing the support my client asked for |
| Backing up the website | Everything in the website database, and the site files | Legitimate interests: making sure data isn’t lost and the site can be restored |
I don’t rely on your consent for any of this, so there’s no consent to withdraw. Where I rely on legitimate interests, you can object at any time (see “Your right to object” below). I don’t use your data for automated decision-making or profiling.
Do you have to give me your data?
No law requires you to give me your personal data. But if you don’t give me your name and email address (or message me on WhatsApp), I can’t reply to your enquiry.
If you become a client, your contact and business details are part of our contract. I need them to set up your portal account, do the work, handle support requests and send quotes and invoices, so without them I can’t work with you.
Your browser has to send technical details such as your IP address for any website to load, and the site needs them to stay secure.
Who I share your data with
I don’t sell your personal data or share it for anyone’s marketing. The only others who handle it are the service providers below, who host and protect the website, send and receive my email, and store backups.
| Provider | What they do | Where data is processed |
|---|---|---|
| DigitalOcean (US company) | Hosts my server, which stores the website, client portal, support requests and server logs. | London, UK |
| Cloudflare (US company) | Protects and speeds up the website, and forwards email sent to [email protected] to my inbox. | Cloudflare’s global network, including the United States |
| Brevo (Sendinblue SAS) | Sends email from the website and server, such as contact form messages, portal emails and support request notifications. | European Union (Brevo is based in France) |
| Google (US company) | Gmail stores email sent to [email protected]. Google Drive stores the website backups. | Google’s infrastructure, including the United States |
I also use UptimeRobot to check whether the websites I host are online. It only checks website addresses and doesn’t receive personal data about you or your visitors.
WhatsApp isn’t one of my service providers. The “Message on WhatsApp” button is an ordinary link to wa.me, so WhatsApp is only involved if you click it. If you then message me, WhatsApp (part of Meta) handles that conversation under its own privacy policy.
Apart from these providers, I’ll only share your data if the law requires me to, or if I need to in order to establish or defend a legal claim.
International transfers
My server is in London, so the live website, client portal and support system are stored in the UK. Some personal data does leave the UK, though. Every visit to the site passes through Cloudflare’s network. Email from the website is sent through Brevo, and email to me passes through Cloudflare and is stored in Gmail. A copy of the website database, including client records, portal accounts, support requests and security logs, is also backed up to Google Drive every day.
The providers involved are based in, or process data in, these places:
- European Union: Brevo is based in France. The UK recognises the EU and EEA as having adequate data protection, so no extra safeguards are needed.
- United States: Cloudflare (website protection and email forwarding) and Google (Gmail, and the website backups in Google Drive) process data in the US and elsewhere. DigitalOcean, which hosts my London server, is a US company. Where a provider is certified under the UK–US data bridge (the UK Extension to the EU–US Data Privacy Framework), that covers the transfer. Otherwise, I rely on safeguards approved under UK law, such as the International Data Transfer Agreement or the EU standard contractual clauses with the UK Addendum.
If you’d like more detail about these safeguards, email [email protected].
How long I keep your data
| Data | How long I keep it |
|---|---|
| Enquiries that don’t turn into work (contact form, email, WhatsApp) | 12 months from our last contact, then deleted |
| Client records, portal account, quotes, invoices, payment records and support requests, including details of anyone named in a request | For as long as I work with the client, then 6 years after that. Quotes, invoices and payment records are kept for tax and accounting. The rest is kept in case of legal claims. I close portal accounts when I stop working with a client. |
| Server access logs | About 3 weeks. A new log starts each week and the oldest is deleted. |
| Security logs (failed logins and blocked IP addresses) | Only as long as they’re needed for security. I clear them periodically. |
| Website backups | Up to 90 days on a rolling basis, then deleted |
The database is backed up daily and the site files weekly. When I delete something from the website, a copy may stay in a backup for up to 90 days until that backup is deleted. I only use backups to restore the website if something goes wrong.
Cookies
Cookies are small files that a website stores on your device. I only use cookies that are strictly necessary: to keep the website secure, to keep logged-in users signed in, and to remember dashboard settings that logged-in users have chosen. Under PECR, strictly necessary cookies don’t need your consent.
PECR also covers other technologies that store or read information on your device. This site also uses Cloudflare’s Network Error Logging. Cloudflare asks your browser to store a short instruction to report connection errors back to Cloudflare, so connection problems can be found and fixed. Its purpose is to help find and fix technical faults, so it’s also strictly necessary. Nothing on this site needs your consent, and that’s why there’s no cookie banner.
