Privacy Policy

The short version: we collect as little as possible, we never sell it, and you can ask us to delete it with one message.

Who we are

KERBSMITH LTD, a company registered in England and Wales, is the data controller for everything described on this page.

• Company number: 17375448
• Registered office: 9 Sylverdale Road, Croydon, CR0 4LD
• Contact for anything on this page: hello@kerbsmith.co.uk

If we called you or knocked on your door

We sell by going out and talking to local trades, so you may hear from us before you've ever heard of us. You're entitled to know where we got your details, so here it is plainly.

• Where it came from. Public business listings: usually a Google Business Profile, sometimes Companies House, a trade directory or the phone number written on a van. We don't buy or rent lists and we never will.
• What we hold. Business name, trading address, phone number, website, and a note of when we last contacted you and what was said.
• Why we're allowed to. Legitimate interests: offering a service to a business that plausibly wants one. We've weighed that against your right to be left alone, and the conclusion is written down. Ask and we'll send it.
• Screening. Before calling anyone we screen the number against the Telephone Preference Service and the Corporate TPS, and against our own do-not-call list.
• Saying no. Tell us once (by phone, message, email or at the door) and you go on the do-not-call list permanently. We keep the bare minimum (your number and the fact you objected) precisely so we don't contact you again by accident. That's the one thing we won't delete on request, because deleting it is how people get called twice.
• How long we keep the rest. If you don't become a client, we delete the prospect record within 12 months of the last contact.

If you contact us, or become a client

If you get in touch on WhatsApp, by phone or by email, we hold your name, number or address and what you sent us, so we can reply and, if you become a client, do the work. If you do become a client we also hold the business details needed to build your site and invoice you.

In UK GDPR terms: legitimate interests for answering enquiries, performance of a contract for client work, and legal obligation for the invoicing records tax law makes us keep. We don't send marketing messages without your consent.

This website

This site sets no cookies and runs no advertising trackers. There's no consent banner because there's nothing to consent to. If we ever add analytics it will be cookieless and anonymous, and this page will say so before it goes live.

Who else sees it

We name our suppliers rather than say “reputable third parties”, because a name is something you can go and check.

• Cloudflare: hosting, DNS and email routing for our site and our clients' sites.
• Google: Business Profile, Maps and search tools, and Gmail, where our email ends up.
• Meta: WhatsApp, if that's how you message us.
• Anthropic: the AI models we use to build websites and, once it exists, to run the AI Front Desk.
• Our domain registrar and our payment provider: for domains and billing. Card details go straight to Stripe; we never see or store them.

Some of these process data outside the UK. Where they do, the transfer relies on a UK adequacy decision, or on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

We don't sell your details and we don't share them with anyone else.

If you're a client of ours

Where we handle your customers' personal data on your behalf (anyone filling in a form on your site, and any message handled by the AI Front Desk once it exists), you are the controller and we are your processor. The data processing agreement that governs it is Schedule 1 of our terms. It applies automatically from the day your site goes live; you don't have to ask for it, and there's nothing extra to sign.

If you're a customer of one of our clients

If you filled in a form on a tradesperson's website that we built, or messaged their AI Front Desk, that business is the controller of your data and we only process it on their instructions: to pass on your enquiry, answer your questions, quote their prices and book appointments. Ask the business directly about their privacy practices. You can also ask us anything at the address above and we'll help, or point you to them.

How long we keep it

• Prospects we contacted who didn't become clients: deleted within 12 months of the last contact.
• Do-not-call entries: kept indefinitely, because that's the point of them.
• Enquiries that go nowhere: deleted within 12 months.
• Client records: for as long as you're a client, plus six years for invoices and accounting records, which is what UK tax law requires.
• A client's website build and supplied content: six months after the plan ends, then deleted.
• Personal data we hold as a processor for a client: deleted or returned within 90 days of their plan ending, under Schedule 1 of the terms.

Ask us to delete something sooner and we will, unless the law says we must keep it.

Your rights

Under UK GDPR you can ask us for a copy of what we hold about you, ask us to correct it, ask us to delete it, ask us to restrict what we do with it, ask for it in a portable format, and object to us processing it, including objecting to direct marketing, which is absolute and which we act on immediately. Where we've relied on consent, you can withdraw it at any time.

Message hello@kerbsmith.co.uk and we'll deal with it within one month. There's no charge and you don't need a reason.

If you're unhappy with how we've handled your data, tell us first and we'll try to put it right. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. You don't have to come to us first.

Changes to this policy

If we change anything that matters (a new supplier, a new purpose, a longer retention period), we'll update this page and change the version stamp below. If you're a client, we'll tell you as well.

Version 2026-08-02. Last updated 2 August 2026.