This policy applies from 29 October 2026.
1. Who we are
Roslin Design is the trading name of Romano Alexander Media Limited, a company registered in Scotland (company number SC371796), 5 South Muirton Cottages, Perth PH1 5BB. We are the controller of the personal data described in this policy.
If you have any questions about this policy or your data, contact us at info@roslindesign.com or on 0131 208 1023.
2. The data we hold about you
When you become a client, or ask us for a quote, we may hold:
- contact details: your name, organisation, address, email address and phone number;
- billing details: invoices, payments, and your direct debit or card payment records. Card numbers are held by Stripe, not by us; bank details for direct debits are held by GoCardless;
- account details: your client area login and the services you have with us;
- domain registration details: the contact details registries require for each domain registered in your name;
- Microsoft 365 details: the account holder and user details needed to set up and manage your licences;
- correspondence: emails, support requests, call notes, and records of the work we have done for you;
- project information: what you tell us about your business and website so we can design, build or host it.
3. Why we use it, and our legal basis
| What we use it for | Legal basis under UK GDPR |
|---|---|
| Providing the services you’ve asked for, including quotes, design work, hosting, domains and Microsoft 365 | Contract: we need it to provide our services to you |
| Billing, taking payments and keeping accounts | Contract, and legal obligation (accounting and tax law) |
| Registering and renewing domain names | Contract: registries require these details |
| Contacting you about your services, for example technical issues, security, renewals, price changes or changes to our terms | Contract, and our legitimate interests in running our services well |
| Telling you about important issues with your website, for example compatibility with new browsers, or practices that could harm your site | Contract: it’s part of the services we provide to you. Where you don’t have a plan with us, our legitimate interests in helping you keep your site working and secure |
| Showing examples of our work, such as website designs, in our portfolio and on social media | Legitimate interests: promoting our business. We don’t normally include personal information, and you can ask us not to feature your site |
| Dealing with complaints, disputes and legal claims | Contract, for complaints about our services, which our terms commit us to handle. Legitimate interests, for disputes and legal claims, including after you stop being a client |
We use your preferred contact method where we can. Tell us if you have one.
Emails about your services. We email you about the services you have with us, for example renewals, technical issues, and changes to our prices or terms. These emails sometimes include options relating to your existing services, such as switching to annual billing. Occasionally they may mention other services we think would be useful to you. If you’d rather we didn’t, tell us and we’ll leave them out. You’ll still receive the emails you need about your services.
4. Who we share it with
We only share your data where we need to in order to provide our services, where you have asked us to, or where the law requires it. The companies we use are:
| Company | What for |
|---|---|
| Freshdesk (Freshworks) | Our support ticketing system |
| Xero | Accounting and invoicing |
| GoCardless | Direct debit payments |
| Stripe | Card payments |
| NetEarthOne, and domain registries including Nominet | Registering and managing domain names |
| Pax8 and Microsoft | Providing Microsoft 365 licences |
| Microsoft 365 | Our own email, and documents and files about our clients and their projects, stored in SharePoint and OneDrive |
| Cloudflare | Hosting, security and DNS for websites |
| Amazon Web Services | Hosting websites and our client area and billing system, backups, email sending, and security monitoring |
| Backblaze (EU region) | Backups of websites and of our business systems |
| GitHub | Storing website code |
| Anthropic (Claude) and OpenAI (ChatGPT) | AI assistants that help with work such as writing code, drafting documents and answering support questions |
AI assistants. We use AI assistants, Anthropic’s Claude and OpenAI’s ChatGPT, to help with work such as writing code, drafting documents and answering support questions. We have switched off the use of our data to train their models. We keep the personal data we share with AI assistants to a minimum, and remove it where we can.
When you register a domain, the registry’s rules require us to pass your contact details to the registrar and registry. Your personal details are normally hidden from public domain lookups, but registries and registrars may disclose them where the law or their policies require it, for example in a domain dispute.
If you ask us to set up a third-party service for you, such as a booking system or an advertising account, we may need to share your details with that provider. We will only do so with your permission.
We may also share data with the police, courts or regulators where the law requires it.
We may use freelancers or subcontractors to help provide our services. If we do, they will only use your data to provide those services, and will be required to protect it to the same standard we do.
5. Data stored outside the UK
Some of the companies we use store or process data outside the UK, for example in the EU or the United States. Where they do, we make sure the transfer is protected, for example by UK adequacy regulations or the UK’s approved contract terms for international transfers.
6. How long we keep it
| Data | How long |
|---|---|
| Invoices, payments and accounting records | 7 years |
| Client account details | While you’re a client, then 7 years |
| Domain registration records | For the registration, then 7 years |
| Emails, support history and records of work | 7 years after you stop being a client |
| Your website and its data, including backups | Up to 6 months after a hosting service ends (Hosting service agreement, section 6) |
| Enquiries that don’t lead to work | Up to 2 years |
After these periods we delete the data, or anonymise it so it no longer identifies you.
7. Keeping it secure
We protect your data with access controls, two-factor authentication on our systems, encrypted connections, and backups held in a separate, secure location.
8. Your rights
Under UK data protection law, you have the right to:
- access the data we hold about you;
- have it corrected if it’s wrong;
- have it deleted, where we don’t need to keep it, for example for accounting law;
- restrict or object to how we use it, including objecting to its use in our portfolio;
- receive a copy of data you gave us, in a common format.
To use any of these rights, contact us using the details in section 1, or see our Data access, amendment and deletion requests page. We will respond within one month.
If you’re unhappy with how we’ve handled your data, please tell us first. You also have the right to complain to the Information Commissioner’s Office (ico.org.uk, 0303 123 1113).
9. Changes to this policy
We may update this policy from time to time. We will tell you about any significant change.