Privacy notice
Last updated: 1 November 2026
Who is responsible
Ben Whyte, trading as Graftwell Digital, is the controller of the personal information described in this notice.
Email: [email protected] Business correspondence address: 34 Tulip Avenue, CW1 4UY, United Kingdom.
Visiting the website and trying the demonstrations
The website's code does not set cookies or use browser storage, analytics, advertising pixels or third-party embeds. Its example businesses and enquiries are fictional. The demonstration form keeps sample information only in the page's memory: it does not submit it, save it to a database or send a message. Reloading or closing the page clears that sample state. Please use fictional details in demonstrations.
Cloudflare provides website hosting, delivery and security. Serving a page requires it to process technical request information, which may include your IP address, requested URL, request time, browser/device information and security or diagnostic information. Our legitimate interests are to deliver a working website, prevent misuse and investigate faults. The site code does not create a separate visitor-log database. Necessary provider processing is separate from advertising or visitor profiling.
Contacting us by email
An email link opens your own email application. You decide whether to send a message; the website does not send it for you. Your message then passes through your email provider and our Google Workspace Gmail service.
We use the name, email address, message and business/project details you choose to provide to understand your request, reply and discuss the services you asked about. A phone number is optional. Please do not send passwords, payment-card details, sensitive personal information or information about your own customers in an initial enquiry. Without a reply address and enough information about the request, we may be unable to help.
For an individual or sole trader requesting a quotation or service, our basis is taking necessary steps at your request before a contract, and performing that contract if agreed. For a company's representative, our basis is our legitimate interests in handling the company's enquiry and business relationship, balanced against the person's rights. We use legally required invoice/tax information to comply with our obligations. Relevant complaint or dispute records may be needed for legal obligations or our legitimate interests in resolving issues and establishing or defending legal claims.
An enquiry does not add you to a marketing list. This contact process does not use automated decision-making, profiling or generative-AI processing of enquiry content. We do not sell your personal information.
Providers and international processing
Google handles our business email; Cloudflare handles hosting, delivery and security. They use their authorised staff, infrastructure and subprocessors to provide those services. Our records are accessible to Ben and people specifically authorised where needed for the stated purposes; enquiry details are not put in the public website, demo or source repository. Information is disclosed to authorities or professional advisers only where legally required or reasonably necessary for the stated legal/record-keeping purposes.
Provider processing can take place outside the UK, including in the United States and other countries where their infrastructure and subprocessors operate. We do not promise UK-only or EU-only storage. The providers' published data-processing terms cover UK data protection obligations and international-transfer protections. These include standard contractual clauses with UK provisions where required, or an applicable recognised alternative transfer mechanism. You can contact us for information or a copy of relevant safeguards.
See Google's data-processing addendum, Google's UK transfer provisions in Annex V, Cloudflare's data-processing addendum and Cloudflare's privacy policy for the provider terms, subprocessors and service/security processing.
Retention and deletion
- Unconverted enquiries: we delete unnecessary personal details 90 days after the last meaningful contact. If you ask us to continue an active discussion, the period runs from its last meaningful contact. A particular complaint, obligation or legal claim may require relevant records longer; we record the reason and review date rather than retaining the whole enquiry indefinitely.
- Customers and required records: we keep information needed for an active service and outstanding obligations, then review and remove unnecessary content. Required sole-trader tax records are kept for at least five years after the 31 January filing deadline for the relevant tax year; an open HMRC enquiry or late return can affect that period.
- Technical service/security records: Cloudflare and Google retain operational information according to the service purposes, security/diagnostic needs and legal/contractual obligations described in their terms. Deleting an email removes it from ordinary use through the provider's deletion process; recovery or backup copies can expire later under that process.
Your rights and complaints
Depending on the circumstances, you can request access, correction, deletion, restriction or transfer of your information. You can object to processing based on legitimate interests. Where consent is used, you can withdraw it. Rights have legal conditions, and we will explain any applicable exception or necessary identity check. We normally respond within one month, explaining any lawful extension.
Use [email protected] for a privacy request or complaint. We will investigate and respond. You can also complain to the Information Commissioner's Office. You may contact the ICO without first complaining to us.