This Privacy Policy covers information Toolbelt uses for its own business purposes. Toolbelt also processes certain personal information on behalf of website customers; that processor relationship is governed by our Data Processing Agreement.
Last updated: 24 August 2026
1. Who we are
Toolbelt Websites is a trading name of Rikki Webster Ltd, registered in England and Wales under company number 13001015. Registered office: Greenacre House, The Street, Hinderclay, Diss, England, IP22 1HX. For questions about this Privacy Policy or Toolbelt's own use of personal information, contact support@toolbeltwebsites.co.uk.
For personal information collected directly by Toolbelt for Toolbelt's own business purposes, Rikki Webster Ltd is the Data Controller.
2. Our two roles under data protection law
When Toolbelt acts as Controller: we decide why and how personal information is used for our own business, for example when someone contacts Toolbelt directly, becomes a Toolbelt customer, receives support, or when we keep account, billing, security and business administration records.
When Toolbelt acts as Processor: a Toolbelt customer decides why personal information is collected through its own website and instructs Toolbelt to process that information as part of the website service. This can include website contact forms and enquiry delivery. In that situation the customer is the Data Controller and Toolbelt processes the information on the customer's behalf under the Data Processing Agreement.
3. Personal information we collect for Toolbelt
When you contact Toolbelt directly, request a website or become a customer, we may collect your name, business name, email address, telephone number, trade or profession, existing website address, plan or service information and the information you include in your message.
If you become a customer, we may also hold project communications, billing and payment records, account or service information, website content and files you provide, agreement acceptance records and records needed to deliver and support the service.
Our infrastructure may automatically record limited technical information such as IP address, browser or device information, requested pages, timestamps and server or security logs where reasonably necessary to operate and protect the service.
4. Why we use information when Toolbelt is Controller
We use personal information to respond to enquiries, prepare proposals, enter into and perform contracts, provide and support services, manage customer relationships, process and record payments, protect our websites and systems, prevent abuse, meet legal obligations and improve our services.
Depending on the circumstances, our lawful bases may include taking steps at your request before entering a contract, performing a contract, complying with a legal obligation, and our legitimate interests in running and protecting the business and responding to genuine enquiries. We use consent where consent is specifically required. Optional direct marketing can be opted out of at any time.
5. Personal information we process on behalf of customers
When Toolbelt provides or manages a customer website, we may process personal information on the customer's behalf in connection with website hosting and operation, website contact forms, enquiry transmission, technical support, service troubleshooting, security and abuse prevention.
For website enquiries, information can include a visitor's name, email address, telephone number, message, service or request details and limited technical or security information. The customer determines what its website asks for and is responsible for its lawful basis and privacy information.
The Toolbelt Notifications service is designed primarily to transmit website enquiries to the customer's nominated recipient rather than to operate as a permanent enquiry CRM. Contact form information may pass through Toolbelt's notification infrastructure and Resend in order to deliver the message to the customer.
If your personal information was submitted through a Toolbelt customer's website and you wish to exercise a data protection right about that enquiry, you should normally contact that business as the Data Controller. Toolbelt will provide reasonable assistance to the customer where required by applicable law and our Data Processing Agreement.
6. Who we share information with
We use service providers where reasonably necessary to operate Toolbelt and provide services. Where they process personal information on our instructions, appropriate contractual arrangements are used.
For customer website processing, current relevant subprocessors include Hostinger infrastructure used by Toolbelt where applicable, and Resend (Plus Five Five, Inc.) for transactional email and website enquiry notification delivery. Further details are set out in our Data Processing Agreement.
We do not sell personal information to advertisers or data brokers.
7. International data transfers
Some service providers and their approved subprocessors may process personal information outside the United Kingdom. Where a transfer is subject to UK international transfer rules, we use or require an appropriate lawful mechanism, which may include an adequacy regulation, the UK International Data Transfer Agreement, the UK Addendum to approved Standard Contractual Clauses, or another safeguard permitted by applicable law.
We do not promise that every service provider will always use infrastructure in a particular country. Our Data Processing Agreement explains the position for customer data and how relevant subprocessor safeguards are addressed.
8. How long we keep information
Toolbelt's own business records: we retain personal information only for as long as reasonably necessary for the purpose it was collected. Direct enquiries that do not become customers are normally reviewed for deletion within 24 months of the last meaningful contact. Customer and project records may be retained for the duration of the relationship and afterwards where reasonably necessary for support, legal, accounting, tax, security or dispute purposes.
Customer website enquiries processed on behalf of customers: Toolbelt does not use the Toolbelt Notifications Gateway as a permanent customer enquiry database. Enquiry content is retained only for as long as reasonably necessary to provide the service, for delivery, security, abuse prevention, troubleshooting or legitimate operational requirements, where retention is required by law, or where reasonably necessary to establish, exercise or defend legal claims. We do not promise an arbitrary fixed deletion period unless a particular service configuration expressly provides one.
Once an enquiry has been delivered into the customer's nominated email account, the customer controls that copy and is responsible for its own retention as Data Controller.
9. Cookies and similar technologies
We use a consent-management tool on this website to remember your privacy choices. Necessary storage used to remember those choices is enabled because it is required for the consent system to work.
Analytics, advertising, embedded media or other non-essential storage and access technologies must remain disabled unless you choose to allow the relevant category. You can change or withdraw your choice using the link in the website footer. For more detail, read our Cookie Policy.
10. Your data protection rights
Depending on the circumstances, UK data protection law may give you rights to ask for access to personal information, correction, deletion, restriction, objection, portability and withdrawal of consent where processing is based on consent. These rights are not absolute in every situation.
For Toolbelt's own controller processing, contact support@toolbeltwebsites.co.uk. For information submitted to one of our customers through that customer's website, contact the relevant customer first because that customer normally controls the information.
11. Security
We use reasonable technical and organisational measures appropriate to the services and risks involved. These include access controls and protected credentials, and for the central customer enquiry notification service, measures such as CSRF and automated-spam controls, submission timing checks, rate limiting, individual site authentication, centrally locked recipients, protected email-delivery credentials and authenticated email sending. No internet or email system can guarantee absolute security.
12. Questions or complaints
Please contact us first at support@toolbeltwebsites.co.uk if you have a concern about Toolbelt's own handling of your personal information. You also have the right to complain to the UK Information Commissioner's Office where it has jurisdiction. If your concern relates to a Toolbelt customer's use of your information, you should normally raise it with that customer as Data Controller first.
13. Changes to this policy
We may update this Privacy Policy when our services, technology, suppliers or legal obligations change. The latest version will be published on this page with an updated revision date.