Privacy Policy

Illume Web Design ("Illume", "we", "us" or "our") is a UK web design business based in Darlington. This notice explains how we use personal information when you visit our website, contact us, create an account, request a website, or use our client and managed website services.

Who is responsible for your information?

YOUR REAL LEGAL BUSINESS IDENTITY, trading as Illume Web Design from YOUR FULL GEOGRAPHIC BUSINESS ADDRESS, is the controller of the personal information described in this notice. You can contact us about privacy at support@illumewebdesign.co.uk.

Information we collect

Depending on how you use Illume, we may process your name, business name, email address, account and authentication information, website details, project briefs, messages, revision and care requests, files you upload, website previews and approvals, project activity, invoices and payment records, Stripe customer/payment identifiers and payment or subscription status, and technical or security information generated when you use the service.

Please avoid uploading unnecessary sensitive personal information. If project material contains information about other people, you are responsible for making sure you have a lawful basis to provide it to us.

Why we use your information and our lawful bases

We use information to respond to enquiries and assess project requests; create and administer client accounts; provide website design, development, handover and managed website services; communicate about projects; maintain project records; issue and administer invoices and payments; protect accounts and systems from misuse; meet tax, accounting and other legal obligations; and establish, exercise or defend legal claims.

Our main lawful bases are taking steps at your request before entering a contract and performing a contract with you, complying with legal obligations, and our legitimate interests in operating, securing and improving Illume and keeping appropriate business records. Where consent is specifically required, we will ask for it separately and you can withdraw it for future processing.

Who we share information with

We use service providers to run Illume. These currently include Supabase for authentication, database and private project storage; Vercel for website hosting and deployment; Zoho for business email; and Stripe for online website-build payments, saved payment methods, recurring Managed Website billing, invoices/receipts and billing-account management. We may also share information with professional advisers, accountants, insurers, regulators, law-enforcement bodies or other parties where reasonably necessary or legally required.

When you pay through Stripe, payment-card details are entered into Stripe's secure payment interface rather than Illume's project database. Illume stores identifiers and status information needed to match the payment or subscription to your website project, but not your full card number or card security code. Stripe may also process information for fraud prevention, security and regulatory purposes under its own applicable terms and privacy information.

International processing

Some technology providers may process information in the UK, EEA or other countries depending on their infrastructure and our service configuration. Where UK data protection law requires safeguards for an international transfer, we rely on an applicable adequacy regulation or appropriate contractual and organisational safeguards made available by the relevant provider.

How long we keep information

We keep personal information only for as long as reasonably needed for the purpose for which it was collected and for legal, accounting, security and dispute-resolution requirements. As a general working policy, enquiries that do not become projects may be retained for up to 12 months; security/activity records may be retained for up to 12 months; operational project records are kept while the project or managed service is active; and core contractual, invoice and payment records may be retained for up to 6 years after the relevant relationship ends. Uploaded working files may be removed sooner when they are no longer needed for an active project or support obligation.

We may keep limited information for longer where required by law, where a dispute or legal claim is reasonably anticipated, or where deletion is not immediately possible from secure backups.

Security

Illume uses authenticated accounts, role-based access controls, database row-level security and private storage for client project information. Client access is scoped to the projects they own, while administrative access is protected by role checks, row-level security and required multi-factor authentication for the Illume Admin account. No internet service can guarantee absolute security, so we also keep access and retention under review.

Cookies and local storage

Illume may use cookies or similar browser storage that are necessary for account authentication, security and core website functionality. We do not currently describe optional advertising or behavioural tracking as part of the service. If non-essential analytics, advertising or similar technologies are introduced, we will update our information and obtain consent where required before they are used.

Your data protection rights

Depending on the circumstances, you may have rights to be informed, access your personal information, correct inaccurate information, request erasure, restrict or object to processing, receive portable information, and withdraw consent where processing relies on consent. These rights are not absolute and legal or contractual record-keeping requirements may sometimes apply.

To exercise a right, email support@illumewebdesign.co.uk. We may need to verify your identity before completing a request.

Data protection complaints

If you believe we have handled personal information incorrectly, please email support@illumewebdesign.co.uk with enough information for us to understand the issue. We will provide a clear route for complaints, acknowledge a data protection complaint within 30 days, investigate it appropriately and communicate the outcome without undue delay.

You also have the right to complain to the UK Information Commissioner’s Office (ICO). You can find current complaint and contact information at ico.org.uk.

Changes to this policy

We may update this notice as Illume’s services, suppliers or legal obligations change. The date shown below indicates when this version was last updated. Material changes will be reflected on this page before or when the relevant processing changes.

Legal · Last updated 18 August 2026