Privacy Policy

Last updated: 15 July 2026

1. Who we are

This policy explains what we do with your personal data when you use our website, send us an enquiry, or work with us. It is written to be read, not to be skimmed past.

The data controller is Expect Best Ltd, a company registered in England and Wales under company number 08878408, whose registered office is at A34 Arena Business Park, Holyrood Close, Poole, Dorset, BH17 7FJ. We have been trading since 2010. We provide web design, web development, SEO, digital marketing, hosting, domains and free online tools. Our website is expectbest.co.uk.

For anything to do with data protection, including any of the rights in section 17, contact us by email at sales@expectbest.co.uk, by phone on 01202 237027, or by post at the address above.

We have not appointed a Data Protection Officer. We are a small business and the law does not require us to have one. We would rather say so plainly than invent the role. Data protection questions go to sales@expectbest.co.uk and a person will answer them.

2. The short version

If you read nothing else, read this.

• We run our own analytics on this website. It is not Google Analytics. It stores a visitor id cookie on your device that lasts 180 days, plus session ids and some browser storage.
• It runs as soon as a page loads, and the storage listed in section 5 is written to your device at that point. Nothing on this website behaves any differently either way.
• If you would rather it did not store anything, you can stop it from your browser by blocking or deleting cookies for this site, or by using a private window. Section 6 sets out exactly how.
• Our lawful basis for the analytics is legitimate interests. Section 7 names the interest and explains how we have balanced it against your privacy.
• There is no advertising on this website. No ad networks, no ad personalisation, no Facebook pixel, no Google Tag Manager, no advertising pixel of any kind, and we do not sell your data to anyone. We do advertise our own business elsewhere, including on Google Ads, so if you arrive here by clicking one of our ads, our analytics records the ad click id (gclid) that Google puts in the link, to count that the ad worked. That is us measuring our own advertising. It is not advertising aimed at you, and nothing about it follows you off this site.
• If you send us an enquiry, it goes to our team by email and into our private admin system. Section 13 is honest about what deletion can and cannot achieve there.
• You can complain to us directly, and you can complain to the Information Commissioner's Office. Section 18.

3. What personal data we collect

• Enquiry details: your name, email address, phone number, the message you write, and a record of which page you sent the enquiry from.
• Correspondence: what you send us and what we send you by email, by phone, or by post, including the content of the conversation.
• Website usage and attribution data: the pages you view, page titles, the website that referred you, marketing parameters in the link you arrived on (utm_source, utm_medium, utm_campaign and similar, plus the Google Ads gclid), how you engage with the page, and the actions we count as conversions: sending a form, tapping a phone number, tapping an email address, and tapping a WhatsApp link.
• Identifiers stored on your device: a visitor id and session ids, plus some browser storage. Section 5 lists every one of them, what it does and how long it lasts.
• A hashed version of your IP address: your IP address reaches our server as part of any normal web request, because that is how the internet works. Our tracking script never sends your raw IP address in the data it collects, and our server converts it into a hash rather than storing it as it is.
• Server logs: our web host keeps standard access logs. These do contain IP addresses. They exist for security and troubleshooting.
• What you put into our free tools: see section 9, because the answer is different depending on which tool you use.
• Business contact details: if you are a client or a supplier, the names, roles, email addresses and phone numbers we need to do the work and to keep our accounts straight.

We do not ask for special category data, which means things like health, ethnicity, religion, political opinions, trade union membership, biometrics or sex life. We have no need for any of it. Please do not put it in an enquiry form.

Our website is aimed at businesses. We do not knowingly collect personal data from children. If you think a child has sent us their details, tell us at sales@expectbest.co.uk and we will remove them.

4. How we collect your data

• Directly from you: when you fill in the enquiry form, email us, call us, or engage us to do work.
• Automatically, as you use the site: through our own attribution tracker and through our host's server logs. Section 5 explains exactly what this involves.
• From other people: occasionally we are given your details by someone else, for example a client passing on a colleague's contact details. Section 16 covers this, because the law requires us to tell you more when data does not come from you.

5. Cookies and other storage on your device

This is the section most privacy policies fudge. We are not going to.

