Privacy Policy

Last updated: 9 October 2026

Who we are and how to contact us

We Are Panda provides website design, hosting, maintenance and business automation services. This notice explains how we handle personal information about website visitors, people who enquire about our services, customers and business contacts.

The data controller is We Are Panda, a partnership. We are responsible for deciding how and why your personal information is used.

For privacy questions, to exercise your rights or to make a data protection complaint, email business@wearepanda.co.uk, or write to We Are Panda, 1 Westley Mews, BS24 7FZ, United Kingdom. Paul and Alan handle privacy enquiries.

Where we process personal information on a customer’s behalf when providing hosting or automation services, the customer may be the controller. Our processing responsibilities for that work are set out separately in the relevant service agreement. This notice covers information we control for our own business.

Information we collect and where it comes from

• Enquiries and correspondence: your name, email address, business name, role, website address, contact details you choose to provide, and the contents of your enquiry and subsequent correspondence. We receive this directly from you when you contact us.
• Website contact form: the contact form asks for your name, email address and message, with fields for a phone number, postcode and business name. Ninja Forms records submissions in our WordPress website and prepares an email notification containing the submitted details.
• Facebook and Instagram enquiries: if you submit one of our Meta lead forms, we receive the information you submit, such as your name, email address, company, role and answers about the work you would like help with. Meta supplies this information to us through its lead-form service.
• Customer and project records: business contact and billing details, proposals, contracts, invoices, payment status, service requests and project materials you provide. Please only share other people’s personal information where you have authority to do so.
• Business research: [CONFIRM: whether business prospect research is in use; exact public sources, information collected and source-record storage].
• Website technical information: our website uses Google Tag Manager to manage tags and loads Google Analytics, Meta Pixel and Tawk.to live-chat scripts. These services can receive technical information about your device and website activity. [CONFIRM: actual fields, active events, server-log fields and security services].

Please do not include passwords, payment-card details, sensitive personal information or unnecessary information about your customers in an initial enquiry. We may ask for further information if it is needed for an agreed service, using an appropriate method.

You can choose whether to give us information. If you do not provide contact details or the information needed to understand your request, we may be unable to reply, prepare a quote or provide the requested service.

Why we use information and our lawful bases

• Answering enquiries and preparing quotes: taking steps at your request before entering a contract where you would be the individual contracting customer. For enquiries on behalf of a company or another organisation, our legitimate interest is communicating with its representatives and assessing the requested work.
• Providing and administering services: performing our contract with an individual customer. When the contract is with an organisation, our legitimate interests are delivering the agreed service, managing the business relationship and communicating with its contacts.
• Invoices, accounts and statutory records: complying with applicable tax and accounting obligations. Our legitimate interests also include collecting payments due and maintaining accurate business records where there is no specific legal obligation.
• Security, preventing misuse and dealing with disputes: our legitimate interests in protecting our website, systems and business, and establishing, exercising or defending legal claims.
• Cookies, analytics and advertising technologies: Google Analytics helps measure website use; Meta Pixel is associated with advertising measurement and targeting. [CONFIRM: actual configured purposes/events, lawful bases and enforced PECR consent for these services]. CookieYes provides the visitor cookie-choice interface.

When relying on legitimate interests, we must consider whether the use is necessary and balance our interests against your rights and reasonable expectations.

Enquiry follow-up and marketing choices

If you request information or a quote, we use your details to respond and follow up about that request. Submitting an enquiry or a Meta lead form does not automatically subscribe you to a newsletter or unrelated marketing.

We do not currently run a newsletter or separate email marketing programme. We plan to advertise our services on Facebook and Instagram. If you submit an enquiry through an advert, we use the details you provide to answer and follow up on your request. This does not give us permission to send you unrelated marketing.

You have an absolute right to object to the use of your personal information for direct marketing, including related profiling. Email business@wearepanda.co.uk to tell us. Where we rely on your consent, you can withdraw it at any time; this does not affect the lawfulness of earlier use. We may retain the minimum information needed to honour an objection rather than contact you again.

