Legal
Data Processing Annex
When someone fills in a form on your website, their details are yours. This one page says exactly how we handle them on your behalf. It forms part of our Terms of Service (section 12).
Last updated 12 October 2026
Between: you (the client business — the “controller”) and Nedas Mikelionis, trading as Little Web Lab, at the address for service in the Legal notice of the Terms (the “processor”).
What this covers
When someone fills in the contact form, quote form, callback request or booking on your website, their details go to you. We run the systems that carry them. Under UK GDPR that makes you the controller (it's your customer, your decision what to do with it) and us the processor (we handle it on your instructions, and only for the purposes below).
Purpose: to build, host and run your website; to deliver enquiries, leads and bookings to you; to send the automatic emails your site sends (auto-replies, confirmations, reminders); and to show you your leads in your dashboard. Nothing else. We never sell, share or use your customers' data for our own marketing.
What the data is: name, phone number, email, address, the message or job description, any photos or documents they upload, booking details, and technical details like the time of the submission. We don't ask for anything sensitive (health, finances) and your forms shouldn't either.
Sub-processors — the providers we use to run your site
| Provider | What it does for your site | Where data is held |
|---|---|---|
| Cloudflare | Hosting, the form-handling code, spam protection (Turnstile), cookieless visitor stats, file uploads | EU and US — EU data-residency set where the product allows; covered by Cloudflare's Data Processing Addendum with UK/EU standard contractual clauses |
| Supabase | The database that stores your leads and powers your dashboard login | EU (Frankfurt) |
| Resend | Sends the emails — lead alerts to you, auto-replies and confirmations to your customers. They all go from Little Web Lab's own sending address, showing your business's name, with replies going to you | US, under standard contractual clauses |
| Setmore (Get Booked only) | Online booking, reminders and customer records — a free account in your name, embedded in your site and looked after by us | US, under standard contractual clauses. Setmore is a controller in its own right for booking data |
| Anthropic (only if you use the change-form helper) | The AI model (Claude) behind the optional helper on your change-request form. It reads the change you're writing, and any photo of a price list or sign you ask it to read, so it can ask one clarifying question or turn the photo into rows you check. Nothing it returns is saved until you confirm it, and Anthropic doesn't use the data to train its models | US, under standard contractual clauses |
| Stripe (our billing) | Takes your monthly payment to us (your card details, not your customers') | EU/US, under standard contractual clauses |
Setmore is the one booking tool we set up and run. Its own terms apply to your booking data, and we never store your bookings on our systems. If you already use a different booking tool we only put a button on your site pointing at it — we don't run it, and nothing about it passes through us.
We'll tell you by email before adding a new provider. If you object on reasonable grounds we'll look for an alternative, and if there isn't one you can cancel without penalty.
How long we keep it
Leads, enquiries and booking records: 24 months from the date they came in, then deleted automatically. Sooner if you ask. Emails already delivered to your inbox are yours to keep or delete as you choose.
Security
Every site is served over HTTPS. Data is stored with providers that hold recognised security certifications (ISO 27001 / SOC 2). Access to your data is limited to the two of us at Little Web Lab, behind two-factor authentication. Forms carry spam and bot protection. We don't keep copies of your data on personal devices.
Your rights, and your customers' rights
If one of your customers asks to see, correct or delete their data, tell us and we'll do it within 5 business days so you can meet your legal deadline. You can ask us at any time what data we hold for you.
When you leave
Within 14 days of your plan ending we hand over your web address and give you an export of your leads (a spreadsheet) if you want one. Your customers' data — and your own account data — is then deleted from our systems 30 days after your plan ends, automatically; your account page shows the exact date. We keep only our customer record for you (your business name, contact details, the dates, what you paid and our notes) for 6 years, for tax and in case of a legal claim, then delete it automatically; none of your customers' data is in it. A late payment on its own isn't leaving: nothing is deleted while a payment is outstanding. A plan only ends for non-payment after 60 days unpaid and a final notice giving the date (Terms, section 7) — then the same hand-over and the same 30-day deletion apply.
If something goes wrong
If we become aware of a breach affecting your customers' data, we tell you within 72 hours of finding out, with what happened, what data was involved, and what we're doing about it, so you can meet your own reporting duties.
The formal bits, briefly
We process data only on your documented instructions (these terms and your requests). Our staff are bound by confidentiality. We help you with data-protection requests and impact assessments where reasonable. We keep records of processing and will show you them on request. Our sub-processors are bound by written terms at least as protective as these. This annex is governed by the law of England and Wales, like the Terms of Service.
Nedas Mikelionis, trading as Little Web Lab · hello at littleweblab.com · see also our Privacy Policy.