Privacy Policy
Last updated: 20 October 2026
This policy explains how Ombush Media Ltd handles personal data: what is collected when you use ombush.com or get in touch, why, who it is shared with, how long it is kept, and the rights you have. It is written to meet the transparency requirements of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Who is responsible for your data
Ombush Media Ltd is the data controller. It is a limited company registered in England and Wales under company number 10552870, registered with the Information Commissioner's Office under number ZB427781. The business is run by one person, Will Robinson, who is the point of contact for anything in this policy.
- Email: [email protected]
- Phone: 0151 662 0088
- Post: Ombush Media Ltd, 1st Floor, The Tapestry, 68-76 Kempston Street, Liverpool, L3 8HL
The company is not required to appoint a Data Protection Officer. Requests and questions go to the address above.
What this policy covers
It covers visitors to ombush.com, people who make an enquiry, and clients. If you are a client, the contract between us may add to this policy for data processed as part of your project. Where I build or maintain a website for a client and handle their visitors' data on their instructions, I act as a processor and the client's own privacy policy applies to those visitors.
The site links to other websites. This policy does not cover them.
The data collected, and where it comes from
Data you give directly. When you use the contact form, email or phone, you provide your name, email address, phone number if you choose to, and whatever you write in your message. If you become a client, you also provide business details, project briefs, content, logins to systems I need to work on, and billing details.
Data collected automatically. When you visit the site, the server and Cloudflare receive your IP address and basic request details in order to deliver the pages and block abuse. If you accept analytics cookies, Google Analytics and PostHog record pages viewed, how you got here, your device and browser, approximate location, and interactions on the page. If you arrived from a Google Ads advert, the click identifier in the link is held in your browser for the duration of the visit and attached to an enquiry if you make one. The Cookie Policy lists every cookie and similar technology used.
Data from other sources. If you are introduced by a referral or come through a client's project, I may receive your name and contact details from them. Companies House and similar public registers may be used to confirm business details before invoicing.
No special category data (such as health, ethnicity or religion) is asked for or needed. Please don't include it in enquiries. The site is not aimed at children and no data is knowingly collected from anyone under 18.
Why the data is used, and the legal basis
UK GDPR requires a lawful basis for every use of personal data. Where legitimate interests is relied on, the interest has been weighed against your rights and is not considered to override them. You can object to any processing based on legitimate interests (see "Your rights").
| Purpose | Data used | Lawful basis |
|---|---|---|
| Responding to an enquiry you send through the contact form, by email or by phone | Name, email address, phone number if given, the content of your message, and the Google Ads click identifier if you arrived from an advert | Legitimate interests (answering the enquiry you made). Where the enquiry leads to a quote, taking steps at your request before entering into a contract. |
| Delivering web design, development and related services to clients | Contact details, business details, briefs, content and access credentials you give me for the project, invoicing and payment records | Performance of a contract. Legal obligation for accounting and tax records. |
| Protecting the site and contact form against spam and abuse | IP address, request timing, and the result of the Cloudflare Turnstile check | Legitimate interests (keeping the site secure and the form usable). |
| Understanding how the site is used so it can be improved, and measuring whether advertising works | Pages viewed, referring site, approximate location, device and browser, interactions on the page, and the advert that brought you here | Consent, given through the cookie banner. You can decline and the site works the same. |
| Sending occasional updates about my services to past enquirers or clients | Name and email address | Consent, or the soft opt-in for existing clients under PECR. Every email has an unsubscribe link. |
| Keeping records needed by law and defending legal claims | Contracts, invoices, correspondence | Legal obligation. Legitimate interests (establishing or defending legal rights). |
If you make an enquiry, you may receive a follow-up email or call about it. You will not be added to a marketing list without agreeing to it. No automated decision-making or profiling that produces legal or similarly significant effects takes place.
You are never obliged to provide personal data. Without a name and email address I can't reply to an enquiry, and without the details a project needs I can't carry out the contract. Everything else, including analytics, is optional.
