Skip to content
Oakmont Digital UK

Privacy Policy

This policy explains what personal information Oakmont Digital UK collects through oakmontdigital.co.uk, why, where it goes and how long we keep it. We have kept it short and plain.

Last updated: 18 October 2026.

1. Who We Are

We are Oakmont Digital UK, based in Chelmsford, Essex, UK. We decide how the personal information described here is used (in data protection terms, we are the “controller”). For any privacy question, email [email protected].

2. What We Collect

  • The enquiry form: your name and email address, and, if you choose to give them, your phone number and a message. You also choose the service you are interested in.
  • Technical details sent with an enquiry: the page you sent it from, how you arrived (for example a campaign tag or referring website), your country, your browser type, and a hashed (scrambled, not readable) version of your IP address that we use only to block repeated abuse.
  • Website statistics: which pages are viewed, what is clicked (for example a pricing tab, a question in the FAQ, or a WhatsApp, phone or email link), whether the enquiry form was started, sent or failed, your device and browser, and your approximate location (town or region, worked out from your IP address). We never send the details you type into the enquiry form to our analytics tools. See section 7.
  • Email, WhatsApp and phone: if you contact us that way, we see the details you give us, such as your name, number and message.
  • If you become a client: the business details, logo, text and photos you give us to build your website, and a record of your payments. Stripe processes your card details, and we do not see or store full card numbers.

3. Why We Use It

  • To answer you and prepare your order: we use your details to reply to your enquiry and to set up a website for you if you go ahead. Our lawful basis is taking steps at your request before a contract, and then performing that contract.
  • To keep the form safe: the hashed IP address and the spam check let us block repeated abuse. Our lawful basis is our legitimate interest in keeping our site and inbox free of spam.
  • To understand and improve this website: we count visits and look at how the site is used so we can see what helps people reach us and fix what does not. Our lawful basis is our legitimate interest in running and improving our website, and the UK rule that allows statistics cookies without consent (section 7).
  • To meet legal duties: if you become a client, we keep records the law requires, such as accounts.
  • Marketing: we do not add enquiry-form contacts to a marketing list. If we ever want to send you marketing, we will ask you first.

4. Enquiries Sent Through This Website

When you send the enquiry form:

  • Storage: your enquiry is stored in a database hosted by Cloudflare (Cloudflare D1) before anything else happens, so it is never lost.
  • Spam check: the form is protected by Cloudflare Turnstile, which checks that you are a person and not a bot. Turnstile reads technical signals from your browser to do this.
  • Notification: the details you entered are then sent to us by email and through a secure messaging app on our phones, so we can reply quickly.
  • WhatsApp: if you choose “Send via WhatsApp”, your enquiry is saved first and WhatsApp then opens with a message ready to send. Anything you send in WhatsApp is handled under WhatsApp’s own privacy policy.

5. Who Else Handles Your Data

  • Cloudflare: hosts this website, delivers it quickly, protects it from attacks, stores enquiries (D1), runs the Turnstile spam check and sends our enquiry emails.
  • Our messaging app: a secure messaging app delivers the new-enquiry alert to our phones.
  • Google (Google Analytics 4) and Microsoft (Clarity): our two website analytics tools, described in section 7.
  • WhatsApp (Meta): only if you choose to message us there.
  • Stripe: only if you become a client. Stripe takes your payment and processes your card details. We do not see or store full card numbers.

Cloudflare, Google, Microsoft, our messaging app provider and Stripe are international companies and may process data outside the UK. We only use providers that offer safeguards recognised under UK data protection law. We do not sell, rent or trade your personal information. The website itself does not take payments, and the form does not ask for any payment details.

6. How Long We Keep It

We keep stored enquiries, including the hashed IP address saved with each one, for up to 24 months after our last contact with you, then delete them. The notification copies of the enquiry that were sent to us (in our email and our messaging app) are deleted on the same schedule. If you become a client, we keep what we need for the contract and our legal obligations for as long as the law requires. Payments are taken by Stripe, so card details are held by Stripe and not by us. Website statistics are kept for the periods in section 7.

7. Analytics and Cookies

We use two tools to understand how this website is used and to improve it. They are for statistics about this website only. We do not use them for advertising and we do not build advertising profiles. Microsoft's own cookies are explained below.

  • Google Analytics 4 (Google): collects the pages you view, what you click and the actions listed in section 2, your device and browser, and your approximate location. Google states that Google Analytics 4 does not log or store IP addresses. It sets two cookies, _ga and _ga_ followed by an ID, which last up to two years and hold a random ID so we can tell visits apart.
  • Microsoft Clarity (Microsoft): records anonymised session replays and heatmaps of how pages are used: how the page was displayed, mouse movements, clicks and scrolling. Everything you type into a form field is masked and is not recorded, and the enquiry form is marked as masked as well. Clarity runs on this site in its cookieless mode: we do not allow it to set its own cookies on our site, so each page you view is treated as a separate visit. Microsoft’s servers may still set cookies on Microsoft’s own domains (clarity.ms and bing.com) when the Clarity tag loads, for example a cookie called CLID on clarity.ms (lasting up to a year), which Microsoft uses to recognise a browser it has seen before on any website that uses Clarity. Its script can also set MUID on clarity.ms and bing.com, which Microsoft says it also uses for its own purposes, including advertising. We don't use Clarity for advertising.

Why, and our lawful basis. We use them to see which pages and buttons help people reach us, and to fix problems. Storing or reading information on your device for statistics like this is allowed in the UK without asking for consent first (the analytics exemption in Schedule A1 of the Privacy and Electronic Communications Regulations, in force since 5 February 2026), as long as we tell you, as this policy and the notice on the site do, and give you a simple way to opt out. For the personal data involved, our lawful basis under UK GDPR is our legitimate interest in understanding and improving our website. We have weighed this against your privacy: we collect no more than is needed, we mask what you type, and you can opt out at any time.

How long we keep it. Google Analytics 4 data is kept for 14 months (event-level data), after which it is deleted; aggregated reports may be kept longer. Clarity session recordings are kept for 30 days (a small random sample, and any recording we mark as a favourite, for up to 9 months) and heatmaps for up to 9 months, as set by Microsoft.

Where it goes. Google and Microsoft are US companies and may process this data in the US and elsewhere outside the UK. They rely on safeguards recognised under UK data protection law, such as the UK-US data bridge or standard contractual clauses.

How to opt out. Choose “Opt out” in the short notice shown on your first visit, or use the “Analytics settings” link at the bottom of every page to open that notice again. We save your choice in your browser and honour it on every later visit: both tools then stay off and any Google Analytics cookies are removed. You can also block analytics with your browser settings or an extension.

Other storage. While you browse, a short note of how you arrived (for example a campaign tag) is kept in your browser’s session storage so that an enquiry can be traced to its source. It is removed when you close the tab. The Turnstile spam check and Cloudflare may use strictly necessary security cookies or similar technology to keep the site and its form safe from abuse. You can block cookies in your browser settings, though the form may then not work.

8. Security

Our website is SSL secured and protected by Cloudflare, so what you send travels encrypted.

9. Your Rights

Under UK GDPR and the Data Protection Act 2018 you can ask us for a copy of your data, ask us to correct or delete it, object to how we use it, ask us to restrict it, ask for it in a portable format, and withdraw consent at any time where we rely on it. Email [email protected] and we will reply within one month.

If you are unhappy with our answer, you can complain to the Information Commissioner’s Office.

10. Changes to This Policy

We update this page when the way we handle data changes. The “Last updated” date at the top shows the latest version.

11. Contact Us

Oakmont Digital UK
Chelmsford, Essex, UK
Email: [email protected]