Privacy policy

01 Who is responsible for your data

LEWCOMMERCE is the trading name of Lewis Stewart, a sole trader in England. I am the data controller for everything described in this policy.

Trading name

LEWCOMMERCE

Proprietor

Lewis Stewart

Address for service

2d Nursery Close, Wroughton, Swindon, SN4 9DR, England

Contact

WhatsApp 07494 582061

Email

info@lewcommerce.co.uk

If you have a question about this policy, or you want to exercise one of the rights in section 08, message 07494 582061 on WhatsApp or email info@lewcommerce.co.uk.

02 What this website collects

Only what you type into the free guide sign-up, if you use it. There is no account to create.

The enquiry sheet on the home page looks like a form, but it does not submit. Everything you type stays in your own browser and is used to write a WhatsApp message or an email for you, whichever button you choose. Close the page without tapping Open WhatsApp or Send as email and that text is gone — it was never sent anywhere.

If you ask for a free guide

The guide page at lewcommerce.co.uk/guide has a sign-up form run by Hostinger Reach, Hostinger's email service. When you submit it, your details are stored in Reach and Reach sends you one email with the download link.

What I hold

Your email address, your first name if you give it, the date you signed up, and whether the email reached you and was opened

Why

To send you the guide you asked for; if you tick the optional box, to email you about guides and offers; and to show you LEWCOMMERCE ads afterwards (see "Ads after you sign up" below)

Legal basis

Sending the guide: your request, because sending it is how I do what you asked. Emailing you about guides and offers: your consent, given by ticking the optional box, which you can withdraw any time. Showing you ads: legitimate interests, which means I judge it reasonable to advertise to someone who asked for a guide from me, and you can object at any time. Ticking the box confirms you've read this policy

Kept for

12 months from sign-up, then deleted. Sooner if you ask

Asking for the guide on its own doesn't put you on a mailing list. You'll get the email with the guide and nothing else. The form has a separate, optional box, unticked by default: "Yes, send me occasional tips and offers from LEWCOMMERCE. Unsubscribe any time." If you tick it, I'll email you occasionally, including about paid guides, until you unsubscribe. If you don't, I won't. Every email has an unsubscribe link, or you can reply "unsubscribe". Reply "delete me" and your details go straight away.

Ads after you sign up

I may upload your email address to Meta (Facebook and Instagram) and Google so that they can show you LEWCOMMERCE ads while you use their services. The platforms match the address against their own users and use it for that purpose only, under their own terms. This is the only way your details are used for advertising: nothing on this website tracks you, and it sets no advertising cookie.

To stop it, reply to the guide email and say "no ads", and I'll remove you from those audiences and stop uploading your address. You can also turn off ads based on your details in your Facebook, Instagram or Google ad settings.

03 What is collected automatically

Web server logs

The site is hosted by Hostinger. Like any web server, theirs records standard technical information whenever a page is requested.

Data

IP address, date and time, page requested, browser and operating system, referring page

Why

Keeping the site online and secure, and diagnosing faults

Legal basis

Legitimate interests — running a website safely

Kept for

Hostinger's standard log retention period, then deleted

These logs are not read routinely and are not used to build any profile of you.

Fonts

The typefaces are served by Google Fonts. Loading them means your browser requests files from fonts.googleapis.com and fonts.gstatic.com, which tells Google your IP address and which page asked for them. Google may process this outside the UK. No cookie is set by this, and on every page except the guide page it is the only third party contacted before you choose to get in touch. The guide page also loads its sign-up form from Hostinger Reach (section 04).

04 Cookies

This site sets no cookies. No analytics, no advertising pixel, no session cookie, and no consent banner — because there is nothing to consent to.

One exception, on the guide page only: the sign-up form is loaded from Hostinger Reach, and Hostinger's security service sets one cookie, __cf_bm, which tells real visitors apart from bots and expires after 30 minutes. It's strictly necessary for the form to work safely, so the law doesn't require consent for it, and it isn't used to track you. The page is set up so Reach doesn't store anything else in your browser.

If that changes, a consent banner will appear first, non-essential cookies will stay blocked until you accept, and this section will be rewritten with the date.