Our analytics tracker loads on every page and runs when the page opens. The cookies and browser storage listed below are written to your device at that point. We use them to count visits, to tell a returning reader from a new one, and to work out which pages and which marketing channels bring people to us. This storage is not needed to make the website work, and nothing on the site behaves differently if you stop it. Section 6 sets out how to stop it from your browser.

Cookies are not the only way information can be kept on your device, so the list below covers browser storage as well.

Set by us, from our own tracker at portal.expectbest.co.uk:

• eb_vid (cookie, 180 days): a first-party visitor id. A random identifier that lets us recognise the same browser coming back, so that a returning reader is not counted as a brand new person. This is the one that lasts longest, and it is the reason we cannot honestly describe this site as cookieless.
• eb_sid (cookie, 30 minutes from your last page view) and eb_ses (cookie, deleted when you close your browser): session identifiers, which group the pages you look at in one sitting into a single visit, so that reading four pages in ten minutes counts as one person having a look round rather than four separate arrivals.
• eb_consent (cookie, 2 years): the tracker reads this cookie to decide whether to run. It is not created when you arrive, and nothing on this website sets it. It exists only where it has been set deliberately, by you or by a consent tool in your browser. Section 6 explains what it does and how it can be set.

Browser storage set by our tracker:

• eb_vid (localStorage, until you clear your browser storage): a copy of the visitor id, kept so the id survives if the cookie is unavailable. Clearing your browser storage, or blocking storage for this site, removes it. See section 6.
• eb_ses (sessionStorage, deleted the moment you close the tab): marks the current visit, so that refreshing a page is not counted as a new visit.
• eb_q (localStorage, cleared as soon as it is sent, and in any event within 24 hours): a short queue of events waiting to be sent, so that a page view is not lost if your connection drops mid-request.

What that tracker collects is listed in section 3. It is our own first-party system, running on our own infrastructure. It is not Google Analytics. There is no Google Analytics, no Google Tag Manager, no Facebook pixel, no advertising pixel and no ad tag on this website. It does not follow you around other websites, because it has no way of doing so. It also does not run when our pages are embedded inside another site's iframe, and it tries to skip obvious bots and automated browsers.

Set by embedded content from other companies:

• YouTube (Google Ireland Limited), on pages with an embedded video. We use youtube-nocookie.com, YouTube's privacy-enhanced mode, and we do not load the embed at all until you click the play button. Until then you see a placeholder and Google is not contacted. Once you click to play a video, Google may set VISITOR_INFO1_LIVE (a cookie, 6 months, used to estimate bandwidth and remember playback preferences), VISITOR_PRIVACY_METADATA (a cookie, 6 months, storing your cookie choice with Google), and YSC (a session cookie, deleted when you close your browser, which counts video views). Google may also write to your browser's local storage. Google decides what these are and how long they last, not us, but it is our job to tell you, so we have checked them against Google's published cookie list. You can read Google's own description at policies.google.com/technologies/cookies.
• app.3dinteractivemaps.com, on the pages with an interactive map. We do not load the map until you click to load it. When you do, it sets: XSRF-TOKEN (a cookie, 2 hours, a security token that protects the map application's own forms) and laravel-session (a cookie, 2 hours, which keeps your session with the map application while you use it). Neither is used for advertising or tracking you across other websites.

If you would rather not load either of those, simply do not click them, or block third-party content in your browser. The rest of the page works without them.

6. How to stop our analytics

Our analytics runs when the page loads, so stopping it is something you do in your browser. Any of these works, and nothing on this website stops working when you use them.

• Block or delete cookies for expectbest.co.uk. Every mainstream browser can do this from its privacy settings. Deleting the eb_ cookies removes the visitor id, and blocking them stops it coming back. The same settings clear the eb_ browser storage keys.
• Browse in a private or incognito window. Anything stored is thrown away when you close it, so the visitor id never persists.
• Block the script. Our tracker is loaded from portal.expectbest.co.uk. If you block that domain, in your browser settings or in a content blocker, the tracker does not run and nothing is stored.
• Or just ask us. Email sales@expectbest.co.uk or call 01202 237027 and we will talk you through it for the browser you are using.

