Privacy policy.
Clear information about how we collect, use and protect personal data.
Last reviewed 14 October 2026This notice describes how we handle personal information when you visit our website, enquire about our services or work with us. It applies to the website and our own business operations. Separate privacy arrangements may apply to websites we build or manage on behalf of clients.
01Who is responsible for your information?
Green Goat Design Limited (company number 12288533) is the data controller for its own business and website activities. Simon Charles Clark is the director responsible for privacy enquiries and day-to-day data-protection decisions. Registered office: The Pines, West Walberton Lane, Walberton, Arundel, West Sussex BN18 0QS, United Kingdom. Email: [email protected]. When we process personal information strictly on a client's instructions for a client-owned website or service, that client will normally be the controller and Green Goat Design Limited may act as a processor under separate agreed terms.
02What information do we collect?
We collect information that you give us, such as your name, business name, work role, email address, telephone number, enquiry or brief, and communications with us. For clients, this can include contracts, project materials, contact records, invoices and payment or accounting information (not full payment-card details unless specifically arranged). Our website and hosting, analytics or security tools may process IP addresses, approximate location, browser/device details, access logs, pages visited, form submissions, referral information and cookie or similar identifiers. Marketing subscriptions may include your address, signup and preference records, and unsubscribe status. Do not send sensitive personal information through a routine contact form unless we ask for it.
03Why we use information and our lawful bases
Enquiries and quotes: to respond and prepare requested work - steps towards a contract, or legitimate interests where you contact us for business purposes. Client services: to manage and deliver agreed projects - contract, or legitimate interests for business contacts where the contracting client is an organisation. Invoicing and accounts: to meet financial and legal requirements - legal obligation. Site security and maintenance: to protect the website, diagnose faults and prevent misuse - legitimate interests. Analytics and advertising: where we use optional tracking, the applicable cookie/storage rules require an appropriate consent or an applicable legal exception. Any subsequent personal-data processing must also have a UK GDPR lawful basis. Marketing: consent where required, or a legally permitted existing-customer or business-to-business route, always with a clear unsubscribe or objection option.
04Where information comes from
Usually directly from you, your employer or your browser when accessing the site. Occasionally we receive relevant professional contact details through a referral, a client contact or a public business listing. Where legally required, we provide privacy information when using data obtained indirectly.
05Who receives information?
Depending on the services in use, we share limited information with hosting and email providers, website security and backup suppliers, contact-form/email-delivery services, website analytics and advertising services, mailing-list providers, accountants and professional advisers, and project subcontractors when necessary. We do not sell personal information. We do not publish your details as client testimonials without appropriate authority. The website uses services associated with WPForms, WP Mail SMTP, Wordfence, LiteSpeed Cache, Google Analytics/MonsterInsights, Mailchimp and a cookie-consent plugin. Google tags and Meta Pixel code have been identified in Divi integration settings; the services and cookies in use may change as we maintain the website.
06Cookies, analytics and marketing technology
We use essential technologies where needed for security, form delivery, website operation and saving privacy preferences. Other technologies, including analytics and advertising identifiers, are optional unless a relevant statutory exception applies. Where permission is legally required, non-essential tracking should only operate with your consent. You can change your cookie choices using the consent controls where available, or adjust browser settings. Please see our separate Cookie Policy for more information. You can also contact us for details of the specific technologies in use.
07How long do we keep information?
We retain information only as long as reasonably necessary for its purpose and applicable obligations. Company accounting records are ordinarily kept for at least six years from the end of the financial year to which they relate, and longer where required. Client project records are reviewed at the end of the engagement and retained where needed to deliver support, resolve disputes or establish legal rights. Enquiries that do not become work are periodically reviewed and erased when no longer useful. Mailing-list contacts remain until unsubscribed or removed through list hygiene; minimal suppression records may remain to respect opt-outs. Security logs, form entries and backups follow the configured retention schedules of the relevant systems. If you would like details of the retention period relevant to your information, please contact us.
08International transfers
Some technology suppliers may process information outside the UK, including in the EEA or United States. When UK data-protection transfer restrictions apply, we use a valid adequacy arrangement (including the UK-US Data Bridge where the recipient is eligible), appropriate contractual safeguards such as a UK IDTA or UK Addendum, or another lawful transfer mechanism as relevant. We can provide information about the applicable safeguards on request. For information about safeguards applying to a particular provider or transfer, please contact us.
09Keeping data safe
We take reasonable technical and organisational measures, including access restrictions, appropriate passwords and authentication, site security, software maintenance and backups, to safeguard personal information. No internet service can guarantee absolute security. If we identify a reportable personal-data breach, we will follow applicable notification obligations.
10AI-assisted services
We may use AI-assisted software for drafting, design exploration, development or research when useful. We aim to limit or remove personal information supplied to such services unless appropriate safeguards and client instructions permit its use. We do not intentionally upload confidential client data to public AI tools without an appropriate basis or permission. Specific AI suppliers and agreements will be reviewed when used for personal data.
11Your rights
Subject to the circumstances and legal exemptions, you may have rights to be informed, access your data, correct inaccuracies, request erasure, restrict processing, object to certain uses, withdraw consent and request portability. You may also challenge decisions made solely by automated processing if applicable. To exercise a right, email [email protected]. We may need to verify your identity and will respond within the legal timeframe. You have the right to object to direct marketing at any time. You can also unsubscribe using the link in an applicable marketing email.
12Privacy complaints
Please email [email protected] with your concern and enough detail for us to investigate. We will acknowledge a data-protection complaint within 30 days, investigate appropriately and explain our findings and any action taken. You may also complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint/.
13Other websites and changes
Links to third-party websites are governed by their own privacy notices. We may update this notice when our services, suppliers or legal requirements change. The date at the top identifies the most recent review.
Email [email protected] or read our Cookie Policy.