Privacy Policy

This Privacy Policy explains how Hiddlins (“Hiddlins”, “we”, “us” or “our”) collects, uses, shares and protects personal data when you visit hiddlins.com, contact us, or buy our web-development services. We have written it to be read, not just to exist: it describes the tools this website actually runs, the data those tools handle, and the practical steps you can take to control your information. Last updated: October 14, 2026.

Who we are and scope of this policy#

Hiddlins is an independent web-development studio. We design and build landing pages, WordPress websites, WooCommerce stores and custom web applications, and we provide performance audits and ongoing website care plans. For the personal data described in this policy, Hiddlins is the data controller (in the language of the EU and UK General Data Protection Regulations) and the business (in the language of the California Consumer Privacy Act, as amended by the California Privacy Rights Act).

This policy applies to:

• visitors to our website, including our blog, service pages and pricing calculator;
• people who contact us through our contact form or by email;
• customers who place orders for services through our online shop; and
• business contacts and prospective clients we correspond with.

It does not cover personal data that we process on behalf of our clients while building or maintaining their websites (for example, the customer records stored in a client’s own WooCommerce store). In that situation the client is the controller and we act as a processor under a separate data processing agreement or the data protection terms in our contract.

Privacy at a glance#

Personal data we collect#

We collect personal data in three ways: information you give us directly, information collected automatically when you use the website, and limited information we receive from third parties such as payment providers.

Contact form and email enquiries#

Our contact form is built with the Contact Form 7 plugin for WordPress. When you submit it, we receive the information you enter, typically your name, email address, the subject of your enquiry, your message and any project details you choose to include (such as your budget range, timeline or a link to your current website). The form submission is delivered to our inbox by email. If you write to us directly, we receive your email address, the content of your message and any attachments.

Please do not send sensitive information, such as health data or government identification numbers, through the form or by email.

Orders and account information#

Our services are sold as virtual products through WooCommerce. When you place an order, we collect the information required to process and fulfil it:

• billing name, company name (if any), email address, phone number (if you provide it) and billing address;
• order details, such as the services purchased, prices, taxes, discounts and order notes;
• account credentials, if you choose to create a customer account (passwords are stored only in hashed form); and
• transaction records returned by our payment provider, such as a transaction reference, the payment status and the last four digits and brand of a card.

We never see or store your full card number or security code. Card payments are processed directly by our payment provider, which is responsible for handling card data in line with the Payment Card Industry Data Security Standard (PCI DSS).

Project and client communications#

If you become a client, we also hold the information needed to run your project: proposals, statements of work, invoices, meeting notes, feedback on designs, and any content, brand assets or access credentials you share with us. We use access credentials only for the agreed work and ask that you revoke or rotate them when the project ends.

Information collected automatically#

Like almost every website, ours records some technical information when you visit:

• Server logs. Our hosting provider’s web servers log requests, including your IP address, the date and time, the page requested, the HTTP status code, the referring page and your browser’s user-agent string.
• Security logs. We use the Wordfence security plugin, which includes a web application firewall, login protection and brute-force mitigation. Wordfence records IP addresses, request details, failed and successful login attempts, and blocked requests in order to detect and stop attacks. We also use WP Hide & Security Enhancer to reduce the information our WordPress installation exposes to automated scanners; it does not collect personal data about visitors itself.
• Cookies and similar technologies. We use strictly necessary cookies (for example, to remember the contents of your cart and your cookie preferences) and, only with your consent, analytics cookies. Full details are in our Cookie Policy.

Analytics (only with consent)#

If you accept analytics cookies through our CookieYes consent banner, we may use an analytics service to understand how visitors use the website: which pages are viewed, how long visits last, which device types and browsers are used, and roughly which country visitors come from. We configure analytics to minimise data collection where the tool allows it, and we do not use analytics data to identify individual visitors. If you decline or ignore the banner, analytics scripts are not loaded.

Information from third parties#

We receive payment status and fraud-screening results from our payment provider. We never buy personal data or contact lists.

