Legal
Data Processing Annex
When someone fills in a form on your website, their details are yours. This one page says exactly how we handle them on your behalf. It forms part of our Terms of Service (section 12).
Last updated 10 September 2026
Between: you (the client business — the “controller”) and Nedas Mikelionis, trading as Little Web Lab, 3 Tattershall Road, Boston PE21 9JG (the “processor”).
What this covers
When someone fills in the contact form, quote form, callback request or booking on your website, their details go to you. We run the systems that carry them. Under UK GDPR that makes you the controller (it's your customer, your decision what to do with it) and us the processor (we handle it on your instructions, and only for the purposes below).
Purpose: to build, host and run your website; to deliver enquiries, leads and bookings to you; to send the automatic emails your site sends (auto-replies, confirmations, reminders); and to show you your leads in your dashboard. Nothing else. We never sell, share or use your customers' data for our own marketing.
What the data is: name, phone number, email, address, the message or job description, any photos or documents they upload, booking details, and technical details like the time of the submission. We don't ask for anything sensitive (health, finances) and your forms shouldn't either.
Sub-processors — the providers we use to run your site
| Provider | What it does for your site | Where data is held |
|---|---|---|
| Cloudflare | Hosting, the form-handling code, spam protection (Turnstile), cookieless visitor stats, file uploads | EU and US — EU data-residency set where the product allows; covered by Cloudflare's Data Processing Addendum with UK/EU standard contractual clauses |
| Supabase | The database that stores your leads and powers your dashboard login | EU (Frankfurt) |
| Resend | Sends the emails — lead alerts to you, auto-replies and confirmations to your customers | US, under standard contractual clauses |
| Your booking tool (Get Booked only — Setmore by default, or the tool you already use) | Online booking, ordering, reminders, customer records and any payments — an account in your name, embedded in your site | Setmore: US, under standard contractual clauses. The booking provider is a controller in its own right for booking and payment data |
| Stripe (our billing) | Takes your monthly payment to us (your card details, not your customers') | EU/US, under standard contractual clauses |
Whichever booking tool you use (Setmore, Fresha, Booksy, Cal.com, Square…), its own terms apply to booking data; we never store your bookings on our systems.
We'll tell you by email before adding a new provider. If you object on reasonable grounds we'll look for an alternative, and if there isn't one you can cancel without penalty.
How long we keep it
Leads, enquiries and booking records: 24 months from the date they came in, then deleted automatically. Sooner if you ask. Emails already delivered to your inbox are yours to keep or delete as you choose.
Security
Every site is served over HTTPS. Data is stored with providers that hold recognised security certifications (ISO 27001 / SOC 2). Access to your data is limited to the two of us at Little Web Lab, behind two-factor authentication. Forms carry spam and bot protection. We don't keep copies of your data on personal devices.
Your rights, and your customers' rights
If one of your customers asks to see, correct or delete their data, tell us and we'll do it within 5 business days so you can meet your legal deadline. You can ask us at any time what data we hold for you.
When you leave
Within 14 days of the end of your plan we give you an export of your leads (a spreadsheet) if you want one. Your customers' data — and your own account data — is then deleted from our systems 30 days after your plan ends, automatically; your account page shows the exact date. We keep only what the law requires us to keep (for example, billing records).
If something goes wrong
If we become aware of a breach affecting your customers' data, we tell you within 72 hours of finding out, with what happened, what data was involved, and what we're doing about it, so you can meet your own reporting duties.
The formal bits, briefly
We process data only on your documented instructions (these terms and your requests). Our staff are bound by confidentiality. We help you with data-protection requests and impact assessments where reasonable. We keep records of processing and will show you them on request. Our sub-processors are bound by written terms at least as protective as these. This annex is governed by the law of England and Wales, like the Terms of Service.
Nedas Mikelionis, trading as Little Web Lab · [email protected] · see also our Privacy Policy.