Privacy policy.

OneGrand is a web design, software and IT services company based in Manchester, United Kingdom. For the purposes of UK data protection law (the UK GDPR and the Data Protection Act 2018) we are the data controller for the personal data described in this policy.

If you have any questions about how we handle your data, email hello@onegrand.co.uk. We aim to respond within five working days.

We only collect what we need to run the studio and reply to you. Depending on how you interact with us, that may include:

• Contact details you give us through our enquiry form or by email: your name, email address, company name and phone number.
• Project details you choose to share, such as budget, timelines and a description of what you need.
• Technical data when you visit the site: IP address, browser type, device, pages viewed and referring URL, collected in aggregate by our hosting and analytics providers.
• Billing details if you become a client, including your business address and VAT number where relevant.

We use your personal data to reply to enquiries, prepare proposals, deliver and support the work you commission, send invoices, and keep the website secure and performing well.

Our lawful bases under UK GDPR are: performance of a contract (or steps taken at your request before entering one); our legitimate interests in running and promoting a small business; and, where we ask for it, your consent. We do not use your data for automated decision-making or profiling.

We will only send marketing emails if you have opted in, and every one includes an unsubscribe link.

We never sell personal data. We share it only with trusted suppliers who help us run the studio, each bound by their own data processing terms:

• Hosting and infrastructure providers that serve this website and our email.
• Privacy-focused analytics tools that report aggregate traffic without identifying individuals.
• Accounting and invoicing software used to bill clients.
• Professional advisers such as our accountant, where required by law.

Some of these providers process data outside the UK. Where they do, we rely on the UK International Data Transfer Agreement, UK adequacy regulations or equivalent safeguards.

When we run lead generation for a client, we handle personal data on that client's behalf: enquiries from their campaign forms, calls and bookings, and, for outreach campaigns, business contact details. In these cases the client is usually the data controller and OneGrand acts as their data processor, under a written agreement. If you are contacted through one of these campaigns, the business you were put in touch with is responsible for how your data is used, and you can exercise your rights with them or with us.

For lead generation forms and calls, we collect only what the client needs to respond: typically your name, contact details, location and what you are asking about, with your consent to be contacted. Forms use spam and bot filtering. Leads are passed to the client's CRM or inbox and are not sold or shared with anyone else.

Business-to-business cold email outreach is run with the aim of meeting the Privacy and Electronic Communications Regulations (PECR) and UK GDPR:

• We email limited companies and limited liability partnerships only, unless the recipient has given consent. Sole traders and partnerships are not emailed without consent.
• Each campaign relies on legitimate interests, and we document a legitimate interests assessment for it before it starts.
• Contact data comes only from reputable data suppliers.
• Every email includes a way to opt out. Opt-outs are added to a suppression list shared across our campaigns, so you will not be emailed again.
• Outreach is sent from separate sending domains rather than a client's main domain.

Outreach and lead data is kept only for as long as the client's campaign needs it, then deleted or returned to the client. To opt out of outreach or ask what we hold about you, email hello@onegrand.co.uk.

This website uses a minimal set of cookies. Strictly necessary cookies keep the site working and remember your preferences. We use privacy-first analytics that do not set cross-site tracking cookies and do not store personal data.

You can block or delete cookies in your browser settings at any time. Doing so may affect some features of the site.

Enquiries that do not become projects are deleted after 12 months. Client records, contracts and invoices are kept for six years after the end of the engagement, as required by HMRC. Aggregate analytics data is retained for 24 months.

We hold data on access-controlled, encrypted services and limit it to the people who need it to do their job.

Under UK GDPR you have the right to access the personal data we hold about you, to have it corrected or erased, to restrict or object to how we process it, and to ask for a copy in a portable format. Where we rely on consent, you can withdraw it at any time.

To exercise any of these rights, email hello@onegrand.co.uk. We will respond within one month. If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

We review this policy at least once a year and whenever our practices change. The date at the top tells you when it was last updated. Significant changes will be flagged on this page, and to existing clients by email.