Privacy policy

Your data, handled properly

What we collect, why we collect it, who else sees it and how to get a copy or have it deleted. It’s written in plain English and sets out your rights under UK GDPR.

Last updated 8 September 2026 · UK GDPR & DPA 2018

OneTapWeb builds and hosts websites, and the software behind them, for small businesses and sole traders across the UK. This policy explains what we do with personal information, whether you are a client, an enquiry, or a customer of a business whose site we run.

01Who we are

OneTapWeb ("we", "us", "our") is a UK business based in Eastleigh, Hampshire. We operate this website at onetapweb.co.uk, the client hub at hub.onetapweb.co.uk, and the websites we build and host for our clients on their own domains.

We are the data controller for information you share with us directly: enquiries, client accounts and billing. That means we decide how and why it is used, and we are accountable for looking after it.

Where you are a customer of one of our clients, for example you booked an appointment or placed an order on a site we host, we act as a data processor on that business's behalf. They are the controller of their own customer list, and their privacy policy governs what they do with it. We process it only to make the booking, order or payment work.

02What we collect

We collect what we need to run the service, and no more. In practice it falls into a few buckets:

From enquiries and lead forms
Name, email, phone number, business name and business type. Collected when you fill in a form on this site, message us on WhatsApp, or respond to one of our ads.
From clients
Business details (address, opening hours, services, prices), your hub login email, billing address, and a payment method. Card and bank details are held by Stripe. We never see a full card number.
From your customers
Where your site has booking, quoting, a shop, food ordering or a contact form, we process the end-customer's name, contact details, appointment or order details and payment reference on your behalf, as processor. You stay the controller of your customer list.
Automatically
Standard web server logs: IP address, browser type, pages visited and referrer. Plus privacy-respecting analytics (Umami), which sets no advertising cookies and does not follow you across other sites.
From ad platforms
If you reply to a Meta (Facebook or Instagram) lead ad, Meta passes us the name, email and phone number you submitted. The ad's own privacy notice links to this page.

We do not collect special category data (health, ethnicity, beliefs and so on) about you. If your business records that sort of thing about your own customers, for example treatment notes in a salon, you are the controller of it and you should say so in your own privacy policy.

03Why we collect it

Under UK GDPR every piece of data needs a lawful basis. We rely on one of four:

  • Contract. To deliver the service you are paying for: build the site, host it, run your bookings and invoices, take payment, answer support requests.
  • Legitimate interests. To reply to enquiries, keep the service secure, prevent fraud, and occasionally tell an existing client about a feature that affects them.
  • Consent. For marketing email to people who are not already clients. We only send it if you asked for it, and every message has a one-click unsubscribe.
  • Legal obligation. To keep financial records for HMRC, or to answer a valid legal request.

04How we use your data

Specifically, we use your information to:

  • Build, deliver and host your website
  • Contact you about your enquiry or your account, by email, phone, WhatsApp or SMS
  • Collect your monthly subscription and any agreed one-off charges through Stripe
  • Send invoices, receipts and service notices
  • Run the bookings, quotes, orders and payments your site takes, on your behalf
  • Provide support when something needs changing or fixing
  • Monitor our systems for uptime, security and abuse
  • Now and then, let existing clients know about a new feature, with an unsubscribe link every time
The short version

We do not sell, rent or trade personal data. That applies to your data and to your customers' data. No advertising network is involved anywhere in this.

05Who we share it with

A small number of suppliers keep the service running. Each is contractually required to protect your data to at least the standard we do, and none of them get it for their own marketing:

  • Stripe. Payment processing for subscriptions, invoices, bookings and orders. Handles card and bank details so we never have to.
  • Twilio. SMS delivery for booking reminders and order notifications.
  • Our UK hosting provider. Runs the servers your website and account data live on.
  • Umami. Website analytics, self-hosted by us, no advertising or cross-site tracking.
  • Hostinger. Our business email, so anything you send to hello@onetapweb.co.uk is stored there. They also provide part of our hosting.
  • Meta. Only if you submitted a Facebook or Instagram lead ad form, in which case your details reached us through Meta's lead ads system.