Who receives your information

Paul and Alan use our shared Google business inbox to deal with enquiries. Google provides the email service. Information needed to operate our services may also be handled by the following categories of suppliers:

• 20i hosts our website in the United Kingdom and provides automatic website backups. UK website hosting does not mean that every other supplier processes information only in the UK.
• Google for website tags and analytics, Meta for the Meta Pixel, Tawk.to for live chat, and CookieYes for cookie choices. The information disclosed depends on the service and your interaction with it. [CONFIRM: actual events, chat contents/identifiers, consent enforcement and provider processing arrangements].
• Domain registrars where we register or manage a domain for you.
• Xero provides our accounting software for customer contact, invoice and accounting records. We may also use payment providers where you purchase a service.
• Professional advisers or public authorities where necessary for advice, legal claims or a legal obligation.

[CONFIRM: remaining current visitor/enquiry data flows and provider arrangements, including payment, review widgets and scheduling; do not include development-only services as live enquiry recipients].

If you use Facebook or Instagram to submit an enquiry, Meta also processes information under its own privacy policy. Its independent use of your platform information is separate from our handling of the enquiry.

Automation and artificial intelligence

We do not currently use AI or n8n workflows to process real enquiries. We advertise automation services, but that does not mean that your enquiry is being processed by AI. We will update this notice before introducing new uses of your enquiry information, including any AI processing.

International transfers

[CONFIRM: the countries and entities receiving personal information outside the UK, including remote access, and the actual transfer mechanism. Specify any applicable UK adequacy regulations or appropriate safeguards, such as the UK International Data Transfer Agreement or UK Addendum, and how a person can obtain a copy or information about the safeguards].

You can ask about where your information is handled by contacting business@wearepanda.co.uk.

How long we keep information

We keep personal information only for as long as it is needed for the purpose for which it was collected, taking account of any legal obligations and the need to deal with disputes.

• Enquiries that do not become customers: Paul and Alan manually review and arrange deletion of enquiry records three months after the last contact, unless an enquiry is still active or the information is needed for a legal obligation or dispute. This includes website submission records and relevant email copies. Closing or archiving an enquiry is different from deleting it.
• Customer and service records: for the duration of the relationship and afterwards where needed for outstanding work, contractual responsibilities or legal claims. The period depends on the service, the record and the applicable obligation.
• Tax and accounting records: for the period required by the tax and accounting laws that apply to our legal business structure. These records are not covered by the three-month enquiry period.
• Marketing objections: the minimum suppression record needed to continue respecting your choice.
• Website backups: we use 20i’s automatic backups and do not keep separate indefinite backup copies. [CONFIRM: configured backup product and its file/database retention windows; ensure expired enquiry data is not returned to ordinary use after a restore].
• Technical logs and other supplier copies: [CONFIRM: actual retention periods and deletion arrangements for current services].

Cookies and external website services

Cookies and similar technologies can store or access information on your device. Some are needed to provide a service you request; other uses require consent or must meet the conditions of a specific legal exception. Advertising and tracking across websites require consent.

Our website displays a CookieYes banner with a Cookie Settings option and a Save My Preferences control. [CONFIRM: repair and test consent enforcement, advertising-cookie classification and a way to reopen choices]. Our Cookie Policy must identify the technologies actually used, their purposes and durations. Browser settings may also let you block or delete cookies; this can affect website functionality.

External websites and platforms linked from our site have their own privacy information. If an external service is embedded in our site, it may receive technical information when it loads; the actual services and controls must be explained in our cookie information.

Your rights

Depending on the circumstances and our lawful basis, you can ask to access your personal information, correct inaccurate information, erase information, restrict its use, receive certain information in a portable format or object to processing based on legitimate interests. These rights have conditions and exceptions; for example, information needed to meet a legal obligation may not be erased immediately.

You can withdraw consent at any time where processing relies on consent. Your right to object to direct marketing is explained separately above.

Email business@wearepanda.co.uk to make a request. We may ask for reasonable information to verify your identity. Requests are normally free and we normally respond within one month. Where the law permits extra time or a different response, we will explain why.

Data protection complaints

If you are concerned about our handling of your personal information, contact business@wearepanda.co.uk or write to the address above. Describe what happened and how you would like it resolved.

We will acknowledge your complaint within 30 days, take appropriate steps to investigate without undue delay, keep you informed about progress and tell you the outcome.

You also have the right to complain to the Information Commissioner’s Office, the UK data protection regulator. See ico.org.uk/make-a-complaint or telephone 0303 123 1113.

Changes to this notice

We will update this page when our handling of personal information changes. The date at the top shows the latest revision.