Privacy Policy

CreateWeb – Rainer Haage takes data protection seriously. This policy explains what personal data we collect, why we collect it, and what rights you have over it. We have tried to write this in plain English — no unnecessary legal jargon.

This policy covers both createweb.uk (our main website) and shop.createweb.uk (our extension shop). Both sites are separately hosted. Any personal data you provide on the shop is stored on the shop server only and is not linked to or shared with the main website.

1. Who we are (Controller)

Rainer Haage
31a St Georges Road, Flat 1 Church View Court
Worthing, BN11 2DS, UK
Phone: +44 1903 330985
Email: mail (at) createweb (dot) uk
Website: createweb.uk

2. What data we collect and why

2.1 Server log files (both sites)

When you visit either website, our server automatically logs basic technical information: your IP address, browser type, operating system, the page you came from, pages visited, and the date and time of your visit. This data is used solely to keep the website running securely and to investigate any technical issues or attacks. It is not linked to any individual and is deleted after a short retention period.

Traffic to this website passes through Cloudflare's network before reaching our server. Cloudflare may log connection metadata including IP addresses and request data for security and performance purposes. See section 4 for details.

Legal basis: Legitimate interest (Article 6(1)(f) UK GDPR)

2.2 Cookies and tracking (main site – createweb.uk)

We use a cookie consent banner to manage your cookie preferences. You can change or withdraw your consent at any time using the "Manage cookie preferences" link in the footer.

Strictly necessary cookies are set automatically and do not require your consent — they are essential for the website to function.

Functional and analytics cookies are only set with your consent:

Matomo (self-hosted analytics)

We use Matomo to understand how visitors use our website. Matomo is installed on our own server — your data is never sent to third parties. Matomo anonymises your IP address before storing it. If you consent to analytics cookies, Matomo will set a cookie to track your visits. You can withdraw consent at any time via the cookie preferences link.

Chatwoot (live chat)

We use Chatwoot, a self-hosted live chat tool, to allow you to contact us directly from the website. Chatwoot sets a persistent cookie on page load to identify returning visitors. If you use the chat and provide your name or email address, that information is stored on our server so we can respond to you. You can withdraw consent for the Chatwoot cookie at any time via the cookie preferences link, and the cookie will be deleted.

Umami (self-hosted analytics, cookieless)

We use Umami to understand how visitors use our website. Umami is installed on our own server — your data is never passed to third parties. Unlike traditional analytics tools, Umami operates entirely without cookies and does not collect any personal data. IP addresses are not stored. There is no cross-session or cross-website tracking of any kind. The information collected is limited to aggregate page views, referrer sources, browser type, screen size, and country — none of which can identify you as an individual.

Because no personal data is processed and nothing is stored on your device, this tool does not require a cookie consent prompt. We operate it under legitimate interest to improve our website and understand which content is most useful to our visitors. You can object to this processing at any time by contacting us directly.

Legal basis: Legitimate interest (Art. 6(1)(f) UK GDPR)

2.3 Contact form and quote request (main site – createweb.uk)

If you contact us via our contact form, or submit a project enquiry through our quote request tool (powered by LimeSurvey, self-hosted), we collect your name, email address, and any information you provide in your message. This data is used solely to respond to your enquiry and is not passed on to any third party.

Legal basis: Legitimate interest / pre-contractual measures (Article 6(1)(b) and (f) UK GDPR)

2.4 Registration and purchases (shop – shop.createweb.uk)

When you register an account or purchase a subscription on our extension shop, we collect your name, email address, and any additional details required to fulfil your order. This data is used to manage your account, process your purchase, deliver your subscription, and provide support.

You can view, update, or request deletion of your personal data at any time by logging into your account and using the built-in privacy request tools, or by contacting us directly.

Legal basis: Contract performance (Article 6(1)(b) UK GDPR); legal obligation for financial records (Article 6(1)(c) UK GDPR)

Please note: Transaction and payment records are retained for 7 years to meet HMRC requirements, even if you request deletion of your account. Only data we are legally required to keep will be retained beyond your request.

2.5 PayPal (shop – shop.createweb.uk)

If you pay via PayPal, you will be redirected to PayPal's platform to complete your payment. We receive confirmation of your payment but do not process or store your card details. PayPal acts as an independent data controller for payment processing. The applicable PayPal entity and privacy policy will depend on your location. Please refer to PayPal's privacy policy for details of how they handle your data.

Legal basis: Contract performance (Article 6(1)(b) UK GDPR)

3. Data storage and retention

We only keep your personal data for as long as necessary. In practice:

  • Server logs are deleted after a short operational period.
  • Enquiry and contact data is retained as long as needed to fulfil your request, and deleted once no longer relevant.
  • Account and subscription data is retained for as long as your account is active, and for up to 7 years afterwards for financial and legal compliance (HMRC).
  • Analytics data (Matomo, Google Analytics) is anonymised and retained for statistical purposes only.

4. Third-party services and data transfers

All tools we use (Matomo, Chatwoot, LimeSurvey, the Joomla shop) are self-hosted on our own serversin the UK/EU. The only exceptions are:

  • Google Analytics — data transferred to Google LLC (USA), covered by the EU-US Data Privacy Framework.
  • PayPal — payment processing handled by PayPal under their own privacy policy.

  • Cloudflare (CDN and security) — We use Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94043, USA) as a content delivery network and security layer for createweb.uk. All traffic to this website passes through Cloudflare's global network. Cloudflare processes visitor IP addresses and connection data to deliver pages securely and efficiently, and to protect the site from malicious traffic. Cloudflare is certified under the EU-US Data Privacy Framework and has standard contractual clauses in place for UK data transfers. Cloudflare does not sell your data. For details, see Cloudflare's privacy policy.

    Legal basis: Legitimate interest (Article 6(1)(f) UK GDPR) — website security and performance.

We do not sell, rent, or share your personal data with any other third parties.

5. International visitors

If you are visiting from outside the UK or EU, please be aware that your data will be processed in the UK in accordance with UK GDPR. We apply the same data protection standards to all users regardless of their location. If you are based in the USA, please note that no US federal privacy law (such as CCPA) currently imposes obligations on a business of our size, but we are happy to respond to any data request regardless of where you are located.

6. Your rights

Under UK GDPR (and EU GDPR for EU-based users), you have the following rights:

  • Access — you can ask us what data we hold about you and receive a copy.
  • Rectification — you can ask us to correct inaccurate data.
  • Erasure — you can ask us to delete your data (subject to legal retention requirements).
  • Restriction — you can ask us to limit how we use your data while a dispute is resolved.
  • Portability — you can ask for your data in a machine-readable format.
  • Object — you can object to processing based on legitimate interest or for direct marketing.
  • Withdraw consent — where processing is based on consent, you can withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at: mail (at) createweb (dot) uk

We will respond within one month. There is no charge for making a request.

If you are unhappy with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):
https://ico.org.uk/make-a-complaint/
Tel: 0303 123 1113

EU-based users may also contact their local data protection authority.

7. No automated decision-making

We do not use any automated decision-making or profiling that produces legal or similarly significant effects.

8. Changes to this policy

We may update this policy from time to time. The current version is always available at createweb.uk/privacy-policy. We will notify registered shop users of any significant changes by email.

Last updated: May 2026