Skip to content
WebAsk

Privacy Notice

How we collect, use and protect personal data when you visit webask.co.uk, get in touch or work with us.

Last updated 8 October 2026

Working draft. This privacy notice is due a legal review and may change after it. This version applies until then, and any change will show a new date above.

This notice explains what personal data WebAsk collects, why, the lawful basis for each use, who else handles it, how long it is kept and the rights you have. It covers this website, enquiries by the contact form, email, phone or WhatsApp, the free audit, discovery calls and the records kept if your business becomes a client.

You have the right to object to some of the ways we use your data. That right is set out in its own section below, headed “Your right to object”.

If anything here is unclear, email info@webask.co.uk and we will explain.

Who is responsible for your data

WebAsk is a trading name of Naxdor, an enskild firma (a Swedish sole proprietorship) operated by Ansar Cheema.

An enskild firma is not a company. Its owner runs it as a private individual and is personally responsible for it. The controller of your personal data, meaning the person who decides why and how it is used, is therefore Ansar Cheema, trading as Naxdor and as WebAsk. In this notice, “we” and “us” mean that business.

The business is established in Sweden. It has no office, branch or other establishment in the United Kingdom. Its registered address is on our Company Information page.

You can reach us at info@webask.co.uk or on +44 7818 920132. Both reach Ansar Cheema, who runs the business. We have not appointed a data protection officer.

Which laws apply

Because the business is established in Sweden, the EU General Data Protection Regulation (EU GDPR) applies to the personal data it handles. Sweden's data protection authority, the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), supervises compliance with it.

Because we offer our services to people in the United Kingdom, the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 also apply when we handle the personal data of people in the UK. The UK regulator is the Information Commission, which is known as the ICO.

For people in the UK we also follow the Privacy and Electronic Communications Regulations (PECR), which cover cookies and similar technologies, and electronic marketing.

Our UK representative

Article 27 of the UK GDPR requires a controller based outside the UK, whose handling of personal data the UK GDPR covers, to designate a representative in the UK in writing. There is an exemption for processing that is occasional, does not include special category or criminal offence data on a large scale, and is unlikely to result in a risk to people's rights and freedoms.

We have not designated a UK representative. Whether we need one is under review. If we do, we will designate one and name them here with their contact details, and the date at the top of this notice will change.

Until then, contact us directly about anything in this notice at info@webask.co.uk. The ICO can reach us at the same address.

The data you give us

We collect only what we need for the reason you contact us:

  • The contact form: your name, email address and message, and the service you are interested in, your budget range and your timeline, which are all required; your company name and your country, which are optional
  • Email: your email address, what you write and any details in your email signature
  • Phone and WhatsApp: your phone number, the name on your account, your messages and the times of your calls
  • The free audit: the web address of your website, with the contact-form details above
  • Discovery calls: the details needed to arrange the call, and any notes we make during it
  • If your business becomes a client: the names and contact details of the people we work with, billing details, the correspondence and files for the work, and anything else you choose to share for it

The data collected when you use the site

Our hosting provider, Vercel, records technical details of requests to the site, such as the page requested, the time and the browser used, and processes the IP address each request comes from. These records keep the site running and secure.

Vercel also gives us measurements of traffic and page speed. Vercel says its Web Analytics does not use cookies, that its data points are anonymous and not tied to an individual or an IP address, and that it identifies visitors by a hash created from the request and discards the visitor session after 24 hours. Vercel says Speed Insights data points are anonymous too.

If you accept analytics cookies, Google Analytics 4 also collects how you use the site: the pages you view, how you arrived, your device and browser, your approximate location, how far you scroll, and some of the links and buttons you click. Google says Google Analytics does not log or store IP addresses from UK users. Google Analytics does not load until you accept. The Cookie Policy lists the cookies involved.

The contact form has a hidden anti-spam field. If it is filled in, which only automated software does, the submission is discarded and nothing is stored or sent.

Data we receive from other sources

For a free audit, we review the public pages of the website you name. Those pages may show personal data, such as a practitioner's name or professional registration details. We use it only for the audit you asked for. The source is the website itself, which anyone can see.

If your business becomes a client, it may give us the names and contact details of colleagues or suppliers we need to work with.

