Get free preview

Privacy policy, sites48h.co.uk

Effective from 31 October 2026 (version 1).

This policy explains how we handle personal data of people who visit sites48h.co.uk, send us a preview request, contact us or sign up for a website plan.

1. Who we are

  1. The controller of your personal data is APTURN SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ (Apturn sp. z o.o.), ul. Pustola 24/49, 01-129 Warsaw, Poland, a limited company registered in Poland in the National Court Register (KRS) under number 0001142653, Polish tax ID (NIP) 5273142724, REGON 540378447 ("Apturn", "we", "us").
  2. For anything about your data, email hello@sites48h.co.uk or write to the address above.
  3. We have not appointed a data protection officer.
  4. We are not based in the UK and have not appointed a UK representative. Under UK GDPR Article 27(2)(a) one is not required: our processing of UK residents' data is occasional, does not involve special category or criminal offence data on a large scale, and is unlikely to put your rights at risk.
  5. Our lead supervisory authority is the President of the Personal Data Protection Office in Poland (UODO). If you are in the UK you can also complain to the Information Commissioner's Office (section 7).

2. What data we collect

  1. Preview request form: your name, business name, trade, town, phone number, email address and message, plus the advert you came from (if the link contained it). Business name and phone number are required; the rest is optional.
  2. Emails and calls: anything you tell us when you get in touch, such as your name, role and the content of your message.
  3. Preview: the material you send for your site (text, photos, logo, business contact details) and the preview we build from it.
  4. Contract: invoicing details, the details needed to register your .co.uk domain, the material for your site, and payment and request history.
  5. Technical data: IP address, date and time of the request, browser and device type, and the page visited, collected automatically by our hosting provider.
  6. Advertising and analytics data (only with your consent): described in section 9.

3. Why we use it and on what lawful basis

Replying to your request and preparing your preview

  1. Lawful basis: steps taken at your request before entering into a contract (UK GDPR Article 6(1)(b)). For contact people at a client company: our legitimate interest in replying to business enquiries (Article 6(1)(f)).
  2. How long: 12 months after our last contact if no contract follows. A preview that is not accepted within 30 days is deleted together with the material you sent, sooner if you tell us you are not going ahead.

Providing the website plan

  1. Lawful basis: performance of a contract (Article 6(1)(b)), or our legitimate interest for contact people at a client company (Article 6(1)(f)).
  2. How long: for the length of the contract, then until any claims are time-barred.

Invoices and accounting

  1. Lawful basis: legal obligation under tax and accounting law (Article 6(1)(c)).
  2. How long: 5 years from the end of the year in which the tax became due.

Keeping the site and form secure

  1. This includes limiting the number of form submissions from one IP address.
  2. Lawful basis: our legitimate interest in keeping our services secure (Article 6(1)(f)).
  3. How long: technical logs at Cloudflare Workers are kept for up to 7 days.

Measuring our adverts (Meta Pixel and Conversions API) and site analytics (Microsoft Clarity)

  1. Lawful basis: your consent (Article 6(1)(a) and regulation 6 of the Privacy and Electronic Communications Regulations, PECR). Details in section 9.
  2. How long: until you withdraw consent. We remember your choice for 12 months, then ask again.

4. Do you have to give us your data?

No, but without your business name and phone number we cannot reply to a preview request, and without invoicing details we cannot provide the plan.

5. Who we share it with

We share data only with providers that help us run the site and the service, under data processing agreements or, where that is the nature of the service, as separate controllers.

  1. Cloudflare, Inc. (USA): hosting and content delivery for sites48h.co.uk, the form, technical logs, protection against abuse, and forwarding email sent to hello@sites48h.co.uk.
  2. Resend (Plus Five Five, Inc., USA): sending the emails generated by the form.
  3. LH.pl Sp. z o.o. (Poland): our email hosting (the inbox the form and hello@sites48h.co.uk deliver to).
  4. Fakturownia sp. z o.o. (Poland): issuing invoices.
  5. Our accountants: bookkeeping.
  6. Domain registrar and Nominet (the .uk registry): registering your .co.uk domain in your name. They act as separate controllers under their own terms.
  7. Our bank: processing bank transfer payments.
  8. Meta Platforms Ireland Ltd. (Ireland), which may pass data to Meta Platforms, Inc. (USA): advertising measurement, only with your consent, the data in section 9.1.
  9. Microsoft Corporation (USA): site analytics, only with your consent, the data in section 9.2.
  10. Public authorities and courts, where the law requires it.