We will also disclose data where we are legally required to, for example a court order or a valid request from HMRC or law enforcement. If we ever sold or restructured the business, client data would transfer with it, and you would be told before that happened.

06How long we keep it

Enquiries that never became clients
12 months, then deleted.
Active client accounts
For as long as you are with us, then six years after cancellation, because HMRC requires business records to be kept that long.
Financial records
Invoices and receipts, six years, per HMRC.
Your customers' booking and order data
Kept while your subscription runs, because it is your business record. Deleted or exported to you on request, and on cancellation once you have had the chance to take a copy.
Web analytics and server logs
90 days. Aggregated counts are not linked to an identifiable person.
Marketing consent
Until you withdraw it, one click, in any email we send.

07Your rights

Under UK GDPR you have the following rights over your personal data. We honour every one of them inside one calendar month of a valid request, and we do not charge for it.

Your UK GDPR rights, in plain English

Access. Get a copy of everything we hold about you.

Rectification. Correct anything wrong or out of date.

Erasure. The "right to be forgotten": have your data deleted, unless we are legally required to keep it, such as HMRC records.

Restriction. Tell us to hold your data but stop using it while a dispute is sorted out.

Portability. Get your data in a machine-readable format to take elsewhere.

Object. Stop us processing your data for marketing, or for anything based on legitimate interests.

Withdraw consent. At any time, for anything you previously consented to.

To use any of these, email hello@onetapweb.co.uk.

If your request is about data held on a client's site, for example you want a salon to delete your appointment history, we will point you to that business, since they are the controller. Ask us and we will pass the request on and help them action it.

08Cookies & tracking

This site sets almost no cookies. The only ones are:

  • Essential. Keep you signed in to the hub, hold a shop basket, and carry your session between pages. These do not need consent.

Our analytics (Umami, self-hosted on our own server) is cookieless. It counts visits without storing an identifier on your device and without following you across other sites, which is why you are not being nagged by a cookie banner.

We do not run Google Analytics, the Meta pixel, or any other third-party advertising tracker on this marketing site. Client sites are a separate matter: a client may choose to add their own analytics or ad tags to their site, which is their decision and falls under their privacy policy, not this one.

09Security

Practical, proportionate measures, rather than a list of buzzwords:

  • All traffic runs over HTTPS, TLS 1.3 where the browser supports it.
  • Passwords are hashed with bcrypt and never stored in readable form.
  • Database backups run daily, encrypted at rest, kept 30 days.
  • Card details never touch our servers. Stripe handles that end of it entirely.
  • Access to production systems is limited to named people with multi-factor authentication.

If a breach happened that was likely to affect your rights, we would report it to the ICO within 72 hours and contact you directly without waiting.

10International transfers

Our servers and day-to-day operations are in the UK. A few suppliers (Stripe, Twilio, Meta) are based outside the UK or may process data outside the UK and EEA, typically in the United States or the EU. Where that happens we rely on the UK International Data Transfer Agreement, the UK Addendum, or the European Commission's Standard Contractual Clauses, so your data keeps UK-level protection wherever it sits.

11Changes to this policy

We update this policy when we add a feature, change a supplier, or when the law moves. The "last updated" date at the top always reflects the current version. Where a change materially affects your rights we email existing clients before it takes effect.

12Contact & complaints

Any question about your data, or this policy, get in touch. We are too small to be required to appoint a Data Protection Officer under UK GDPR, so requests go straight to the person who runs the business.

WhatsApp Message 07599 883 585
Email hello@onetapweb.co.uk
Trading address Eastleigh, Hampshire, UK
Hours Mon to Fri, 9am to 6pm
Data requests One address, straight to us

We reply within three working days, usually a lot sooner. Formal data requests are answered inside one calendar month.

Complaining to the ICO

If you are unhappy with how we have handled your data and we have not been able to put it right between us, you can complain to the UK's Information Commissioner's Office:

  • Online: ico.org.uk/make-a-complaint
  • Phone: 0303 123 1113
  • Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF