Who is responsible?
The legal operator, postal contact and working privacy email will be published before enquiries open. Nesso Webcare is a trading brand; a limited-company structure has not been confirmed.
What we collect and why
When enquiries are open, the form collects your name, contact email, business name and project requirements. An invited client workspace also holds the website brief, business content, project files, work requests and messages you choose to provide.
We use this information to respond to enquiries, scope and deliver agreed work, communicate about projects and keep necessary business records. Depending on the relationship, the lawful basis is steps toward or performance of a contract, legitimate interests in managing business contacts, or a legal record-keeping obligation. Permission to publish content is reviewed separately.
Who can access it?
Public visitors can see the business website. Authorised clients can see only projects assigned to their signed-in account. The Nesso owner can review enquiries and projects. Internal Nesso notes are excluded from client responses.
The current service uses Sites hosting and sign-in, Cloudflare database/file services, and any separately agreed business email provider. Before client intake opens, the operator must review the relevant supplier processing terms, storage and transfer arrangements and publish any further applicable details. No UK-only storage promise is made.
Retention
The proposed starting schedule is: keep current project details while needed for the service; remove spare drafts and unused uploads within 90 days of launch or handover; review unsuccessful enquiries after six months without meaningful contact; retain only necessary contract evidence for a justified period, usually six years after completion. Tax records follow their applicable HMRC deadlines. Approved live website assets may be needed for longer than unused drafts.
Records must be reviewed and deleted when no longer needed, including exports and downloads. The initial release has no automated purge or tested independent backup/restore process. The operator must confirm the deletion and recovery arrangements before real client use. A legal hold may require relevant records to be kept longer.
Your choices and rights
You can request access to, correction of or deletion of your personal information, and other rights may apply depending on the processing. Contact the operator using the published privacy contact once active. Subject access requests normally require a response within one month, subject to applicable verification and extension rules.
You can complain to the Information Commissioner’s Office.
Cookies and sensitive information
Sign-in and form-protection cookies support access and security. This version does not add advertising cookies or analytics tracking. The enquiry service uses a short-lived form token and a rotating, keyed identifier to limit abuse.
Do not provide passwords, API keys, bank/card details, identity documents, medical information or salon customer records. Complete provider verification with that provider. Agree any customer-data processing separately before a client website starts taking real bookings.