Our tracker also checks for the three things below before it runs, and honours any of them. There is no button on this website that sets them, so they are of use only if you, your browser, or a consent tool can set them yourself:

• a cookie named eb_consent with the value 0 on expectbest.co.uk;
• an eb:consent event emitted by your browser or a consent management platform, which our tracker listens for and honours;
• window.EB_CONSENT = false set before the script loads.

One honest limitation. A preference recorded in the eb_consent cookie is itself a cookie, so it applies to that browser on that device, and clearing your cookies clears it along with everything else. Blocking cookies for this site, or blocking portal.expectbest.co.uk, does not have that weakness.

Stopping our analytics does not affect an enquiry you have already sent us. To deal with that, see sections 13 and 17.

7. Why we use your data, and our lawful basis for each purpose

The law says we need a lawful basis for every purpose, and that we have to tell you which basis goes with which purpose. Here it is, purpose by purpose. Where we rely on legitimate interests we have named the actual interest, because "business purposes" tells you nothing.

• Replying to your enquiry. Basis: legitimate interests (UK GDPR Article 6(1)(f)). The interest: answering the question you actually asked us, and being able to get back to you by the method you chose. Where your enquiry is a request for a quote or for us to start work, we also rely on steps taken at your request before entering a contract (Article 6(1)(b)).
• Providing services to you as a client, including design, development, hosting, domains, SEO and marketing work. Basis: contract (Article 6(1)(b)).
• Measuring how our website and our marketing perform, which is the analytics and attribution described in section 5. Basis: legitimate interests (UK GDPR Article 6(1)(f)). The interest: understanding how people find and use our website, which pages are useful and which are not, and whether the advertising we pay for actually brings anyone to us, so that we can improve the website and stop wasting money advertising in places that do not work. We have weighed that against your privacy. The data is first-party and stays with us, it is never used to target you or anyone else, it is not sold, it is not shared with advertisers, it does not follow you off this website, and your IP address is hashed. You can stop it at any time from your browser under section 6, and you can object to it under section 17.
• Keeping the website and our systems secure, including spotting spam, abuse and bots. Basis: legitimate interests (Article 6(1)(f)). The interest: protecting the site, our business and the people who contact us from fraud, abuse and disruption.
• Keeping records of our dealings with you, including correspondence. Basis: legitimate interests (Article 6(1)(f)). The interest: knowing what was said and agreed, so we can pick up a conversation properly and deal with any question or dispute later.
• Invoicing, accounts and tax records. Basis: legal obligation (Article 6(1)(c)), mainly under tax and company law.
• Establishing, exercising or defending a legal claim. Basis: legitimate interests (Article 6(1)(f)). The interest: being able to defend ourselves, or pursue a debt, if it ever comes to that.
• Anything we ask your permission for, such as adding you to a mailing list. Basis: consent (Article 6(1)(a)).

Withdrawing consent. Where we rely on your consent, you can withdraw it at any time by emailing sales@expectbest.co.uk, and any marketing message we send will carry an unsubscribe link. Withdrawing your consent does not make what we did beforehand unlawful. It stops things from that point on.

Objecting to marketing. Separately from consent, you have an absolute right to tell us to stop sending you direct marketing, and we will stop. It does not matter what we relied on to send it and you do not need a reason. Email sales@expectbest.co.uk or use the unsubscribe link in any message.

We do not sell your personal data. We do not rent it, and we do not hand it to advertisers.

8. What you have to provide, and what happens if you do not

• The enquiry form. We require your message, and one way of getting back to you, an email address or a phone number, whichever you prefer. That is it. Your name is optional, and so is the second contact method. We do not make you hand over a phone number to ask us a question by email, because we would not need it to answer you, and asking for data we do not need is exactly the thing we are supposed to avoid. The form also records which page you were on. There is no law requiring you to give us any of this and no contract obliging you to. If you would rather not use the form at all, call us on 01202 237027 or email sales@expectbest.co.uk and give us only what you want to give. The only consequence of leaving out the two things we do ask for is that the form will not send, because we would have no way to reply.
• Becoming a client. Once we are working together, we need enough information to do the job and to invoice you. That is a contractual requirement. If you do not provide it, we may not be able to provide the service or complete the work.
• Analytics. Nothing is required of you at all. There is nothing to fill in, nothing to agree to, and every part of this website behaves exactly the same whether our analytics is running or not. Section 6 explains how to stop it.

