Privacy notice

Your privacy

Last updated: 1 October 2026

This notice explains what personal information Nawa Labs collects, why, and what you can do about it. It is written in plain English. If anything is unclear, email [email protected].

Who is responsible

Nawa Labs is a web design and software business in London, run by Abu as a sole trader. Nawa Labs is the "controller" of the personal information described here. You can contact me at [email protected] or on 07466 839423.

What this website collects

Like every website, the hosting provider (Cloudflare) processes basic technical information such as your IP address and browser type so the site can be delivered and protected from attacks. I may use Cloudflare Web Analytics, which counts visits without cookies and without identifying you.

What I collect when you get in touch

If you message, call or email me, I receive what you choose to share, usually:

• your name, business name, phone number and email address
• details about your business, such as your trade, area, prices and photos
• the messages we exchange

If you become a client, I also keep records such as quotes, invoices and payments. To manage your domain or Google profile, you invite me as a user on your own account. I never ask for your passwords.

The client portal

Clients get a private link on portal.nawalabs.uk to send their details, photos and change requests. What you send there is stored with Cloudflare (the database is held in Western Europe) and only I can see it, after signing in. Your progress on a form is saved in your own browser until you send it. Files sent through the portal are deleted from it within 90 days of the job being finished, and I keep only what is used on your website.

Why I use it, and the legal basis

• To reply to you and prepare a quote or free preview. This is to take steps you have asked for before a contract, or my legitimate interest in answering enquiries.
• To build and look after your website. This is to carry out our contract.
• To keep business and tax records. This is a legal obligation.
• To follow up on an enquiry you made, for example to check you received your preview. This is my legitimate interest. I will not add you to a mailing list or send marketing without asking first.

Who else sees it

I do not sell your information. It is only shared with services I use to run the business, such as:

• WhatsApp (Meta), phone and email providers, to talk to you
• Cloudflare, to host websites and manage domains
• Google, for business email, documents, and Google Business Profile setup if you ask for it
• my bank, payment providers and accountant, for invoices and tax

Some of these providers may process data outside the UK. When they do, they use recognised safeguards such as the UK International Data Transfer Addendum or an adequacy decision.

How long I keep it

• Enquiries that do not go ahead: up to 12 months, then deleted.
• Client records, invoices and payments: 6 years after the end of the tax year they relate to, as HMRC requires.
• Website content and photos you give me: for as long as I look after your site, then returned or deleted when you ask.

Your rights

You can ask to see the information I hold about you, ask me to correct it, delete it, limit how I use it, or send it to you in a portable format. You can also object to me using it for my legitimate interests. Email [email protected] and I will reply within one month.

If you are unhappy with how I have handled your information, please tell me first so I can put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk.

Changes

If this notice changes, the new version will be posted here with a new date.