How we use personal data and our lawful bases#

Under the EU GDPR and the UK GDPR, we must have a lawful basis for each purpose for which we process personal data. The table below sets out our purposes and the bases we rely on.

Purpose	Data involved	Lawful basis (GDPR / UK GDPR)
Responding to enquiries and preparing quotes	Name, email, message, project details	Steps taken at your request before entering into a contract (Art. 6(1)(b)); otherwise our legitimate interest in answering business enquiries (Art. 6(1)(f))
Processing orders, delivering services and managing projects	Order, billing and project data	Performance of a contract (Art. 6(1)(b))
Invoicing, bookkeeping and tax records	Billing details, order and payment records	Legal obligation (Art. 6(1)(c))
Website security, fraud prevention and abuse detection	IP address, request and login logs, security cookies	Legitimate interests in protecting our website, customers and systems (Art. 6(1)(f))
Operating the cart, checkout and customer accounts	Session and cart cookies, account data	Performance of a contract (Art. 6(1)(b)) and legitimate interests (Art. 6(1)(f)); these cookies are strictly necessary
Recording your cookie choices	Consent cookie, consent log	Legal obligation to demonstrate consent (Art. 6(1)(c)) and legitimate interests (Art. 6(1)(f))
Website analytics	Pseudonymous usage data, analytics cookies	Consent (Art. 6(1)(a)), which you can withdraw at any time
Sending service updates and care-plan notices	Name, email, service records	Performance of a contract (Art. 6(1)(b))
Occasional newsletters or marketing emails (if we offer them)	Name, email	Consent (Art. 6(1)(a)), or for existing customers, legitimate interests where permitted by e-privacy law, always with an easy opt-out
Establishing, exercising or defending legal claims	Relevant records	Legitimate interests (Art. 6(1)(f))

Where we rely on legitimate interests, we have balanced them against your rights and freedoms. You may ask us for details of that assessment.

We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.

Who we share personal data with#

We share personal data only with service providers that help us run the website and our business, and only to the extent they need it. These providers act as our processors (or “service providers” and “contractors” under California law) and are bound by contractual terms that restrict how they may use the data.

Category of recipient	What they do	Data they receive
Web hosting provider	Hosts the website, database and server logs	All data stored on the website, server logs
Payment providers (for example, a card processor or PayPal, depending on the method enabled at checkout)	Process payments, prevent fraud	Billing details, order amount, payment details you enter on their form
Email and transactional email services	Deliver contact-form messages, order confirmations and our correspondence	Name, email address, message content
Security services (Wordfence)	Firewall rules, threat intelligence and malware signatures	IP addresses and request data associated with suspicious activity
Consent management (CookieYes)	Displays the cookie banner and records consent	Consent choices, a consent ID, timestamp and pseudonymous technical data
Analytics provider (only with consent)	Aggregated usage statistics	Pseudonymous usage data and device information
Professional advisers	Accounting, legal and insurance advice	Only the records relevant to the advice

We may also disclose personal data when required by law or a valid request from a public authority, to protect the rights or safety of our clients, visitors or ourselves, or as part of a sale or reorganisation of our business, in which case the recipient would be bound by equivalent protections.

We do not allow our service providers to use your personal data for their own marketing, and we do not disclose it to advertisers.

International data transfers#

Some of our service providers are located, or store data, outside the country where you live, including outside the European Economic Area (EEA) and the United Kingdom. When we transfer personal data from the EEA or UK to a country that has not been recognised as providing an adequate level of protection, we rely on appropriate safeguards, such as:

• the European Commission’s Standard Contractual Clauses (SCCs);
• the UK International Data Transfer Addendum to the SCCs, or the UK International Data Transfer Agreement;
• adequacy decisions, including the EU-U.S. Data Privacy Framework and the UK Extension to it, where a recipient is certified; and
• supplementary technical measures such as encryption in transit.

You can ask us for more information about the safeguards that apply to a particular transfer by contacting us at hello@hiddlins.com.

How long we keep personal data#

We keep personal data only for as long as we need it for the purposes described above, including legal, accounting and reporting requirements. When it is no longer needed, we delete it or anonymise it.

Type of data	Typical retention period
Contact form submissions and enquiry emails that do not lead to a project	Up to 24 months after our last communication
Client project files and correspondence	For the duration of the project and up to 6 years afterwards, to support warranties, follow-up work and legal claims
Orders, invoices and payment records	As long as tax and accounting law requires (commonly 6 to 10 years, depending on the jurisdiction)
Customer accounts on the website	Until you ask us to delete the account, or after 24 months of inactivity, subject to the order-record rules above
Security and firewall logs (Wordfence)	Rolling retention, generally no longer than 90 days unless needed to investigate an incident
Web server access logs	According to our host’s log rotation, generally no longer than 90 days
Cookie consent records	Up to 12 months, matching the life of the consent cookie, so that we can demonstrate consent
Analytics data	No longer than 14 months in identifiable form; aggregated reports may be kept indefinitely
Marketing preferences and opt-outs	For as long as needed to respect your choice (a suppression record)

For cookie lifetimes, see the table in our Cookie Policy.

How we protect personal data#

Security is central to the work we do for clients, and we apply the same standards to our own website. Our measures include:

• HTTPS (TLS) encryption for all pages, forms and checkout;
• a web application firewall, login rate-limiting and brute-force protection provided by Wordfence;
• reducing the information our site exposes to automated vulnerability scanners using WP Hide & Security Enhancer;
• strong, unique passwords and two-factor authentication for administrative accounts;
• keeping WordPress core, themes and plugins up to date and removing software we do not use;
• the principle of least privilege for anyone with access to our systems;
• regular backups stored separately from the live site; and
• outsourcing card handling entirely to our PCI DSS-compliant payment provider.

No system is completely secure. If a personal data breach is likely to put your rights at risk, we will notify the relevant supervisory authority and, where required, you, within the time limits set by law.

Your rights under the GDPR and UK GDPR#

If you are in the EEA, the United Kingdom or Switzerland, you have the following rights, subject to certain conditions and exemptions:

• Access: to receive confirmation of whether we process your data and a copy of it.
• Rectification: to have inaccurate or incomplete data corrected.
• Erasure: to have your data deleted where there is no good reason for us to keep it.
• Restriction: to ask us to pause processing, for example while we verify a correction.
• Portability: to receive data you provided to us in a structured, commonly used, machine-readable format, or have it sent to another controller.
• Objection: to object to processing based on legitimate interests, and to object at any time to direct marketing.
• Withdraw consent: where we rely on consent, you can withdraw it at any time without affecting the lawfulness of processing before withdrawal. For cookies, use the “Cookie settings” link in the website footer.
• Complain: to lodge a complaint with a data protection supervisory authority, in particular in the country where you live or work or where an alleged infringement took place. In the UK, this is the Information Commissioner’s Office (ico.org.uk). We would, however, appreciate the chance to address your concerns first.

Your rights under California law (CCPA/CPRA)#

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives you specific rights. This section also serves as our “notice at collection”.

Categories of personal information#

In the preceding 12 months we have collected the following categories of personal information, from the sources and for the purposes described in the sections above:

• Identifiers, such as name, email address, IP address and account username;
• Customer records described in Cal. Civ. Code §1798.80(e), such as billing address and phone number;
• Commercial information, such as services purchased and order history;
• Internet or other electronic network activity, such as server and security logs and, with consent, analytics data;
• Approximate geolocation derived from IP addresses (country or region level); and
• Professional or employment-related information, such as your job title or company, if you provide it.

We do not collect sensitive personal information for the purpose of inferring characteristics about you. The account password you choose is sensitive personal information under California law; we use it only to authenticate you.

Your California rights#

• Right to know the categories and specific pieces of personal information we have collected, the sources, the purposes and the categories of third parties to whom we disclose it.
• Right to delete personal information we collected from you, subject to legal exceptions.
• Right to correct inaccurate personal information.
• Right to opt out of sale or sharing of personal information. As explained below, we do not sell or share personal information.
• Right to limit the use of sensitive personal information. We use sensitive personal information only for purposes permitted without offering this right.
• Right to non-discrimination for exercising any of these rights. We will not deny you services, charge you a different price or provide a different quality of service because you exercised your rights.

