Privacy policy
1. Who we are and what this policy covers
1.1 Spectacle Ltd ("Spectacle", "we", "us") is a family-run company that designs and builds websites and looks after them through Website Care, our managed hosting and maintenance plans. We are registered in England and Wales (company number 17469934), and our registered office is at 9 Mistle Way, Thursby, Cumbria, CA5 6ES. We are registered with the Information Commissioner's Office (ICO) under number ZC278116.
1.2 We are the controller of the personal data described in this policy. You can contact us about it at [email protected], or through the Dashboard if you are a customer.
1.3 This policy explains how we handle personal data about:
- visitors to our website, usespectacle.net;
- people who enquire about our services;
- our customers and their staff, including users of our Dashboard at app.usespectacle.net;
- freelancers, partners and suppliers we work with;
- people who join our referral programme, and the customers they refer.
1.4 This policy does not cover visitors to the websites we build or host for our customers. For that data, our customer is the controller and we act as their processor under our Data Processing Agreement. Please read the privacy policy on the website you visited, or contact its owner.
2. Information we collect
2.1 Information you give us
- Contact and account details: your name, business name, job title, email address, postal address and Dashboard login details.
- Billing details: billing address and payment history. Your card details are collected and stored by Stripe, our payment provider. We never see or store your full card number.
- Eligibility details: if you apply for a special offer, information such as your company registration date or trading address.
- Project and support information: messages, files, feedback and requests you send us through the Dashboard or by email, and the content you give us for your website.
- Marketing preferences: whether you have signed up to our newsletter.
- Referral programme details: if you join our referral programme, your name, email address, business name (if you have one), UK bank details for payments, and your VAT number if you are VAT registered.
2.2 Information we collect automatically
- Website usage: pages visited, referring site, browser and device type, and approximate country, collected through our own privacy-friendly analytics that do not use cookies or identify you personally.
- Dashboard usage: when you are logged in to the Dashboard, the pages and features you use, linked to your account, so that we can improve the Dashboard and help you when you need support.
- Dashboard activity and security logs: when you log in (and failed attempts to log in to your account), and the actions taken in your account, by you or by our team, such as saving details, sending a request or accepting a quote. Each entry records when it happened, the page, your IP address and your browser and device type. It does not record what you type into forms. We use these logs to keep accounts secure, to look into problems, and to show what happened if a payment is disputed.
- Agreeing to our terms: when you create an account and when you buy a plan, we record that you agreed to our terms, when, which version, and the IP address you agreed from.
2.3 Information from others
- Public records such as Companies House, to check eligibility for offers.
- Details passed to us by someone who refers you to us, such as a partner or affiliate.
2.4 We do not knowingly collect special category data, such as health information, and we ask you not to send it to us. Our services are not aimed at children.
3. How we use your information
3.1 UK data protection law requires a lawful basis for each way we use personal data. These are ours:
| What we use it for | Lawful basis |
|---|---|
| Setting up and running your account, and providing our services | Contract |
| Taking payments, issuing invoices and keeping accounting records | Contract and legal obligation |
| Answering enquiries before you become a customer | Legitimate interests (responding to people who contact us) |
| Sending service messages about your account, billing, maintenance and changes to our terms | Contract |
| Checking eligibility for special offers | Legitimate interests (making sure offers go to those who qualify) |
| Keeping our systems, Dashboard and customers' websites secure | Legitimate interests (security and fraud prevention) |
| Keeping a log of activity in your account and a record of when you agreed to our terms, so that we can investigate problems, show what was agreed and respond if a payment is disputed | Legitimate interests (security, and establishing, exercising or defending legal claims) |
| Understanding how our website is used, so that we can improve it | Legitimate interests (improving our website) |
| Sending our newsletter and offers | Consent. We only send it to people who have opted in |
| Showing work in our portfolio | Legitimate interests (promoting our business), with your right to object under our Terms |
| Dealing with complaints and legal claims | Legitimate interests and legal obligation |
| Running the referral programme: tracking referrals and paying commission | Contract |
| Keeping records of commission paid, for our accounts and HMRC | Legal obligation |
| Checking for referral fraud or misuse | Legitimate interests (protecting our business and customers) |
| Understanding how customers use the Dashboard, linked to their account, so that we can improve it and support them | Legitimate interests (improving our services and support) |
3.2 You can unsubscribe from marketing emails at any time, using the link in every email or in the Dashboard. Service messages are not marketing, so you will still receive them while you are a customer.
3.3 We do not sell your personal data. We do not make decisions about you using solely automated processing.
3.4 If someone referred you to us, we record who referred you so that we can pay them. We only show them your business name and the status of the referral. We never show them what you bought or what you paid.
