Privacy Policy

Last updated: 25 September 2026
Version: 3.1

XLWEB takes your privacy seriously. This policy explains what personal data we collect, why we collect it, how we use it, who we share it with, and the rights you have over your information. It applies to visitors to our website, prospective clients, current clients, past clients, contractors, and anyone else who interacts with our business.

We comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (DPA 2018), and the Privacy and Electronic Communications Regulations 2003 (PECR).

1. Who we are

XLWEB is a search marketing and digital agency based in Glasgow, Scotland.

Data controller: XLWEB Internet Marketing Ltd
Address: 14 Willowbank Crescent, Glasgow, G3 6NB, Scotland, UK
Telephone: 07469 190806
Email: info@xlweb.co.uk

We are the data controller for personal information we collect about website visitors, prospects, and our own team. For personal data we process on behalf of clients (for example, when we access their Google Search Console or advertising accounts), we act as a data processor. Section 8 covers this in detail.

2. What personal data we collect

Depending on how you interact with us, we may collect the following categories of personal data.

From website visitors:

• Device and browser information (IP address, browser type, operating system)
• Pages visited, time on page, referring source
• Any information you submit through contact forms, live chat, or downloads

From prospective and current clients:

• Name, job title, and business role
• Business email address, phone number, and postal address
• Company details (name, sector, size, website)
• Meeting notes, correspondence, and project scope documents
• Payment and invoicing details (billing address, bank details, VAT number)

From client accounts we’re granted access to:

• Google Search Console, Google Analytics 4, Google Ads, Meta Ads, and Microsoft Ads data
• WordPress, Shopify, or other CMS admin access
• Hosting, DNS, and domain registrar access where required
• CRM and email marketing platform data where required

From contractors and suppliers:

• Name, contact details, and payment information
• Correspondence relating to work delivered

We do not knowingly collect any special category data (health, race, religion, sexual orientation, political views, trade union membership, or genetic or biometric data). We do not collect data from children under 13.

3. How we collect your personal data

We collect personal data in these ways:

• Directly from you when you fill out a form, email us, call us, sign a contract, or attend a meeting.
• From your device through cookies and similar technologies when you visit our website (see Section 9 and our Cookie Policy).
• From third-party platforms when you grant us access to your business accounts (Google, Meta, hosting providers, and similar).
• From publicly available sources such as your company website, Companies House, or LinkedIn, when researching prospective clients.

4. Why we process your data (legal bases)

Under the UK GDPR, we must have a lawful basis for processing your personal data. We rely on the following:

Contract: to deliver the services you’ve engaged us for, to invoice you, to communicate about your project, and to fulfil our contractual obligations.

Legitimate interests: to run and grow our business, respond to enquiries, prevent fraud, maintain security, and improve our services. We only rely on this basis where our interests are not overridden by your rights.

Consent: for optional marketing communications such as newsletters, industry updates, or events. You can withdraw consent at any time using the unsubscribe link in any email or by emailing info@xlweb.co.uk.

Legal obligation: to comply with laws that require us to hold or disclose certain information (for example, tax and accounting law, or a lawful request from a regulator).

5. Who we share your data with

We only share personal data with the following categories of recipient, and only when necessary.

Sub-processors and service providers we use:

(Note: replace the platform names above with the actual tools XLWEB uses. This list must be accurate under UK GDPR Article 30.)

Other parties we may share data with:

• Professional advisers such as solicitors, accountants, and insurers, where required.
• Law enforcement or regulators, if compelled by a valid legal request.
• A successor business, in the event of a sale, merger, or restructure. You would be notified before this happened.

We do not sell your personal data to anyone. We do not share it for third-party marketing purposes.

6. International data transfers

Some of our sub-processors are based outside the UK, primarily in the European Economic Area (EEA) and the United States. Where personal data is transferred outside the UK, we ensure appropriate safeguards are in place under the UK GDPR, using one or more of the following:

• Adequacy decisions issued by the UK government
• The UK International Data Transfer Agreement (IDTA)
• The UK Addendum to the EU Standard Contractual Clauses
• Binding corporate rules or other approved mechanisms

You can request more information about the safeguards we use by emailing info@xlweb.co.uk.

7. How long we keep your data

We keep personal data only as long as necessary for the purposes we collected it for, or as required by law. Broadly:

• Enquiries that don’t lead to a contract: up to 24 months, then deleted unless you ask us to keep your details on file.
• Active client records: for the duration of the engagement and up to 7 years after the final invoice, to meet accounting and tax obligations.
• Marketing subscriber records: until you unsubscribe, plus a suppression record so we don’t email you again.
• Website analytics data: up to 26 months in Google Analytics 4, then automatically deleted.
• Contractor and supplier records: for the duration of the working relationship and up to 7 years after final payment.

Data may be anonymised for statistical purposes and retained indefinitely in that anonymised form.

8. Client data (where XLWEB is a processor, not a controller)

When we deliver SEO, PPC, content, and other services for a client, we typically access personal data that the client controls. This may include:

• Website visitor data via Google Analytics, Google Search Console, or Meta Pixel
• Customer contact details visible in a client’s CRM, e-commerce platform, or hosting environment
• Enquiry and lead data captured through client website forms

In these situations, XLWEB acts as a data processor on behalf of the client (the data controller). Our processing is governed by a written Data Processing Agreement (DPA) with each client. We only process client data on documented instructions, we don’t use it for our own purposes, and we return or delete it at the end of the engagement.

If you are an end-user of one of our clients’ services and have questions about their data handling, please contact the client directly. If you are unsure who to contact, we can help you identify them.

9. Cookies

Our website uses cookies to improve your experience and to help us understand how visitors use the site. This includes cookies from Google Analytics, and cookies set by Google if you choose to load the map on our contact page.

Under PECR, non-essential cookies are only set with your consent. When you first visit our site, you will see a cookie banner asking you to accept, reject, or customise your cookie preferences. You can change your choice at any time on our Cookie Policy page, which is linked in the site footer.

10. Your rights

Under the UK GDPR, you have the following rights over your personal data:

• Right to be informed: you have the right to know what data we hold and how we use it (that’s what this policy does).
• Right of access: you can ask for a copy of the personal data we hold about you (a “subject access request”).
• Right to rectification: if any of your data is wrong or incomplete, you can ask us to correct it.
• Right to erasure: in certain circumstances, you can ask us to delete your personal data.
• Right to restrict processing: you can ask us to pause processing your data in certain circumstances.
• Right to data portability: you can ask us to transfer your data to another provider in a structured, commonly used, machine-readable format.
• Right to object: you can object to certain types of processing, including direct marketing.
• Rights related to automated decision-making: we do not currently use automated decision-making or profiling.

To exercise any of these rights, email info@xlweb.co.uk. We will respond within one month.

There is no fee for exercising your rights, unless a request is manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse to respond.

We may ask you for proof of identity before releasing personal information, to make sure we don’t disclose your data to someone else.

11. Marketing communications

We may occasionally send you information about our services, industry news, or events, but only if you have opted in to receive them.

Every marketing email we send includes an unsubscribe link. You can also stop marketing at any time by emailing info@xlweb.co.uk.

Under the “soft opt-in” rule in PECR, we may occasionally email existing clients about similar services to those they’ve bought from us, without prior consent. You can opt out of this at any time.

12. Data security

We take appropriate technical and organisational measures to protect your personal data against loss, unauthorised access, disclosure, alteration, and destruction. These include:

• Password-protected devices, laptops, phones, and tablets, with full-disk encryption
• Multi-factor authentication on all business accounts
• Password managers with unique passwords for every service
• Regular backups of critical data
• Access controls limiting data access to team members who need it
• SSL/TLS encryption for all data transmitted through our website and cloud services
• Written data processing agreements with all sub-processors

Despite these measures, no online transmission or storage system can be guaranteed 100% secure. If a personal data breach occurs that poses a high risk to your rights and freedoms, we will notify you and the ICO without undue delay, in line with our legal obligations.

13. Complaints

If you have a concern about how we handle your personal data, please contact us first at info@xlweb.co.uk. We will investigate and respond as quickly as possible.

If you are not satisfied with our response, you have the right to complain to the Information Commissioner’s Office (ICO), which is the UK’s data protection regulator.

ICO contact details:
Information Commissioner’s Office
Wycliffe House, Water Lane
Wilmslow, Cheshire, SK9 5AF
Telephone: 0303 123 1113
Website: www.ico.org.uk

14. Changes to this policy

We review this policy regularly and may update it from time to time. When we make significant changes, we will update the “Last updated” date at the top of the page, and where appropriate, notify you by email.

15. Contact us

For any questions about this policy or the way we handle your personal data:

XLWEB Internet Marketing Ltd
14 Willowbank Crescent
Glasgow, G3 6NB
Scotland, UK

Email: info@xlweb.co.uk
Telephone: 07469 190806