Who the data is shared with
Personal data is not sold or rented to anyone. It is shared only with the service providers needed to run the business, each acting on written instructions and under contract, and with professional advisers and authorities where required.
| Recipient | What they do | Where data is processed |
|---|---|---|
| Cloudflare, Inc. | Content delivery, security and the Turnstile anti-spam check on the contact form | Global network. Cloudflare processes connection data at the data centre nearest to you and is bound by its Data Processing Addendum. |
| Mailgun (Sinch) | Delivers the email containing your enquiry to my inbox | United States. The transfer relies on Mailgun’s standard contractual clauses with the UK Addendum. |
| Google Ireland Limited | Google Analytics 4 and Google Ads conversion measurement | Ireland and the United States. Covered by the UK Extension to the EU-US Data Privacy Framework and standard contractual clauses. |
| PostHog, Inc. | Product analytics | EU Cloud, hosted in Frankfurt, Germany. |
| Accountants, insurers and legal advisers | Professional services to the business | United Kingdom. |
Enquiries are also stored in a lead database that I run on my own server infrastructure in the United Kingdom. Data may be disclosed to HMRC, regulators, courts or the police where the law requires it, and to a buyer or successor if the business is sold, in which case this policy continues to apply.
International transfers
Data is kept in the UK or the European Economic Area wherever possible. Where a provider processes data in the United States, the transfer relies on one of the safeguards recognised by UK law: the UK Extension to the EU-US Data Privacy Framework (the UK-US data bridge) where the provider is certified, or the International Data Transfer Agreement or UK Addendum to the EU standard contractual clauses. The European Economic Area is covered by UK adequacy regulations. A copy of the relevant safeguard can be requested using the contact details above.
How long data is kept
- Enquiries that do not become projects: 24 months from the last contact, then deleted.
- Client records, contracts and correspondence: for the length of the relationship and 6 years after it ends, to meet accounting and tax obligations and the limitation period for contract claims.
- Invoices and payment records: 6 years after the end of the financial year they relate to, as HMRC requires.
- Server and security logs: up to 30 days.
- Google Analytics data: 14 months, after which Google deletes it. Aggregated reports that identify no one may be kept longer.
- PostHog data: 12 months, then deleted.
- Marketing consent records: for as long as you remain subscribed, plus 12 months as evidence of consent.
When data is no longer needed it is deleted or anonymised. If it has to be kept longer because of a legal hold or a dispute, it is kept only for that purpose.
How data is protected
The site is served over HTTPS. The contact form is protected against automated submissions. Enquiry data and client records are held in systems that only I can access, protected by strong unique passwords and two-factor authentication. Access credentials you give me for a project are stored in a password manager and deleted when the project ends unless you ask me to keep maintaining the site. Despite these measures no transmission over the internet is entirely secure, so if you need to send something sensitive, ask for a secure route first.
If a breach is likely to put your rights at risk, I will tell you without undue delay and report it to the ICO within 72 hours as the law requires.
Your rights
Under UK GDPR you have the right to:
- Be informed about how your data is used, which is the purpose of this policy.
- Access the personal data held about you and receive a copy.
- Rectification of data that is inaccurate or incomplete.
- Erasure of your data in certain circumstances, such as when it is no longer needed or you withdraw consent.
- Restriction of processing while a dispute about accuracy or lawfulness is resolved.
- Portability of data you provided, in a machine-readable format, where processing is based on consent or contract.
- Object to processing based on legitimate interests, and to direct marketing at any time, in which case it stops.
- Withdraw consent at any time where consent is the basis, without affecting processing that happened before.
- Not be subject to automated decision-making that significantly affects you. None takes place.
To exercise any of these, email [email protected]. There is no charge. A response will be sent within one month, extendable by a further two months for complex requests, in which case you will be told why. Proof of identity may be requested if there is reasonable doubt about who is asking.
Complaints
If you are unhappy with how your data has been handled, please contact me first and I will try to put it right. You also have the right to complain to the Information Commissioner's Office, the UK's data protection regulator:
- Website: ico.org.uk/make-a-complaint
- Telephone: 0303 123 1113
- Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Changes to this policy
This policy is reviewed at least once a year and whenever the way data is handled changes. The date at the top shows the current version. Significant changes will be flagged on the site, and where a change needs your consent you will be asked for it.