05 When you get in touch

You can reach me three ways, and each one carries your message differently. On WhatsApp, WhatsApp Ireland Ltd (part of Meta) processes the message under its own terms, which I do not control, and your phone number is visible to me as in any WhatsApp conversation. On Instagram, Meta processes the message the same way, and your username and profile are visible to me as in any Instagram conversation. By email, the message reaches the info@lewcommerce.co.uk mailbox hosted by Hostinger, which I read in Google's Gmail app — so your email address and whatever you write sit with those two providers as well as with me.

What I hold

Your name, phone number or email address, business name, and whatever you tell me about the job

Why

To answer your enquiry and, if you go ahead, to carry out the work

Legal basis

Steps taken before entering a contract, then performance of that contract

Kept for

Enquiries that go nowhere: deleted within 12 months. Clients: six years after the final invoice, the period business records must be kept for HMRC

Getting in touch doesn't put you on a mailing list. If you enquire and don't become a client, you won't hear from me again unless you get back in touch.

If you order printed products

A print order needs more from you than an enquiry does, because something physical has to reach you. I pass a delivery name, address and contact number to the trade printer that produces your order, and they pass it to the courier that delivers it (section 07). I do not see or hold your card details: payment is made directly through the payment provider.

What I hold

The delivery name, address and phone number for the order, what was ordered, and the artwork files — which may contain personal data if you chose to put it there, such as a name, phone number or photograph of a person

Why

To get the order printed, proofed and delivered to you, and to handle any fault or reprint afterwards

Legal basis

Performance of our contract

Kept for

Order records: six years after the invoice, the period business records must be kept for HMRC. Approved artwork files: kept so that a reorder needs no new proof — ask me to delete them and I will, and they go

If the artwork is for your own customers — a mailing list printed onto postcards, for example — then that is your data and not mine. I handle it only on your instructions, use it for that job alone, and return or delete it when the job is finished.

If you comment to get the free guide

Comment "GUIDE" on one of my Instagram posts and a DM comes back automatically. It is sent by ManyChat, a tool connected to my Instagram account (section 07), so your Instagram username, the comment you left and the messages in that DM sit with ManyChat as well as with Instagram and me. The DM asks you to follow the account, then sends you the link to the guide page; it never asks for your email address. If you want the guide you enter your email on that page, and section 02 covers what happens to it. Reply to the DM and you are talking to me, not the automation.

06 If I contacted you first

I find local businesses whose websites I think I could improve, check their sites, and get in touch about what I found — by email, or on LinkedIn. If that reached you, this section is the notice UK GDPR requires when personal data wasn't collected from you directly.

Where it came from

Apollo.io, a business contact database that supplies company details and the work contact details of people at those companies; LinkedIn, where I read what you and your business show publicly on your profiles; your business's own website; and occasionally a recommendation from someone who knows your business

What I hold

Business name, website, business email address and phone number, the name, job title and work email address of a contact at the business, and, if I contacted you on LinkedIn, your name, job title and profile link; company size and the website technology it uses; my notes on what I found on your website; and a record of what I sent and whether you replied

Why

To tell you about specific problems on your website and offer to help fix them

Legal basis

Legitimate interests: telling a business about a service relevant to its website, using work contact details only

Kept for

No reply: deleted within 12 months of my last message. If you reply and we talk, section 05 applies from then on

Who I contact, and how

By email: businesses, at the work email addresses listed for them in Apollo.io. I send one email about what I found and, if you haven't replied, one follow-up about a week later. That is two emails at most, and the follow-up is never sent if you have replied or asked me to stop.

On LinkedIn: the owner or manager of a business, from my own personal profile. I send a connection request with no sales pitch in it. If you accept, I send one message about what I found; if you don't, I withdraw the request and that's the end of it. Every message is written and sent by me, not by automation software.

Each business hears from me on one channel only, email or LinkedIn, never both. On LinkedIn I send no follow-up. Everyone is checked against my do-not-contact list first, and every message says who I am and how to stop further messages.