9. Our free online tools

Our free tools need no account and no sign-up. What happens to what you type depends on which tool it is, so here is the split.

Tools that run entirely inside your browser. The case converter, the CSS gradient generator, the line break remover and text cleaner, and the image background remover. Whatever you paste or upload is processed on your own device and never leaves it. Your image is not uploaded anywhere. We never see this content, and we do not store it.

Tools that have to look something up elsewhere. The website security check, the SEO audit, the domain lookup and the DMARC checker. These cannot answer without asking a service that holds the answer, and your browser contacts that service directly. That means the URL or domain you submitted, and your IP address, are visible to that service, wherever it is based. It is a connection between your browser and them, and it is not routed through us.

• The domain lookup and the DMARC checker query public DNS services for DNS records, and the domain lookup also queries a public domain-registration lookup service.
• The website security check and the SEO audit fetch the page you asked about through a public proxy service, so the URL you enter is sent to that service.

We do not keep a record of what you submit to any of these tools. Our analytics records that you visited the tool page, as described in section 5, not what you typed into it. If a submitted URL or domain is sensitive, please bear the paragraph above in mind before you submit it.

10. Who we share your data with

We share personal data only where there is a reason to. The recipients, and the categories of recipient, are these.

• SiteGround, our web host. They host expectbest.co.uk and therefore process anything that passes through the site, including server access logs.
• Our email delivery provider, which sends the notification email when you submit an enquiry. Your enquiry is in that email.
• Our own attribution system at portal.expectbest.co.uk. This is ours, running on our own infrastructure. No third-party analytics company is involved, because there is no third-party analytics on this site.
• YouTube (Google), where a page has an embedded video, via youtube-nocookie.com.
• app.3dinteractivemaps.com, where a page has an embedded interactive map.
• The public lookup services behind our free tools, as set out in section 9, and only when you use the relevant tool. Your browser contacts them directly.
• Our accountants and professional advisers, where they need it to do their job for us.
• Law enforcement, regulators or a court, where we are legally required to disclose, or where we need to establish or defend a legal claim.

Where these are our processors, they act on our instructions and are bound by a contract that limits what they may do with the data. If we ever bring in a subcontractor to help with your project, we will make sure they are held to the same standard.

Worth repeating plainly: there are no advertising networks involved in this website, and no ad personalisation. No ad network, no ad tag and no advertising pixel is loaded on any page, and we do not share your data with advertisers.

11. Sending data outside the UK

Some of the providers listed in section 10 may store or process personal data outside the United Kingdom.

Here is who, where, and on what basis:

• SiteGround (our web host): our website and our email are hosted in a London data centre in the United Kingdom. No international transfer arises, because your data stays in the UK.
• Our email notifications: enquiry notifications are sent through our own mail server, hosted in the same London data centre in the United Kingdom. No international transfer arises.
• Google (YouTube embeds, and Google Public DNS when you use the domain or DMARC tools): United States. We rely on the UK adequacy regulations for the United States, the UK to US data bridge, where Google is certified under it, and on the UK Addendum to the European Commission's standard contractual clauses where it is not.
• app.3dinteractivemaps.com: hosted in a London data centre in the United Kingdom. No international transfer arises.

Two different legal routes are in play there, and they are worth telling apart. UK adequacy regulations (sometimes called a data bridge) are made under Article 45 of the UK GDPR: the UK government has decided the destination country protects your data adequately, so no extra safeguard is needed. Where no adequacy regulations cover a provider, we use an Article 46 safeguard instead, either the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the European Commission's standard contractual clauses, and we carry out a transfer risk assessment before we do.

If you want to know which mechanism applies to a particular provider, or you want a copy of the safeguards, email sales@expectbest.co.uk and we will send it to you. You do not need to give a reason.

One thing to be clear about. When you use the free tools described in section 9, your browser contacts those lookup services directly, so what you submit and your IP address go to them wherever they happen to be. We are not in the middle of that connection, so it is not a transfer we make on your behalf and it is not covered by safeguards we hold.