If you’re just browsing, the only cookies you’re likely to get are Cloudflare’s security cookies. The WordPress cookies are only used when you log in, or once you’re signed in.
| Cookie | What it does | How long it lasts |
|---|---|---|
| wordpress_test_cookie | Checks that your browser accepts cookies when you log in | Session (deleted when you close your browser) |
| wordpress_logged_in_ (followed by a unique code) | Keeps you signed in to the client portal | Session, or 14 days if you tick “Remember me” |
| wordpress_sec_ (followed by a unique code) | Keeps your login secure while you’re signed in | Session, or 14 days if you tick “Remember me” |
| wp-settings- and wp-settings-time- (each followed by your user number) | Only for logged-in users. They remember the settings you choose in the site’s dashboard, and when you last saved them, so it stays the way you left it. | 1 year |
| __cf_bm | Cloudflare security cookie: helps Cloudflare tell real visitors from automated bots | About 30 minutes |
| cf_clearance | Cloudflare security cookie: only set when you pass a security check, so you don’t have to do it again straight away | Depends on the site’s security settings, up to about 1 year |
You can block or delete cookies in your browser settings. If you block the login cookies, though, you won’t be able to sign in to the portal. If you block Cloudflare’s cookies, you may be asked to complete security checks more often.
Links to other websites
My homepage links to websites I’ve built for clients: reddogpetservices.co.uk, dselectricalely.uk and fenrock.com. They’re ordinary links. Those sites have their own privacy policies, and this policy doesn’t cover them.
How I keep your data secure
- The website uses an encrypted (HTTPS) connection.
- Cloudflare protects the site against attacks and malicious bots.
- A security plugin records failed logins and blocks abusive IP addresses.
- Portal passwords are stored in hashed form, never as plain text.
- There’s no public sign-up for the client portal.
- Regular backups mean data can be restored if something goes wrong.
No website or online service can be completely secure, but I take reasonable steps to protect your data. If a breach is likely to put you at high risk, I’ll tell you, and I’ll report breaches to the ICO where the law requires.
Your rights
Under UK GDPR you have the right to:
- Access: ask for a copy of the personal data I hold about you. This is called a subject access request.
- Correction (rectification): ask me to correct data that’s wrong or incomplete.
- Deletion (erasure): ask me to delete your data.
- Limiting use (restriction): ask me to limit how I use your data, for example while we check whether it’s accurate.
- Data portability: ask for a copy of the data you’ve given me in a common digital format (such as a spreadsheet), or ask me to send it to someone else. This applies to data I hold electronically to provide my services to you.
- Automated decisions: you have rights if an important decision about you is made entirely by computer, with no person involved. I don’t make any decisions like this.
Your right to object
Where I rely on legitimate interests (see “Why I use your data and my lawful basis” above), you can object at any time by emailing [email protected]. I’ll stop unless I have strong, legitimate reasons to carry on that outweigh your interests, rights and freedoms, or I need the data to establish or defend a legal claim.
How to make a request
To use any of these rights, email [email protected]. You don’t need a special form or special wording. Before I act, I may need to ask for information to confirm who you are.
Making a request is free. I’ll reply within one month. If your request is complex, or you’ve sent several, I can take up to two months longer. If so, I’ll tell you within the first month and explain why. I can only charge a reasonable fee, or refuse, if a request is clearly unfounded or excessive.
Some of these rights have limits. For example, I can’t delete invoices before the end of the period that tax law says I must keep them. If I can’t do what you ask, I’ll explain why.
Complaints
If you’re unhappy with how I’ve handled your data, please tell me first at [email protected]. I’ll acknowledge your complaint within 30 days, do my best to put it right, and let you know the outcome as quickly as I can.
If you’re still not happy, you can complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator. Their website is ico.org.uk/make-a-complaint and their helpline is 0303 123 1113.
Children
My website and services are for businesses, and I only work with people aged 18 or over. I don’t knowingly collect personal data from children. If you think a child has sent me their details, please email [email protected] and I’ll delete them.
Changes to this policy
I’ll update this policy whenever the way I handle personal data changes, for example if I start using a new service provider. The date at the top shows when it was last updated. If I make an important change that affects clients, I’ll also email my clients to let them know.