This page sets out what personal data Ginger Creative handles on behalf of the businesses whose websites it builds and hosts, where that data is held, who else is involved, and for how long it is kept.
It serves as our record of processing under Article 30 of the UK GDPR, and as the list of sub-processors referred to in our client contracts.
For the websites we build and host, the client is the data controller — it is their customers' data, and they decide what happens to it. Ginger Creative is a data processor, acting on their instructions.
Ginger Creative is a sole trader based in Edinburgh, United Kingdom. Contact: scott@gingercreative.co.uk.
Where a client's website has an enquiry form, a visitor may submit their name, email address, telephone number and whatever they write in the message — which on a restaurant site typically means a date, a number of guests and the occasion.
This data is not stored. A submission is received, sent on to the email address the client has set, and discarded. There is no archive, no database and no copy kept on our systems. The client's own mailbox is the only record.
This means that if a member of the public asks us what we hold about them, the answer is nothing, and we will direct them to the business they contacted.
Our web servers record each request in the ordinary way, including the visitor's IP address, which is personal data under the UK GDPR. These logs exist to keep the sites running and secure. They are not analysed, not linked to anything else, and not shared.
Where a client edits their own site, we hold the login for that — a password stored only as a one-way hash, never in readable form — and a short record of failed login attempts, including IP address, to stop repeated guessing.
All primary hosting is in the United Kingdom. Backups are held in the United Kingdom. There are no international transfers.
| Who | What they do | Where |
|---|---|---|
| IONOS | Web and mail servers | London, UK |
| Cloudflare | DNS, and traffic protection on some sites | Global network |
| GitHub | Website source code. Holds no customer data. | USA |
| Ginger Creative | Nightly encrypted-in-transit backups of site content | Edinburgh, UK |
Clients using Google Workspace, Microsoft 365 or a similar service for their own email have their own arrangement with that provider. Once an enquiry reaches their mailbox it is in their hands, not ours.
| Enquiry form submissions | Not kept. Passed on and discarded. |
| Web server logs | Short-lived, then rotated away |
| Failed login records | Cleared once the lockout expires |
| Site content backups | Rolling, most recent copies only |
| Everything for a client | Deleted on request when a contract ends |
If we become aware of a personal data breach affecting a client's site, we will tell that client without undue delay and give them what they need to decide whether it must be reported to the Information Commissioner's Office. As processor, that decision is theirs to make, not ours.
Requests from members of the public should go to the business they contacted, as the data controller. Where we are asked to help a client answer one, we will.