← Back to home

Privacy policy

Last updated 19 September 2026 · Version 2

This policy explains what personal data Lewis Forecourts collects through this website, why, how long it is kept and what rights you have over it. It covers the advertising enquiry form and the client area. It is written to be read — if anything is unclear, ask us and we will explain it.

Who is responsible for your data

The data controller is Lewis Forecourts. For anything to do with your personal data, contact us through the form on this site. Mark your message for the attention of the data controller and we will route it accordingly.

What we collect, and why

If you register interest

We collect your name, email address, phone number, business name if you give one, which screen types interest you, and anything you write in the additional information box. We also record the time, your IP address and your browser's user-agent string with the submission.

Why: to reply to your enquiry and to work out what to quote you. The IP address and user-agent are kept to detect and block automated abuse of the form.

Lawful basis: your consent, which you give by ticking the box and confirming your email address. You can withdraw it at any time by emailing us, and we will delete the enquiry.

If you become a client

We collect your billing name and address, VAT number if you have one, contact details, the advertising media you upload, and a record of payments. Your password is stored only as a hash — we cannot read it. Your two-factor authentication secret is stored encrypted.

Why: to run your advertising account, display your adverts, take payment and meet our accounting obligations.

Lawful basis: performance of our contract with you, and legal obligation for the accounting records.

When you use the site

We record which pages are visited, roughly where visits come from (the referring site, and any campaign tags in the link), and general device information such as browser and operating system. We do not use Google Analytics or any other third-party analytics or advertising service, and there are no tracking pixels on this site.

Visits are grouped using a key derived from your IP address and browser that is regenerated every day. This lets us count how many people visited without building a profile that follows you between days or between sites. We never store your raw IP address against a page view.

Lawful basis: consent where you have accepted analytics cookies; otherwise we do not record the visit.

Emails we send

We keep a record of the transactional emails we send you — the recipient, subject, time and whether delivery succeeded — so we can prove an email was sent and diagnose delivery problems. The content of the message is discarded once it has been delivered.

Who we share it with

We do not sell your data and we do not share it for anyone else's marketing. It is shared only with:

  • Our hosting provider, who stores the site and its database on our behalf.
  • Stripe, who process card payments. Card details are entered on Stripe's own pages and never reach our servers. See Stripe's privacy policy.
  • Our email provider, who delivers the messages we send you.
  • Our accountant and HMRC, for invoices and payment records, where we are legally required to.

How long we keep it

WhatHow longWhy that long Unconfirmed enquiries30 daysDeleted automatically if the email is never confirmed. Confirmed enquiries that do not become clients24 monthsSo we can pick up a conversation you started. Client accountsWhile active, then 7 yearsAccounting and tax record-keeping requirements. Uploaded advertising media12 months after it is replacedSo a previous advert can be restored if you ask. Payment records7 yearsLegally required. Website analytics26 monthsTo compare year on year. Security and audit logs24 monthsTo investigate misuse of an account.

Your rights

Under the UK GDPR you have the right to:

  • Access — ask for a copy of the personal data we hold about you.
  • Rectification — have anything inaccurate corrected.
  • Erasure — ask us to delete it, where we are not legally required to keep it.
  • Restriction — ask us to stop using it while a dispute is resolved.
  • Portability — receive the data you gave us in a machine-readable format.
  • Objection — object to processing we carry out on the basis of legitimate interests.
  • Withdraw consent — at any time, without affecting anything done before you withdrew it.

Contact us through the form on this site, and we will respond within one month. There is no charge. If you are not satisfied with how we handle it, you can complain to the Information Commissioner's Office, the UK's data protection regulator.

How we protect it

  • All traffic is encrypted in transit with HTTPS.
  • Passwords are stored as salted hashes and are never recoverable, by us or by anyone else.
  • Every account — client and administrator — must use two-factor authentication.
  • Stripe keys and two-factor secrets are encrypted at rest.
  • Every change made in the system is written to an append-only audit log.
  • Uploaded media is stored outside the public web directory and served only to the account that owns it.

Children

This is a business-to-business service and is not directed at children. We do not knowingly collect data about anyone under 18.

Changes to this policy

If we change this policy we will update the date at the top. Where the change is significant and affects you, we will email you about it.