Why we use your data, and the lawful basis for each use

Data protection law requires a lawful basis for each use of personal data. Where we rely on legitimate interests, we say what the interest is. We may rely on it only where your rights and interests do not override it.

  • Answering your enquiry, by form, email, phone or WhatsApp. Basis: legitimate interests, in answering people who contact us about work for their business. Where the contract would be with you personally, for example as a sole trader, the basis is taking steps at your request before a contract.
  • Carrying out a free audit, recording the walkthrough on Loom and sending you the findings. Basis: legitimate interests, in providing the audit you asked for and showing you our work in the hope that you hire us.
  • Following up once after a free audit, to ask whether you have questions. Basis: legitimate interests, in answering questions about the audit.
  • Arranging discovery calls and preparing proposals. Basis: legitimate interests, in discussing work for your business, or steps at your request before a contract where the contract would be with you.
  • Doing the work and managing the relationship with a client. Basis: performance of a contract, where the contract is with you; otherwise legitimate interests, in working with the people a client business asks us to deal with.
  • Invoicing and keeping accounting records. Basis: a legal obligation under Swedish bookkeeping law, for the EU GDPR. The UK GDPR recognises only obligations under UK law for that basis, so for the UK GDPR we rely on legitimate interests, in complying with the law that governs the business.
  • Running, securing and improving the website, including request logs and Vercel's traffic and speed measurement. Basis: legitimate interests, in keeping the site working and secure and understanding which pages are used.
  • Google Analytics 4. Basis: consent, which you give through the cookie banner and can withdraw at any time. PECR also requires consent for its cookies.
  • Dealing with your requests to use your rights, and with complaints. Basis: legal obligation, because data protection law requires it.
  • Establishing, exercising or defending legal claims. Basis: legitimate interests, in protecting the business if a dispute arises.

Your right to object

Where we rely on legitimate interests, you have the right to object at any time, on grounds relating to your particular situation. We must then stop, unless we can show compelling legitimate grounds that override your interests, rights and freedoms, or we need the data to establish, exercise or defend legal claims.

You can object to direct marketing at any time, for any reason, and we will stop. If you would rather not receive the single follow-up after a free audit, tell us and there will be none.

To object, email info@webask.co.uk.

We do not send marketing

Sending us an enquiry or asking for a free audit does not put you on a mailing list. We do not send marketing emails or texts, and we do not pass your details to anyone else for their marketing. After a free audit, we follow up once at most.

If that ever changes, we will ask for your consent first, and every message will carry a way to stop.

Providers that handle data for us

We do not sell personal data. The providers below handle it on our behalf, as processors, under contracts that require them to protect it and to use it only on our instructions:

  • Resend (United States): sends the email we receive when you submit the contact form, and the confirmation you receive
  • Vercel (United States): hosts the website, holds its request logs and provides the traffic and speed measurement
  • SiteGround (Spain): hosts our business mailbox, where enquiries and correspondence are received and kept
  • Loom, part of Atlassian (United States): hosts the recorded walkthrough of a free audit, which we share with you by a link
  • Google (United States): runs Google Analytics 4, only if you accept analytics cookies. Google acts as our processor under its Ads Data Processing Terms, which cover Google Analytics. Google explains how it uses information from sites that use its services at www.google.com/policies/privacy/partners

Others who receive data

If you message or call us on WhatsApp, WhatsApp handles your number and messages as well. Its own terms and privacy policy apply to your use of WhatsApp.

If we hold a discovery call by video, it runs on Google Meet, and Google handles the call as well. Google's own terms and privacy policy apply to your use of Google Meet.

When you open a Loom link, Atlassian's privacy policy, which covers Loom, applies to your visit to Loom's website.

We may also share personal data with a professional adviser, such as a lawyer or accountant, if we need advice, and with authorities, such as the Swedish Tax Agency (Skatteverket), where the law requires us to.

International transfers

The business is in Sweden. UK law treats transfers of personal data to countries in the European Economic Area, including Sweden, as approved (Data Protection Act 2018, Schedule 21), so no further safeguard is needed for your data to reach us.

Resend, Vercel, Google and Loom are based in the United States.

