Privacy Policy

1. Who we are

Found First Media is a WordPress web design agency based in Brooke near Norwich, Norfolk. We design, build, and support high-performing websites and local SEO solutions for UK businesses.

For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, the data controller is Found First Media. Our registered contact address is 33 Norwich Road, Brooke, Norfolk NR15 1AB.

2. What information we collect

We only collect personal information that is relevant and necessary for our business interactions with you:

• Quote and contact form details: When you complete the contact and quote form on our website, we collect your full name, email address, telephone number, company website URL (if provided), estimated project budget, the service you need, and any details you share in your project message.
• Direct communications: Information you provide when contacting us directly by telephone, email, or post, including enquiry context, meeting notes, and correspondence.
• Technical data: When you visit our website, your browser automatically transmits technical information such as your Internet Protocol (IP) address, browser type and version, device identifier, and operating system.
• No payment card data collected: We do not collect or process debit or credit card details through this website. Any commercial client payments are handled through direct bank transfers or invoiced arrangements.

3. How we use your information

We use the information we hold about you to:

• Review your enquiries, communicate with you, and prepare accurate, tailored fixed-price proposals and quotes.
• Deliver web design, development, maintenance, and SEO services under contract once you engage us.
• Manage our client relationship, billing, invoicing, and service communications.
• Operate, monitor, protect, and improve the performance and security of our website.
• Comply with applicable legal, accounting, and statutory requirements in the United Kingdom.

We never sell your data: Found First Media does not sell, rent, or trade your personal information to third parties for commercial or marketing gain. We will only send direct marketing communications with your explicit prior consent, or to existing business clients where permitted by PECR, and you can unsubscribe at any time.

4. Lawful bases for processing

Under UK GDPR Article 6, we rely on the following lawful bases when processing your personal data:

• Contractual necessity: To take pre-contractual steps at your request (such as providing a quote) or to perform a contract for web design and maintenance services.
• Legitimate interests: To operate, safeguard, and develop our agency business, respond to general enquiries, prevent fraud, and maintain website stability.
• Legal obligation: To satisfy statutory record-keeping, corporate governance, and tax reporting requirements under UK law.
• Consent: Where you have explicitly opted in to receive specific communications, which you can withdraw at any time.

5. Who we share it with

We may share your data with trusted service providers who assist us in operating our business:

• Hosting and infrastructure providers: Secure UK and European hosting platforms that host our website and maintain server uptime.
• Email and form-handling services: Providers who route and manage our email correspondence and quote submissions.
• Professional advisers: Accountants, legal advisers, and insurers when necessary to obtain advice or meet regulatory compliance.
• Law enforcement and regulatory authorities: In circumstances where we are legally compelled to disclose information.

All third-party data processors act strictly on our documented instructions, are bound by contractual confidentiality terms, and must implement appropriate technical and organisational security measures.

6. Cookies and third-party services

Our website uses essential session cookies necessary for basic site functionality and security token verification on form submissions.

7. How long we keep your information

We retain your personal data only for as long as is necessary to satisfy the purposes for which it was obtained:

• General enquiries and proposals: If an enquiry does not result in an ongoing commercial contract, we retain your contact details and message for up to 12 months from our last communication, after which they are deleted.
• Client records and contracts: For active clients, we keep project files, correspondence, and contracts throughout our working relationship. Invoices and accounting records are kept for 6 years following the end of the relevant financial tax year, in compliance with UK HMRC rules.

When retention periods expire, records are securely deleted or irreversibly anonymised.

8. Security

We take the security of your personal data seriously and implement appropriate technical and organisational precautions to protect it against accidental loss, unauthorised access, modification, or disclosure.

All data transmitted through our website is encrypted using modern Transport Layer Security (HTTPS / SSL). Access to client accounts and enquiry records is strictly restricted to authorised personnel on a need-to-know basis.

9. International transfers

While our core operations are based within the United Kingdom, some of our third-party infrastructure providers or email systems may process data outside the UK or European Economic Area (EEA).

Where such transfers take place, we ensure appropriate safeguards are implemented in accordance with UK data protection regulations, such as the UK International Data Transfer Agreement (IDTA), UK Addendum to EU Standard Contractual Clauses, or an adequacy decision by the UK Government.

10. Your data protection rights

Under UK data protection law, you have specific rights regarding your personal information:

• Right of access: You can request a copy of the personal information we hold about you (a Subject Access Request).
• Right to rectification: You can ask us to correct inaccurate information or complete incomplete data.
• Right to erasure: You can ask us to delete your personal data under certain conditions (the right to be forgotten).
• Right to restriction: You can ask us to restrict the processing of your data while a complaint or accuracy check is investigated.
• Right to data portability: You can request that we transfer data you provided to you or another provider in a structured, machine-readable format.
• Right to object: You can object to processing based on legitimate interests or to direct marketing at any time.
• Right to withdraw consent: Where our processing relies on your consent, you may withdraw it whenever you wish.
• Automated decisions: We do not conduct automated decision-making or profiling that produces legal effects concerning you.

Exercising these rights is free of charge in most instances. We will respond to verified requests within one calendar month. To exercise any right, email us at john@foundfirstmedia.com.

11. Complaints

If you have any questions, concerns, or complaints about how we process your personal data, please contact us first so we can address your issue directly.

You also have the right to lodge a complaint with the UK supervisory authority, the Information Commissioner’s Office (ICO):

12. Changes to this policy

We may update this Privacy Policy from time to time to reflect operational, regulatory, or legal changes. When changes are made, we will update the "Last updated" date at the top of this page. We encourage you to review this policy periodically.

13. Contact us

If you have questions about this Privacy Policy or wish to make a privacy request, please contact our data controller using the details below: