Privacy policy
Data protection notice
How MURTWEB LTD collects, uses, stores and protects personal data, in accordance with the UK GDPR, the Data Protection Act 2018 and the Data (Use and Access) Act 2025.
01Scope of this policy
This policy explains how MURTWEB LTD handles personal data collected through this website and through business correspondence with prospective and existing clients. It applies to visitors to https://murtweb.com/ and to individuals who contact the company by email, telephone or the website enquiry form.
It does not apply to personal data that the company processes on behalf of a client in the course of delivering a project. In those circumstances the client is normally the controller and the company acts as a processor under a separate written agreement containing the provisions required by Article 28 of the UK GDPR.
02Data controller
The controller for the processing described in this policy is:
| Controller | MURTWEB LTD (company number 17370617) |
|---|---|
| Registered office | 29 Buckingham Court, Wakefield, West Yorkshire, United Kingdom, WF1 5EN |
| Contact | contact@murtweb.com · +44 7458 148578 |
Given the company's size and the limited nature of its processing, it is not required to appoint a Data Protection Officer under Article 37 of the UK GDPR. Data protection matters are handled by the director.
03Personal data collected
Information you provide
- Enquiry form data — name, company name, email address, telephone number (optional), project type, message content, and optional budget and timeline indications.
- Correspondence — the content of emails, call notes and messages exchanged in connection with an enquiry or project.
- Contract and billing data — where an engagement proceeds, the contact details, business details and payment information necessary to perform and invoice the contract.
Information collected automatically
- Server log data — the hosting provider records standard technical information such as IP address, request time, requested resource, HTTP status and user-agent string, generated automatically by the web server for security, diagnostics and abuse prevention.
This website does not use analytics, advertising or tracking technologies. See the Cookie Policy.
04Special category and criminal offence data
The company does not seek, and asks that you do not submit, special category personal data (Article 9 UK GDPR — including data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, health data, or data concerning sex life or sexual orientation) or criminal offence data (Article 10 UK GDPR) through the enquiry form.
If such data is submitted unsolicited, it will be deleted unless it must be retained for the establishment, exercise or defence of legal claims.
05Purposes and lawful bases
Personal data is processed only where a lawful basis under Article 6 of the UK GDPR applies:
| Purpose | Data | Lawful basis |
|---|---|---|
| Responding to an enquiry | Enquiry form data, correspondence | Art. 6(1)(b) — steps at your request prior to entering a contract; and Art. 6(1)(f) — legitimate interests in responding to business enquiries |
| Preparing a quote or proposal | Enquiry and project data | Art. 6(1)(b) — pre-contractual steps |
| Performing a project contract | Contact, contract and billing data | Art. 6(1)(b) — performance of a contract |
| Invoicing, accounting and tax records | Billing and transaction data | Art. 6(1)(c) — compliance with a legal obligation (Companies Act 2006; Value Added Tax Act 1994 where applicable) |
| Website security, diagnostics and abuse prevention | Server log data | Art. 6(1)(f) — legitimate interests in maintaining a secure and available service |
| Establishing, exercising or defending legal claims | Relevant records | Art. 6(1)(f) — legitimate interests in protecting the company's legal position |
Legitimate interests
Where processing relies on legitimate interests, the company has considered whether those interests are overridden by the interests, rights and freedoms of the individuals concerned. The processing described above is limited in scope, is of a kind that a person submitting a business enquiry would reasonably expect, involves no profiling and no disclosure for marketing purposes, and is therefore considered proportionate. You may object to such processing at any time (see Your rights).
06Consent and marketing
The enquiry form includes a consent confirmation for the processing of the information submitted. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.
The company does not send unsolicited marketing email, does not operate a mailing list, and does not sell, rent or share contact details with third parties for marketing purposes. Any future electronic marketing would be conducted in accordance with the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR), including the consent and "soft opt-in" requirements of regulation 22, with an unsubscribe facility in every message.
07Recipients, processors and disclosures
Personal data is accessed by the director of MURTWEB LTD and is disclosed only as set out below.
Processors
| Recipient | Role | Data |
|---|---|---|
| Namecheap, Inc. | Website hosting and domain services | Server log data; any data transmitted to the site |
Each processor engaged by the company is bound by a written contract meeting the requirements of Article 28 of the UK GDPR, including obligations of confidentiality, security, assistance with data subject rights, and deletion or return of data at the end of the engagement.
Contact form delivery
The website enquiry form is not currently connected to a third-party form-delivery or mail-processing service. Until such a service is configured, form submissions are not transmitted to or stored by any third-party provider, and the Contact page directs enquiries to email and telephone instead. If a provider is engaged, this policy will be updated to name it before the service goes live.
Other disclosures
Personal data may also be disclosed to professional advisers (such as accountants or solicitors) under a duty of confidentiality, to public authorities where disclosure is required by law or court order, and to a purchaser or successor in the event of a sale or reorganisation of the business, in each case only to the extent necessary.
08International transfers
Namecheap, Inc. is established in the United States. Where personal data is transferred outside the United Kingdom, the company relies on the transfer mechanisms permitted by Chapter V of the UK GDPR — in practice, the International Data Transfer Agreement or the UK Addendum to the European Commission's Standard Contractual Clauses, supported by a transfer risk assessment, or an applicable adequacy regulation where one is in force.
You may request further information about the safeguards applied to a specific transfer by contacting the company at contact@murtweb.com.
09Your rights
Subject to the conditions and exemptions in the UK GDPR and the Data Protection Act 2018, you have the right to:
- Be informed about how your personal data is used — the purpose of this policy;
- Access your personal data and receive a copy of it (Art. 15);
- Rectification of inaccurate or incomplete data (Art. 16);
- Erasure of your data where one of the grounds in Article 17 applies;
- Restriction of processing in the circumstances set out in Article 18;
- Data portability for data you provided, where processing is based on consent or contract and carried out by automated means (Art. 20);
- Object to processing based on legitimate interests (Art. 21);
- Withdraw consent at any time where processing is based on consent (Art. 7(3));
- Not be subject to a decision based solely on automated processing producing legal or similarly significant effects (Art. 22).
How to exercise your rights
Requests may be sent to the contact details in section 2. No fee is charged unless a request is manifestly unfounded or excessive. The company will respond without undue delay and in any event within one month of receipt, which may be extended by up to two further months where a request is complex or where several requests have been made; you will be informed of any extension and the reason for it. Proof of identity may be requested where necessary to confirm that the request is genuine.
10Automated decision-making and profiling
The company does not carry out automated decision-making producing legal or similarly significant effects, and does not use personal data collected through this website for profiling.
11Retention
Personal data is kept no longer than is necessary for the purposes for which it was collected:
| Category | Retention period |
|---|---|
| Enquiries that do not lead to an engagement | Up to 12 months after the last contact |
| Project correspondence and contract records | 6 years after the end of the contract, reflecting the limitation period under the Limitation Act 1980 |
| Accounting and tax records | 6 years from the end of the relevant accounting period, in accordance with the Companies Act 2006 and HMRC requirements |
| Server logs | Retained by the hosting provider for its standard operational period, then deleted or overwritten |
Contact requests and project enquiry data are retained for up to 12 months after the last contact, unless a contractual relationship is established or a longer retention period is required by law. At the end of the applicable period data is deleted or securely destroyed.
12Security
The company applies technical and organisational measures appropriate to the risk, as required by Article 32 of the UK GDPR. These include encryption of the website in transit (HTTPS/TLS), access controls and authentication on the systems used to hold correspondence, the principle of least privilege, keeping software and dependencies up to date, and limiting the volume of personal data collected in the first place.
No method of transmission or storage is completely secure. Where a personal data breach occurs and is likely to result in a risk to the rights and freedoms of individuals, it will be reported to the Information Commissioner's Office without undue delay and, where feasible, within 72 hours of the company becoming aware of it, in accordance with Article 33; affected individuals will be informed where Article 34 requires it.
13Children
This website is directed at businesses and is not intended for children. The company does not knowingly collect personal data from children. Where the company provides an online service likely to be accessed by children in the course of a client project, the children's higher protection matters introduced into Article 25 of the UK GDPR by the Data (Use and Access) Act 2025, and the ICO's Age Appropriate Design Code, are taken into account at the design stage.
14Complaints
If you are concerned about how your personal data has been handled, please raise the matter with the company first so it can be addressed directly.
You also have the right to lodge a complaint directly with the supervisory authority at any time:
Information Commissioner's Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline: 0303 123 1113 · ico.org.uk
15Third-party links
This website may contain links to external websites. The company is not responsible for the content or privacy practices of those websites, and this policy does not apply to them. You should review the privacy policy of any third-party site you visit.
16Changes to this policy
This policy may be updated to reflect changes in the company's practices or in applicable law. The version published on this page is the version in effect. Material changes affecting how personal data is used will be reflected in the version number and date shown at the top of this page.
Questions about this policy may be sent to contact@murtweb.com · +44 7458 148578.