Privacy Policy
Effective date: Friday 6 November 2026
1. Introduction
This Privacy Policy explains how Hwyl Housing CiC, trading as Hwyl (“Hwyl”, “we”, “us” or “our”), collects, uses, discloses and retains personal data in connection with hwylcic.com (the “Website”) and enquiries submitted to us.
We process personal data in accordance with applicable UK data protection legislation, including the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018, as amended.
2. Data Controller
For the purposes of applicable data protection legislation, the data controller is:
Registered company name:[full registered company name]
Company registration number:[number]
Registered office:[address]
Data protection contact:[email address]
3. Personal Data We Collect
We may collect and process the following categories of personal data:
a. Identity and contact data: your name, email address, telephone number and organisation, where provided.
b. Enquiry and correspondence data: information submitted through our contact form or other communications, together with records of our responses.
c. Technical data: IP address, browser information, submission timestamps, referring page information and related technical records processed in connection with the operation and security of the Website and contact form.
Personal data is collected directly from you when you communicate with us and, where applicable, automatically through the systems used to operate and protect the Website.
You should not submit health information or other sensitive personal data through the general contact form unless we have specifically requested it and provided appropriate privacy information.
4. Purposes and Lawful Bases for Processing
We process personal data for the following purposes and on the following lawful bases:
| Purpose | Lawful basis |
|---|---|
| Receiving, reviewing and responding to enquiries | Our legitimate interests in communicating with individuals who contact us and administering our activities |
| Taking steps at your request before entering into a contract, or performing a contract with you | Necessity for pre-contractual steps or performance of a contract, where applicable |
| Maintaining appropriate correspondence and administrative records | Our legitimate interests in maintaining records and managing our organisation |
| Operating and protecting the Website, preventing spam and detecting misuse | Our legitimate interests in maintaining the security and availability of our services |
| Complying with applicable statutory or regulatory requirements | Compliance with a legal obligation |
| Activities for which we specifically request consent | Your consent |
Where we rely on legitimate interests, we assess those interests against your interests, rights and freedoms.
Where processing is based on consent, you may withdraw your consent at any time by contacting us. Withdrawal does not affect the lawfulness of processing undertaken before consent was withdrawn.
5. Contact Form Processing: Web3Forms
We use Web3Forms, operated by Web3Creative, to process submissions made through the Website’s contact form.
When you submit an enquiry, the information entered into the form, together with associated technical data, is transmitted to Web3Forms for processing and delivery to us by email. Web3Creative acts as a data processor on our behalf in providing this service.
Web3Forms uses infrastructure and other service providers to support hosting, storage, email delivery, security and spam prevention. Its published privacy policy states that form submitters’ IP addresses and email addresses may be disclosed to CleanTalk and Akismet for spam prevention.
Web3Forms’ published privacy policy provides for retention of form submission data for a maximum of three years, unless a shorter period applies to the relevant plan or the data is deleted earlier. Correspondence received in our email systems is subject to the retention arrangements described in section 8.
Further information is available in the Web3Forms Privacy Policy and Web3Forms Data Processing Agreement.
6. Disclosure of Personal Data
We may disclose personal data to:
a. Authorised personnel who require access to administer or respond to your enquiry.
b. Web3Creative and its relevant sub-processors, for the purposes described in section 5.
c. [Website hosting provider], which provides Website hosting and associated services.
d. [Email service provider], which provides email delivery, storage and communications services.
e. [Other relevant recipients or categories of recipients, together with their purposes; delete if not applicable.]
f. Professional advisers, regulators, courts, law enforcement bodies or other persons where disclosure is required by law or is necessary to establish, exercise or defend legal claims.
Where a service provider acts as our processor, applicable data protection law requires processing to be governed by appropriate contractual terms.
7. International Transfers
Personal data processed through Web3Forms may be transferred to, accessed from or otherwise processed in countries outside the United Kingdom. Web3Creative operates from India and uses infrastructure providers in multiple jurisdictions.
Web3Forms’ Data Processing Agreement provides for the use of Standard Contractual Clauses, together with the UK International Data Transfer Addendum where applicable, for transfers requiring such safeguards.
[Specify any additional international transfers involving the Website host, email provider or other recipients, including the applicable UK adequacy regulations or appropriate safeguards.]
Further information about the safeguards applicable to your personal data, including how to obtain a copy where available, may be requested using the contact details in section 2.
8. Retention
We retain personal data only for as long as necessary for the purposes for which it was collected, taking into account applicable legal requirements and the need to establish, exercise or defend legal claims.
The following retention periods apply:
General enquiries and related correspondence:[period] after the enquiry is concluded.
Records relating to an ongoing contractual or organisational relationship:[period or specific retention criteria].
Website security and technical logs under our control:[period or specific retention criteria].
Where information must be retained for longer to comply with a legal obligation or address a dispute, retention will be limited to what is necessary for that purpose.
Web3Forms’ retention arrangements are described separately in section 5.
9. Cookies and Similar Technologies
[Insert a verified description of the cookies and similar technologies used on the Website, including their purposes, providers, durations and available controls, or link to a separate Cookie Policy containing this information. Include any analytics, embedded content or CAPTCHA services.]
Where consent is required by applicable law, relevant cookies or similar technologies will be used only after that consent has been obtained. Any consent mechanism must also provide a means of withdrawing consent.
10. Security
We implement appropriate technical and organisational measures designed to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction or damage.
Access to personal data is restricted to authorised persons who require it for the purposes described in this Privacy Policy.
11. Your Rights
Subject to the conditions and exemptions provided by applicable law, you may have the right to:
a. Obtain confirmation of whether we process your personal data and request access to it.
b. Request correction of inaccurate personal data and completion of incomplete personal data.
c. Request erasure of your personal data.
d. Request restriction of processing.
e. Object to processing based on legitimate interests, on grounds relating to your particular situation.
f. Receive certain personal data in a structured, commonly used and machine-readable format and request its transmission to another controller, where the right to data portability applies.
g. Withdraw consent where processing is based on consent.
Requests should be submitted to [data protection contact email]. We may request information reasonably necessary to verify your identity.
We will respond within the period required by applicable law, normally one month, subject to any permitted extension or other applicable timing provisions.
12. Provision of Personal Data
Submission of an enquiry is voluntary. However, failure to provide sufficient information about your enquiry or a valid means of contacting you may prevent us from responding or taking the action you request.
13. Complaints
If you have concerns about our processing of your personal data, you may contact us using the details in section 2.
You also have the right to lodge a complaint with the Information Commissioner’s Office, the UK supervisory authority for data protection:
You are not required to contact us before exercising that right.
14. Amendments
We may amend this Privacy Policy to reflect changes in our processing activities or applicable legal requirements. The current version will be published on the Website and identified by its effective date.