This policy explains how I collect, use and protect personal data when you contact me or use my website design, development, hosting and IT services. It's written in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025.
jigsaw kloud is run by me, James Burrows, as a sole trader. I'm the data controller for the personal data described here, which means I decide how and why it's used. I'm registered with the Information Commission (formerly the Information Commissioner's Office, ICO), registration number ZA074109. As a sole trader, I'm not required to appoint a Data Protection Officer.
I only collect the personal data I need to provide a specific service. This usually includes your name, business name, email address, telephone number and business address. If you contact me, I also receive the contents of your message and any files you send.
To carry out a project, I may also need website content, logins or account details for systems I'm working on for you. I only use these for the work you've asked me to do, and I store logins in an encrypted password manager.
The personal information I ask for, and why, will always be made clear when I ask for it.
I use personal data to provide quotes, arrange and manage website and IT contracts, deliver the work, invoice for it, and communicate with you as part of these services.
When I build, host or maintain a website, or manage IT systems such as email or Google Workspace for a client, I may handle personal data belonging to that client's own customers or staff. In these situations, my client is the data controller and I act as their data processor. I only use that data on my client's instructions and for the work agreed, and I keep it secure and confidential.
If you have a question or request about personal data held on one of my clients' websites or systems, please contact that business directly. If you contact me instead, I'll pass your request on to them.
I only share personal data where it's needed for a specific service, or where the law requires it. I don't sell personal data.
Some of these providers may store or process data outside the UK. Where this happens, I make sure appropriate safeguards are in place, such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or a UK adequacy decision.
I may use secure AI-assisted tools to help with document preparation, data analysis, coding and drafting correspondence. They are not used for automated decision-making or profiling.
I remain responsible for how your data is handled when these tools are used.
All client information is stored electronically in secure, access-controlled systems. No paper records are kept. Files are encrypted, and accounts are protected by strong passwords and two-factor authentication.
I keep personal data only for as long as there's a genuine business or legal need. Client and invoice records are normally kept for up to six years to meet contractual, tax and legal requirements. I review the records I hold periodically, and delete those that are no longer needed. Where data can't be deleted straight away, it's securely stored and isolated from further use until it can be.
This website doesn't use advertising cookies.
I use Google Analytics to count visits and see which pages are read, so I can improve the site. Google Analytics sets cookies to do this. It's configured so that the data isn't used for advertising or shared for Google's own purposes, and it's kept for no more than two months. I only see anonymous totals. My lawful basis for this is legitimate interests.
Since February 2026, UK law (the Privacy and Electronic Communications Regulations, as amended by the Data (Use and Access) Act 2025) allows cookies to be used without consent when they're used only to produce statistics that help improve a website, as long as visitors are told about them and given a simple way to object.
Opinions differ on whether Google Analytics fully qualifies for this exception, because Google is a separate company that processes the data. I've taken the view that, configured as described above, it does. So rather than asking for cookie consent, I'm telling you openly how it works.
If you'd rather not be included, you can object at any time by installing Google's Analytics opt-out browser add-on, or by blocking cookies in your browser settings. The rest of the site will work normally.
To make a request, please contact me. Requests are free of charge, and I aim to respond within one month. A reasonable fee may only be charged, or a request refused, where it is manifestly unfounded or excessive, as UK GDPR allows.
If you're unhappy with how I've handled your personal data, or with how I dealt with a request you made, please contact me first so I can put it right. You don't need to use any particular wording. I'll handle it as follows:
You also have the right to complain to the Information Commission (formerly the ICO) at any time, at ico.org.uk/make-a-complaint or on 0303 123 1113.
Created 19 May 2018
Last updated November 2026
The General Data Protection Regulation (GDPR) came into effect on 25 May 2018 and forms part of UK data protection law alongside the Data Protection Act 2018 (UK).
We use your personal data to quote, arrange, and manage web design contracts, and communicate with you as part of delivering our services.
jigsaw kloud, as the Data Controller, is responsible for determining how and why your personal data is processed. As a sole trader, we are not required to appoint a Data Protection Officer under UK GDPR. All client information is stored electronically using secure, access-controlled systems. No paper records are kept. Some of our trusted suppliers and service partners may process or store data outside the UK. Where this occurs, we ensure that appropriate safeguards – such as UK-approved Standard Contractual Clauses (SCCs) – are in place to keep your data protected.
When building or maintaining websites for clients, jigsaw kloud may process personal data on behalf of those clients. In these situations, the client acts as the Data Controller and jigsaw kloud acts as a Data Processor.
Data Processor suppliers
We use a number of trusted service providers to operate and deliver services. These providers may process personal data on our behalf and are listed below.
#1 Microsoft
#2 Google
#3 Zoho
#4 Filen
#5 Authy
#6 WordPress and Hostinger
#1 Microsoft
Windows 11 and Office documents containing sensitive data are password-protected and backed up to encrypted cloud storage.
Microsoft’s GDPR statement
#2 Google
Data is saved in various apps.
Google’s GDPR statement
#3 Zoho
Data is saved in various apps.
Zoho’s GDPR statement
#4 Filen
Files encrypted in cloud storage.
Filen GDPR Statement
#5 Authy
Additional security is provided using Two-factor Authorisation (2FA).
Twilio’s GDPR statement
#6 WordPress and Hostinger
All websites are managed via WordPress and Hostinger.
WordPress’ GDPR statement
Hostinger’s GDPR statement
What personal data we collect
jigsaw kloud considers there to be either a contractual or legitimate business interest to maintain contact with current clients, partners and suppliers. We only collect and process personal data we require to provide a specific service, which may include personally identifiable contact information. In addition, if you contact us directly, we may receive additional information, the contents of any message and/or attachments you send us, and any other information you choose to provide. The personal information you are asked to provide, and the reasons you are asked to provide it, will be made clear to you when we request such information.
How we handle your data
We use your data to provide a specific service and may share this data with trusted third parties, only when necessary.
How we protect your data
We take reasonable precautions, utilising encryption (#4) and 2FA (#5) to protect data in our possession from loss, misuse, and unauthorised access.
How long we process your data
Personal data we process will not be held longer than we have an ongoing legitimate business need to do so. Client records may be retained for up to six years to comply with contractual and legal obligations. When there is no ongoing legitimate business need, we will delete or, if not possible, securely store your information and isolate it from any further processing until deletion is possible.
How we process requests for data
Any clients, suppliers, or partners who wish to receive copies of the personal data jigsaw kloud holds about them can request this free of charge. We aim to respond within one month. A reasonable administrative fee may only be applied where a request is manifestly unfounded, excessive, or repetitive, as permitted under UK GDPR.
YOUR RIGHTS
Right of access: You have the right to obtain from us information concerning you and to request copies of your data.
Right to rectification: You have the right to request inaccurate data be amended by providing correct data.
Right to be forgotten: You have the right to request erasure of your personal data in certain circumstances, as provided by UK GDPR.
Right to restriction of processing: In certain situations, you have the right to obtain from us the restriction of processing.
Right to data portability: You have the right to receive your data in a structured, commonly used and machine-readable format to transmit to another controller.
Right to object: In certain situations, you have the right to object to the processing of your data e.g. for marketing purposes.
Right to file complaints: You have the right to complain to the ICO about how we process your data.
If you wish to request your data related to the rights mentioned, contact us.
jigsaw kloud
Created: 19th May 2018
Last updated: 6th March 2026