On 1 October 2026, Resend, Vercel, Google and Atlassian, which owns Loom, were each listed on the US Data Privacy Framework List as taking part in the EU–US Data Privacy Framework and its UK Extension. UK law treats transfers to US organisations on that list as adequate, under the Data Protection (Adequacy) (United States of America) Regulations 2023, and the European Commission has recognised the same framework as adequate for the EU GDPR.

The data processing terms of Resend, Vercel and Atlassian also include standard contractual clauses with the UK's addendum to them, and Google's include standard contractual clauses as a fallback. You can ask us for a copy of the safeguard that applies to a provider.

SiteGround is based in Spain, in the European Economic Area. It stores our mailbox, and its backups, in its data centre in the Netherlands, also in the European Economic Area.

How long we keep it

We keep personal data only as long as we need it:

  • An enquiry that does not lead to work, by any route, with any free-audit recording and summary and any call notes: 12 months after our last exchange, so that we can pick up the conversation if you come back. It is then deleted.
  • Accounting records, such as invoices: until the end of the seventh year after the end of the calendar year in which the financial year ended, as Swedish bookkeeping law requires (Bokföringslagen, chapter 7, section 2).
  • Other records of work for a client, such as correspondence, proposals and project files: for as long as the work lasts, then for six years, so that we can answer questions or claims about the work.
  • Request logs: Vercel stores the site's runtime logs for one day on its Pro plan.
  • Vercel's traffic and speed measurement: Vercel says the Web Analytics visitor session is discarded after 24 hours, and the data is used for aggregated statistics only.
  • Google Analytics: user-level and event-level data for 2 months, the retention period set in our account. That setting does not affect aggregated reports.
  • The theme and consent entries in your browser: until you clear your browser's data for this site.

Your rights

You have the right to:

  • Ask for a copy of your personal data
  • Have inaccurate data corrected
  • Have your data deleted, in some circumstances
  • Ask us to restrict how we use it, in some circumstances
  • Receive data you gave us in a portable format, where we rely on consent or a contract
  • Object, as set out in “Your right to object” above
  • Withdraw your consent at any time where we rely on it, for example through the “Cookie settings” link in the footer. Withdrawing consent does not affect our use of your data before you withdrew it.

How to use your rights

Email info@webask.co.uk. In most cases there is no charge. We will reply without undue delay and within one month. If a request is complex, the law lets us extend that by up to two further months; if we need to, we will tell you within the first month.

We may ask for information to confirm who you are. The time limit starts once we have it.

Complaints

If you are unhappy with how we have handled your personal data, please complain to us first, at info@webask.co.uk. We will acknowledge your complaint within 30 days of receiving it, look into it, keep you informed of progress and tell you the outcome without undue delay.

You also have the right to complain to the Information Commission, known as the ICO, at ico.org.uk/make-a-complaint. The ICO recommends giving the organisation a chance to complete its own complaint process first, but you can complain to the ICO at any time.

Because the business is established in Sweden, you can also complain to the Swedish Authority for Privacy Protection (IMY) at imy.se.

Do you have to give us your data?

No law requires you to give us personal data. The contact form asks for your name, email address, the service, a budget range, a timeline and a message so that we can reply usefully; your company name and country are optional. If you would rather not use the form, email or phone us instead.

If your business becomes a client, we need billing details to invoice, because Swedish bookkeeping law requires accounting records, and contact details to do the work.

No automated decisions

We do not make decisions about you based solely on automated processing, and we do not profile you.

When we handle data for a client

If a client business asks us to build or run a system that holds its own customers' personal data, we handle that data on the client's behalf and only on its instructions. The client is the controller of that data, and its privacy notice applies to it. This notice does not cover it.

How we protect your data

The site is served over HTTPS. Within the business, only Ansar Cheema has access to the data described here. The providers named above hold some of it too, and the terms of those that act for us require them to protect it. No website or email system is completely secure, but we take reasonable steps to protect your data against loss, misuse and unauthorised access.

Children

The site and our services are for businesses. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

Changes to this notice

We will update this notice when what we do or the law changes, and change the date at the top when we do. If a change affects how we use data you have already given us, we will take reasonable steps to tell you.

Contact us

Questions about this notice or your personal data? Email info@webask.co.uk and we will reply within one working day.