We do not sell your data.

6. Transfers outside the UK

  1. We are based in Poland. The UK recognises Poland and the rest of the European Economic Area as providing adequate protection, so data you send us can go there without extra safeguards.
  2. Cloudflare, Resend, Meta and Microsoft may process data in the USA. Where the provider is certified under the UK Extension to the EU-US Data Privacy Framework (the "UK-US data bridge"), that is the basis for the transfer. Otherwise we rely on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses in the provider's data processing terms.
  3. Email us for a copy of the safeguards.

7. Your rights

You have the right to:

  1. access your data and get a copy,
  2. have it corrected,
  3. have it erased,
  4. restrict how we use it,
  5. data portability for data we process under a contract,
  6. object to processing based on our legitimate interests,
  7. withdraw consent at any time, without affecting processing before you withdrew it,
  8. complain to a supervisory authority: our lead authority is the President of the Personal Data Protection Office in Poland (UODO, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl); if you are in the UK you can also complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113).

To use your rights, email hello@sites48h.co.uk. We reply within one month.

8. Automated decisions

We do not make decisions about you based solely on automated processing. The automatic limit on form submissions is only there to stop spam.

9. Cookies and browser storage

  1. Meta Pixel and Conversions API (advertising, only with consent). We load Meta Pixel only after you click "Accept" on the cookie banner. Without consent, Meta gets nothing from us and the site works the same.
    1. Purpose: measuring how our adverts on Facebook and Instagram perform and showing them to people who visited the site.
    2. Data sent from your browser: page views, clicks on example sites, the form being sent, the page address, Meta cookie identifiers (_fbp, and _fbc if you came from an advert), IP address and browser details.
    3. Data sent from our server, only after you send the form and only with consent: the same form event (with the same ID, so Meta does not count it twice), IP address, browser details, _fbp/_fbc, and your phone number and email address as SHA-256 hashes, never in plain text.
    4. Cookies: _fbp and _fbc, lasting up to 90 days.
    5. For collecting and sending this data we are joint controllers with Meta under Meta's Controller Addendum; Meta's further use is covered by its own privacy policy (facebook.com/privacy/policy).
  2. Microsoft Clarity (analytics, only with consent). Loaded with the same consent as Meta Pixel.
    1. Purpose: seeing how people use the site (scrolling, clicks, mouse movement, heatmaps) so we can improve it. We tell Microsoft not to use the data for advertising.
    2. Data: the course of your visit, device and browser type, approximate location from your IP address and a Clarity cookie identifier. Clarity does not record what you type into the form.
    3. Cookies: _clck (up to 12 months) and _clsk (up to 1 day); Microsoft may also set CLID and MUID on its own domains. Recordings are kept for up to 30 days.
  3. Strictly necessary storage (no consent needed): Cloudflare security cookies __cf_bm (up to 30 minutes) and cf_clearance (after a security check), and your cookie choice saved in browser storage (key s48-zgoda) for 12 months.
  4. You can change your choice at any time with "Cookie settings" in the footer. When you withdraw consent, Meta Pixel and Clarity stop collecting data and we remove their cookies from your browser.

10. Security

The site only works over an encrypted HTTPS connection. Only people authorised by Apturn have access to personal data.

11. Our clients' websites

This policy covers sites48h.co.uk only. The websites we build for clients have their own privacy policies. For data collected by a client's site (for example through its contact form), the client is the controller and we process it on their behalf under the Data Processing Addendum in our terms (sites48h.co.uk/terms).

12. Changes to this policy

We may update this policy, for example when the law, our providers or the site change. The current version, with its date, is always available at sites48h.co.uk/privacy. We will email clients with an active plan about significant changes.