How to stop it

Reply to the email or LinkedIn message and say "stop", or message me on WhatsApp or by email. I'll stop straight away and won't contact your business again, on any channel. I delete your details except the business name and the email address or LinkedIn profile I contacted, which go on a do-not-contact list so you aren't contacted by mistake later. You can still use any of the rights in section 08.

07 Who else sees your data

Nothing is sold or rented. Your details are handled only by the services needed to run the business, plus Meta and Google if you signed up for the free guide, for the ads described in section 02.

Hostinger

Website hosting, server logs, the business email mailbox, and Hostinger Reach, which runs the free guide sign-up and sends the guide email

WhatsApp, Instagram / Meta

Carrying the messages between us, if you contact me on either; and, if you signed up for the free guide, matching your email address to show you ads (section 02)

ManyChat

Sending the automatic Instagram DM if you comment "GUIDE" on a post, which means it holds your Instagram username, that comment and the messages in that DM. It is never given your email address (section 05)

Google

Serving typefaces, which receives your IP address; the Gmail app I read business email in; Google Drive and Google Sheets, where working files are stored, including the spreadsheet I use to track the emails I send to businesses (the contact's name and work email address, what I sent and any reply); and PageSpeed Insights, which is given your website's address when I check its speed; and, if you signed up for the free guide, matching your email address to show you ads (section 02)

ClickUp

The task and contact tracker where prospect and client records are kept

LinkedIn

A source of public profile details, and carrying the messages between us, if I contact you there

Apollo.io

A source of business and work contact details, and the searches I run to find them

UptimeRobot

Checking that client websites are online, which it does using the website's address

The trade printer & its courier

If you order printed products: the printing company that produces your order and the courier that delivers it are given the delivery name, address and phone number, and the artwork to be printed. They are not given anything else, and they are not permitted to use it for their own marketing

Payment provider

Takes your payment for an order and holds your own payment details under its own terms. I am told that a payment succeeded, not what you paid with

People who help me

A freelancer building prospect lists or a subcontractor building a client's site, only the data they need, under a written agreement and my instructions

Accountant & HMRC

Client invoices, where the law requires it

Solicitor & insurer

Only if advice is needed on a contract, a complaint or a claim

Some of these operate outside the UK. Where they do, transfers rely on the UK's adequacy regulations (including the UK–US data bridge for certified US companies) or on the UK's international data transfer agreement or addendum — the safeguards UK data protection law provides for exactly this.

If a client's own website or systems are involved in a job, anything seen there is confidential and covered by the agreement for that work, not by this policy.

08 Your rights

Under UK GDPR you can ask me to:

• Tell you what personal data I hold about you, and give you a copy
• Correct anything that is wrong
• Delete it, where there is no legal reason to keep it
• Restrict or object to how it is used — and if it's used to contact your business about my services, you can stop that at any time, no reason needed
• Provide it in a portable format

Ask on WhatsApp or by email and you will get a response within one month. There is no charge.

If you are unhappy with how I have handled it, you can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint, or on 0303 123 1113. I would rather you told me first so I can put it right.

09 Changes to this policy

If this policy changes, the date at the top changes with it. Subscribers aren't notified of changes, so the version and date are the record.

Version 1.5, 7 October 2026: the free guide sign-up now has an optional box to receive emails, and your email address may be used to show you ads on Meta and Google (section 02).

Version 1.6, 7 October 2026: commenting "GUIDE" on an Instagram post now gets you an automatic DM, sent by ManyChat, which is added to the list in section 07 and explained in section 05.

Version 1.7, 7 October 2026: if I email your business about what I found on its website and you don't reply, I now send one follow-up about a week later, two emails at most (section 06). LinkedIn is unchanged: one message and no follow-up.

Version 1.8, 7 October 2026: the spreadsheet I use to track the emails I send to businesses is kept in Google Drive and Google Sheets, so section 06 now says I hold a record of what I sent and any reply, and section 07 names it under Google.

Version 1.9, 22 October 2026: printed products can now be ordered, so section 05 explains what a print order collects — a delivery address and your artwork — and section 07 adds the trade printer, its delivery courier and the payment provider to the list of who else sees your data. Approved artwork files are kept so reorders need no new proof; you can ask me to delete them at any time.