You may use an authorised agent to submit a request on your behalf. We may ask the agent for proof of authorisation and ask you to verify your identity directly. More information about California privacy rights is available from the California Privacy Protection Agency (cppa.ca.gov).

Do Not Sell or Share My Personal Information#

We do not sell personal information, and we have not sold personal information in the preceding 12 months. We do not “share” personal information for cross-context behavioural advertising as that term is defined under California law. We do not knowingly sell or share the personal information of consumers under 16 years of age.

Because we do not sell or share personal information, there is nothing you need to opt out of. If we ever change this practice, we will update this policy, provide a clear “Do Not Sell or Share My Personal Information” mechanism and honour opt-out signals before any such processing begins.

Global Privacy Control#

Global Privacy Control (GPC) is a browser setting or extension that tells websites you do not want your personal information sold or shared (see globalprivacycontrol.org). We treat a GPC signal as a valid request to opt out of the sale and sharing of personal information for that browser and, where we can associate it with you, for your account. Where our consent tool supports it, a GPC signal is also treated as a refusal of non-essential, advertising-related cookies. Honouring GPC does not require you to give us any additional information.

Because there is no agreed standard for “Do Not Track” (DNT) headers, we rely on GPC and our cookie banner instead. Either way, we do not track you across other websites.

Artificial intelligence, AI crawlers and your data#

We are open about how artificial intelligence relates to your personal data:

• No sale or licensing for AI training. We do not sell, license or otherwise provide the personal data of our visitors, customers or correspondents to developers of AI models for training purposes.
• AI tools in our work. We may use AI-assisted tools for tasks such as drafting, coding assistance or proofreading. We do not paste personal data or confidential client material into AI services that use inputs to train their models, and we use business-grade tools with appropriate data protection terms where client information is involved.
• AI crawlers. Our public pages, such as blog articles and service descriptions, may be accessed by search engines and AI crawlers, and we may use files such as robots.txt to state our preferences about that access. These pages do not contain visitor or customer personal data. Areas such as the checkout, customer account pages and contact form submissions are not publicly accessible.

See also our Editorial Policy.

Children’s privacy#

Our website and services are intended for businesses and adults. We do not knowingly collect personal data from children under 16 (or under 13 in the United States). If you believe a child has provided us with personal data, please contact us and we will delete it.

Marketing communications#

We do not add you to a mailing list just because you sent an enquiry. Any marketing email we send includes an unsubscribe link. Service messages, such as order confirmations and invoices, are not marketing.

How to exercise your rights#

1. Send your request to hello@hiddlins.com, or use our contact form. Please state which right you wish to exercise and, if possible, which data your request concerns.
2. Verification. To protect your data, we will verify your identity before acting. Usually we do this by confirming the request comes from the email address we hold. For more sensitive requests, we may ask for one or two additional details we already have, such as an order number. We will not ask for more information than necessary.
3. Response time. We aim to acknowledge requests within 10 days. We respond in full within one month under the GDPR and UK GDPR (extendable by two further months for complex requests) and within 45 days under California law (extendable by a further 45 days where reasonably necessary). We will tell you if we need an extension and why.
4. Cost. Exercising your rights is free. We may charge a reasonable fee, or decline, only where a request is manifestly unfounded or excessive, as the law allows.

If we cannot fulfil all or part of a request, for example because we must retain invoices for tax purposes, we will explain why.

Changes to this Privacy Policy#

We review this policy regularly and update it when our practices, our tools or the law change. The “last updated” date at the top of this page shows when it was last revised. If we make a material change, such as using personal data for a new purpose, we will highlight it on the website and, where appropriate, notify customers by email before the change takes effect.

Contact us#

If you have questions about this Privacy Policy, want to exercise your rights, or have a concern about how we handle personal data, please get in touch. We read every message and will respond as quickly as we can.

Email: hello@hiddlins.com

Hiddlins

You can also reach us through our contact page. For details about cookies specifically, please see our Cookie Policy.