4. Who we share it with
4.1 We share personal data only with providers who help us run our business. Each one is under a contract that requires them to protect the data and use it only on our instructions. We use these types of provider, and can tell you the names of the providers we use if you ask:
| Type of provider | What they do for us | Where the data is held |
|---|---|---|
| Payment provider | Card payments, subscriptions and invoices | UK, EU and US |
| Email and productivity provider | Business email, documents and calendar | UK, EU and US |
| Hosting provider | The servers that run our website and the Dashboard | UK |
| Website security and performance provider | Security, speed and DNS for our website and the Dashboard | Global network |
| Email delivery provider | Sending Dashboard notifications, reminders and invoices | UK, EU and US |
| Accounting software | Bookkeeping and tax records | UK |
4.2 We may also share personal data with:
- freelancers who work on your project, such as copywriters or photographers, and only what they need;
- our professional advisers, such as our accountant, lawyers and insurers;
- the police, HMRC or other authorities, where the law requires it;
- a buyer of our business, if Spectacle is ever sold, who would continue to protect your data under this policy.
4.3 If you dispute a payment with your bank, we send Stripe, and through Stripe your bank and card network, the evidence needed to respond. This can include your name, contact and billing details, what you bought and when you agreed to our terms, the work we did, our messages with you, and your log-ins and activity in the Dashboard with their IP addresses.
5. International transfers
5.1 Some of our providers store or access data outside the UK. When this happens, we make sure the data is protected by one of the following:
- the country has a UK adequacy decision, as the EU and EEA countries do;
- for the US, the provider is certified under the UK Extension to the EU-US Data Privacy Framework;
- the provider has signed the UK International Data Transfer Agreement, or the EU Standard Contractual Clauses with the UK Addendum.
5.2 You can ask us for more detail about the safeguards for a particular provider.
6. How long we keep it
6.1 We keep personal data only for as long as we need it:
| Information | How long we keep it |
|---|---|
| Enquiries that do not lead to work | 12 months from our last contact |
| Account and contract records | For as long as you are a customer, then 6 years (the time limit for legal claims) |
| Invoices and payment records | 6 years from the end of the financial year they relate to (HMRC requirement) |
| Support and project messages | For as long as you are a customer, then 2 years |
| Your website files and data, when you leave | 30 days, then deleted (see our Terms) |
| Website backups | 30 days, on a rolling basis |
| Dashboard activity and security logs (log-ins, actions, IP addresses) | 24 months, then deleted |
| Records of when you agreed to our terms | For as long as you are a customer, then 6 years (the time limit for legal claims) |
| Evidence sent for a disputed payment | 6 years from the dispute (the time limit for legal claims) |
| Newsletter subscription | Until you unsubscribe. We then keep your email address on a do-not-contact list so that we do not email you again |
| Referral programme account and bank details | While you are in the programme, then 2 years |
| Commission payment records | 6 years from the end of the financial year they relate to (HMRC requirement) |
| Website and Dashboard analytics | 13 months, then deleted automatically |
6.2 When the time is up, we securely delete or anonymise the data.
7. Cookies and analytics
7.1 Our website uses our own privacy-friendly analytics, which we run ourselves and do not share with any analytics company. They do not use cookies and do not track you across other websites.
7.2 The same analytics run in the Dashboard. When you are logged in, we link the pages and features you use to your account, as explained in section 2.2. You can object to this at any time (section 8).
7.3 The Dashboard uses strictly necessary cookies to keep you logged in and secure. These do not need your consent.
7.4 If we ever add cookies that are not strictly necessary, we will ask for your consent first and list them in a Cookie Policy.
8. Your rights
8.1 Under UK data protection law, you have the right to:
- access the personal data we hold about you and get a copy of it;
- correct data that is wrong or incomplete;
- delete your data, where we no longer have a reason to keep it;
- restrict how we use your data while a concern is looked into;
- object to our using your data based on legitimate interests, including for direct marketing, which we will always stop;
- move data you gave us to another provider, in a commonly used format;
- withdraw consent at any time, where we rely on it.
8.2 To use any of these rights, contact us at [email protected] or through the Dashboard. We may ask you to confirm your identity. We will respond within one month, and there is usually no charge.
9. Security, complaints and changes
9.1 We protect your data with encryption in transit, two-factor authentication on our business accounts, access limited to the people who need it, and providers chosen for their security. If a data breach is likely to put you at risk, we will tell you and the ICO as the law requires.
9.2 If you are unhappy with how we have handled your data, please tell us first, so that we can put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113.
9.3 We may update this policy from time to time. We will post the new version here with a new date, and tell customers about significant changes through the Dashboard.