Legal
Privacy policy
The short version: We collect what you send us in the contact form, we use it to reply to you, and we do not sell it or add you to a mailing list. The longer version is below.
Last updated 5 September 2026.
Who is responsible for your data
Werehouse Media is a trading name of Werehouse Holdings Ltd, a company registered in England and Wales, company number 16802511, registered office as published on our Terms page. The company is the data controller for information collected through werehousemedia.com. It is a small studio, and the person responsible is Ed, reachable at ed@werehousemedia.com.
What is collected, and why
| What | When | Why | Kept for |
|---|---|---|---|
| Your name and email address | When you submit the contact form | So we can reply to your enquiry. This is the only reason. | Up to 24 months from our last contact, then deleted |
| Your website address, if you give one | When you submit the contact form | So we can look at the site before replying, which makes the reply useful | As above |
| What you write in the message box | When you submit the contact form | So we understand what you are asking for | As above |
| Your IP address and browser details | Automatically, on every request | Standard server logs kept by the host, used for security and spam prevention | Per the host's retention, typically 30 days |
The lawful basis for handling your enquiry is legitimate interest: you contacted a business asking it to get in touch, and replying is the obvious expected use. If we go on to work together, the basis becomes performance of a contract.
What is not collected
This site runs no advertising trackers, no marketing pixels, no session recording and no cross-site profiling. There is no cookie banner because there are no non-essential cookies to ask you about. Fonts and scripts are served from this domain rather than a third-party CDN, so loading a page does not hand your IP address to anybody else.
Who your data is shared with
Three processors, each necessary to run the site and reply to you:
- Netlify (Netlify, Inc.) hosts the site, serves every page, keeps the server logs, and stores form submissions. Their privacy terms govern that processing.
- Resend (Resend, Inc.) delivers the notification email that tells us an enquiry has arrived. It carries your name, your email address and your message, because that is the enquiry. It is transactional only: Resend is not used for any mailing list, because there is no mailing list.
- The mailbox provider for ed@werehousemedia.com, which holds the enquiry once it is delivered and carries our reply back to you.
Two small pieces of technical housekeeping also involve your data, and it would be dishonest to leave them out of a list headed "who your data is shared with":
- Abuse protection. To stop the contact form being used to send thousands of messages, the server keeps a one-way hash of your IP address for 24 hours, and a one-way hash of your email address and message for 15 minutes so that a double-tapped submit button does not send the same enquiry twice. Neither can be turned back into the original. Both are held by Netlify and expire on their own.
- Error reporting. If a script on the page fails, the browser sends the error message, the page address and the browser's user-agent string to this site's own server, where it is written to a log. No cookie, no identifier and nothing stored on your device. It exists so that a broken page on some particular phone can be found and fixed, and it goes nowhere but this site.
Nothing is sold, rented or passed to advertisers, data brokers or lead-generation networks. Your enquiry is not shared with other suppliers so they can also pitch you, which is a thing that happens on comparison sites and is worth knowing about.
Cookies and similar technologies
This site sets no cookies at all, and there is no consent banner. Under the Privacy and Electronic Communications Regulations, consent is required before storing or reading information on your device unless it is strictly necessary for a service you asked for. Two things are stored, both of them for that reason, and it would be wrong to write “nothing is stored” and leave it there.
- Dismissing the offer bar. If you close the strip at the top of the page, the browser remembers that so it stays closed. It is one character (
whm-offer) in your browser’s own storage, on your device only. It is never sent anywhere and nothing else reads it. It exists solely to carry out the thing you asked for by clicking the cross. - The hero prompt. On the home page, if you sit still for a few seconds, a small line appears offering to let you spin the object. Once shown, that is recorded for the rest of the browser session (
whm.hint) so it does not appear again. It is cleared when you close the tab, is never sent anywhere, and exists to stop the page nagging you.
Neither identifies you, neither is read by anybody else, and neither leaves your device. If you clear your browser storage they both disappear and the site behaves as it did on your first visit.
Specifically, there are no advertising cookies, no analytics cookies, no social media pixels, no session recording, no fingerprinting and no cross-site tracking. Fonts and scripts are served from this domain rather than a third-party CDN, so loading a page does not disclose your IP address to anyone else. The ICO's guidance on cookies sets out the rules this follows.
If that ever changes, a consent banner will appear before the first non-essential cookie is set, not afterwards.
Automated decisions and AI
No automated decision-making or profiling is carried out on your data, and nothing you send is used to train an AI model. Enquiries are read by a person, not by a system that decides anything about you.
The site publishes an llms.txt file and permits AI search crawlers to read its public pages, so that the business can appear in AI-generated answers. That governs published marketing content only. It has nothing to do with anything you submit through a form, which is never published, shared or exposed to those systems.
Where your data is held
Form submissions are processed by Netlify, whose infrastructure may place data outside the UK. Where personal data is transferred internationally, it relies on the transfer mechanisms in that provider's terms, such as the UK International Data Transfer Addendum or an adequacy decision. If you would rather not use the form for that reason, email or WhatsApp reaches us directly and the message stays in a UK or EU mailbox.
Keeping it secure
The site is served over HTTPS with HSTS, so traffic between your browser and it is encrypted. Access to the inbox and hosting accounts is protected by two-factor authentication. No client data is stored on portable media. This is a small studio, so the number of people who can see an enquiry is very small.
Should a personal data breach occur that is likely to result in a risk to your rights, it will be reported to the ICO within 72 hours and you will be told directly where the risk is high.
Your rights
Under UK GDPR you can ask us to show you what we hold about you (access), correct it (rectification), delete it (erasure), pause our use of it while a dispute is sorted out (restriction), and, where we hold it because we are working together, receive it in a portable format (portability). Email ed@werehousemedia.com and we will action it within 30 days, usually the same week. There is no form to fill in and no charge.
You also have the right to object. We handle your enquiry on the basis of legitimate interests, and where that is the basis you are entitled to object to it at any time, for reasons connected to your situation. Say so in a reply or to the address above and we will stop, unless we can show compelling grounds that override your interests, which for a reply to your own enquiry is not a case we would expect to make. Objecting costs you nothing and does not need a reason you have to justify.
If you are not happy with how we have handled it, you can complain to the Information Commissioner's Office, the UK regulator for data protection. You do not need our permission and you do not have to tell us first, though we would rather you did so we can put it right.
Marketing
There is no mailing list. Submitting the contact form does not subscribe you to anything, and there is no follow-up sequence. If you never hear from us again after one reply, that is the system working as designed.
Client sites
If Werehouse Media builds or maintains your website, we act as a processor for any personal data that site handles, under whatever is agreed in writing for that project. Your own site needs its own privacy policy covering what it collects, and that is something we will raise during the build rather than leave you to discover later.
Changes to this policy
If this policy changes, the date at the top changes with it. There is no version history to dig through because the policy is short enough to reread.
Related
- Terms of business, covering payment, ownership and liability.
- Reviews and testimonials policy, written to the DMCC Act 2024 rules.
- Accessibility statement, including what falls short.