12. How long we keep your data

• Enquiries: we delete the working copy 24 months after your last contact with us. If you become a client, your details move into the client record instead. One qualification, because the number above is not the whole story: our enquiry store keeps a version history, so a copy of your enquiry stays in that history, and in our backups, after the working copy is gone. Nothing removes that copy on a timer. It stays until we take it out by hand, and section 13 explains exactly what we will do if you ask us to.
• Client records, invoices, and anything needed for accounts and tax: at least 6 years from the end of the financial year they relate to, because tax law requires it.
• Analytics identifiers on your device: the eb_vid visitor id lasts 180 days from your last visit. After that your browser deletes it and you appear to us as a new visitor. Session identifiers last only for the visit.
• Analytics records on our own systems: the page views, page titles, referrers, marketing parameters (utm and gclid), engagement events, conversions and hashed IP addresses described in section 3 are held at portal.expectbest.co.uk. We do not currently delete these on a timer, so we keep them until we remove them, and we will remove them if you ask us under section 17. If you stop the tracker under section 6, we stop collecting from that browser straight away. We also keep aggregate totals, things like "this page had 400 views in June", indefinitely, because once aggregated they are no longer personal data and cannot be traced back to you.
• Server access logs: kept by our host, SiteGround, for 30 days for security and troubleshooting, then rotated and permanently overwritten. These are the standard logs every web server keeps, and they are the one place your unhashed IP address appears. We do not extract anything from them into our own systems, and we do not use them for analytics.
• Email correspondence: kept while we need a record of our dealings with you, and reviewed against the periods above.

Where we cannot give you a fixed period, the criteria we use are: how long we need the data to do the thing you asked us to do, how long the law requires us to keep it (mainly tax and accounting), and how long we might reasonably need it to defend a legal claim.

13. An honest word about deleting enquiries

We would rather tell you how this actually works than make a promise we cannot keep.

When you send an enquiry, it is emailed to our team and stored in our own private, version-controlled system, which our team reads through the site's admin area. Version-controlled means it keeps a history of every change made to it. That is good for reliability and for keeping an audit trail, and it has one consequence you should know about: when we remove an enquiry, the visible record goes, but a copy remains in that history. The same is true of routine backups, and of any notification email already sitting in a colleague's inbox.

We cannot pick a single entry out of that history without rebuilding the whole store, so we are not going to tell you that erasure is instant and total when it is not. What we will actually do if you ask us to delete your enquiry: remove it from the admin area and from active use straight away, stop processing it, and keep access restricted to the few people who administer the system. There is no scheduled purge that clears the history for us, so if you want the copy in the history gone as well, we will rebuild the store by hand to remove it. That is work, but it is work we will do, and we will confirm when it is done. You only have to ask.

If you need something gone sooner or more thoroughly than that, email sales@expectbest.co.uk and tell us. We will tell you honestly what we can and cannot do, and we will do what we can.

14. How we keep your data secure

We take measures that are proportionate to a business of our size and to the fairly limited data we hold.

• The website is served over HTTPS, so traffic between your browser and the site is encrypted in transit.
• Our tracker never transmits your raw IP address, and our server hashes it rather than storing it as it is.
• The enquiry store is private, and the admin area sits behind authentication.
• Access is limited to the people who need it to do their job.
• We keep our systems and dependencies updated, and our hosting provider maintains its own infrastructure security.

No website and no system is completely secure, and anyone who tells you otherwise is selling something. If a breach ever occurs that is likely to result in a risk to your rights and freedoms, we will report it to the Information Commissioner's Office within 72 hours where required, and we will tell you if the risk to you is high.

15. Automated decision-making and profiling

We do not make decisions about you by automated means alone that produce legal effects or similarly significantly affect you. Nothing on this website decides anything about you. There is no automated scoring, no automated rejection, and no automated pricing based on who you appear to be.

To be precise rather than merely reassuring: our analytics does link your visits together over time using the eb_vid cookie, and grouping a person's visits is a limited form of profiling in the legal sense. It is used only to count and attribute visits to our own website, as described in section 7. It does not follow you across other websites, it does not build a picture of you from outside sources, and no decision about you comes out of it. It falls well short of the automated decision-making described in Article 22 of the UK GDPR, and you can stop it under section 6.

16. Where we get data from someone other than you

Nearly everything we hold came from you directly. Sometimes it does not, and the law requires us to tell you more when that happens.

The usual situations: a client gives us a colleague's name and work contact details so we can arrange access or agree content; somebody refers you to us and passes on your contact details; or we use business contact details from a publicly accessible source, such as a company's own website or a public register. The categories involved are usually your name, your job role, and your business email address and phone number. We will tell you where we got it. When we first contact you we will name the source, the person, the organisation, or the register, and if it came from a publicly accessible source we will tell you which one. You can also ask us at any time by emailing sales@expectbest.co.uk, and you do not need to give a reason for asking.

When we obtain your data this way, we will give you this information within one month of getting it, or when we first contact you, or when we first pass it to anyone else, whichever comes first, unless you already have the information. Our lawful basis is normally legitimate interests, and the interest is delivering the project we have been engaged to deliver or responding to a referral about our services. If you would rather we did not hold it, tell us at sales@expectbest.co.uk and we will deal with it.

17. Your rights

Under UK data protection law you have the following rights. They are free to use, and using them is not a nuisance to us.

• The right to be informed. To be told what we do with your data. That is what this document is for.
• The right of access. Ask for a copy of the personal data we hold about you, and we will send it to you.
• The right to rectification. Ask us to correct anything that is wrong or to complete anything that is missing.
• The right to erasure. Ask us to delete your data. Please read section 13 first, which explains honestly what we can achieve. We may also need to keep some data where the law requires it, for example accounting records, and we will tell you if that applies.
• The right to restrict processing. Ask us to pause using your data, for example while we sort out a dispute about whether it is accurate.
• The right to object. Object to any processing we base on legitimate interests, which includes our website analytics. We will stop unless we have compelling grounds that override your interests, and we will explain our reasoning either way.
• The right to object to direct marketing. Tell us to stop sending you marketing and we must stop. This one is absolute. There is no balancing test, we have no grounds to refuse, you do not have to give a reason, and we will not ask you for one. Email sales@expectbest.co.uk, reply to any marketing message, or click the unsubscribe link it carries.
• The right to data portability. Ask for the data you gave us in a common, machine-readable format, or ask us to send it to someone else. This applies where our basis is consent or contract and the processing is automated.
• The right to withdraw consent at any time, where consent is the basis we rely on, such as a mailing list you asked to join. Email sales@expectbest.co.uk or use the unsubscribe link in any message. Withdrawing does not affect the lawfulness of anything we did before you withdrew.
• Rights related to automated decision-making. See section 15. We do not do it.

To use any of these, email sales@expectbest.co.uk or call 01202 237027. We may ask you to confirm your identity first, so that we do not hand your data to somebody pretending to be you. We will respond within one month. If your request is genuinely complex, or you have made several, we can extend that by up to two further months, and we will tell you inside the first month if we need to and why.

18. How to complain

There are two routes, and you can use either or both.

Step one: complain to us. Under section 164A of the Data Protection Act 2018 you have the right to complain to us directly about how we have handled your personal data, and we are required to make that straightforward rather than to make you work for it. Use the contact form with "Data protection complaint" as the first line of your message, or if you would rather not use a form, email sales@expectbest.co.uk with "Data protection complaint" in the subject line, call 01202 237027, or write to us at the address in section 1. Any of those counts, and we will treat it the same way. Tell us what happened and what you would like us to do. We will acknowledge your complaint within 30 days of receiving it and tell you what happens next, then investigate and respond to you without undue delay, and tell you the outcome. If we get something wrong, we would rather hear it from you and fix it.

Step two: complain to the regulator. Under section 165 of the Data Protection Act 2018 you can complain to the Information Commissioner's Office. You do not have to come to us first, and you can go to the ICO whether or not you are happy with our answer.

• Website: ico.org.uk
• Helpline: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

19. Changes to this policy, and contacting us

This policy was last updated on 15 July 2026 and it replaces every earlier version. Where we make a significant change we will update the date shown on this page.

If we ever want to use your personal data for a new purpose that is not compatible with the one we collected it for, we will tell you before we start and explain the lawful basis we are relying on.

Questions, requests, complaints, or a copy of our transfer safeguards: email sales@expectbest.co.uk, call 01202 237027, or write to Expect Best Ltd, A34 Arena Business Park, Holyrood Close, Poole, Dorset, BH17 7FJ. This policy and any dispute arising from it are governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.