PRIVACY POLICY

Itoteki Design ("we", "us", "our") is committed to protecting your personal data. This policy explains what we collect, why we collect it, and how we keep it safe. It applies to everyone who uses our website or gets in touch with us.

We comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR).

WHO WE ARE

Itoteki Design is a trading name used by Andrea Merron and Elizabeth Taylor, who each operate as sole traders. We are joint data controllers for the personal data described in this policy.

Each of us holds enquiry data in our own email account, and each of us is responsible for the personal data under our own control, including keeping it secure and deleting it when it is no longer needed or when you ask us to. Between us, we have agreed to pass on any request we receive so that it is acted on by both of us.

This is our internal arrangement, and it does not limit your rights. You can contact either of us about any of your rights, and we will handle your request across all the data we hold, not just the copy held by whichever of us you happened to write to.

You can reach us at any time by emailing hello@itoteki.co.uk, or by writing to us at The Limes, The Street, Alton GU34 3DT.

WHAT WE COLLECT

Information you give us directly, when you use our contact form or email us:

  • Your name and email address

  • Your phone number, if you provide one

  • Details of the property you are enquiring about, which may include its address

  • Anything else you choose to tell us in your message

Information collected automatically when you visit our website:

  • Your IP address, browser type and device type

  • Approximate location, derived from your IP address

  • Which pages you viewed, how you arrived at our site, and how long you stayed

Our website is built on Squarespace, and this second category is collected by Squarespace on our behalf using cookies. It is only collected if you accept analytics cookies. See the Cookies section below.

We do not sell products or take payments through this website, so we never collect card or payment details.

We do not knowingly collect data from children, and our services are not directed at them.

HOW WE USE YOUR DATA

We use the information you send us to respond to your enquiry: to discuss your property, arrange a site visit, and prepare a quotation if you would like one. We use website analytics data, where you have consented to it, to understand how our site is used so we can improve it. We will never sell your data, and we will not send you marketing you have not asked for.

LAWFUL BASIS FOR PROCESSING

Legitimate interests - to read and reply to enquiries you send us. We have balanced this against your rights, and we think you would reasonably expect us to use your details to answer your message.

Consent - for analytics cookies. You can withdraw this at any time.

SHARING YOUR DATA

We use the following services to run our website and receive enquiries:

  • Squarespace - website hosting, contact form handling, and website analytics, provided under Squarespace's data processing agreement.

  • Google - we use Gmail, so your enquiry arrives in and is stored in our email accounts, subject to Google's own terms and privacy policy.

We may also disclose data to law enforcement or a regulator where we are legally required to do so. We do not share your data with anyone else. We do not pass your details to estate agents, contractors or any other third party without asking you first.

SENDING DATA OUTSIDE THE UK

Both of the providers we use are based in the United States, so your enquiry and any analytics data may be transferred outside the UK.

Squarespace, Inc. relies on the UK Extension to the EU-US Data Privacy Framework and, where that does not apply, on the European Commission's Standard Contractual Clauses together with the UK International Data Transfer Addendum.

Google relies on the same safeguards for personal data transferred out of the UK.

These are transfer mechanisms recognised under UK data protection law.

HOW WE STORE AND PROTECT YOUR DATA

Your data is stored securely, and only the two of us have access to it. We use encrypted connections (HTTPS), strong passwords and multi-factor authentication on the accounts where enquiries are held.

HOW LONG WE KEEP IT

We keep enquiries for 24 months from your last contact with us, then delete them.

If you go on to become a client, we will keep the records relating to your project for as long as the project runs, and for 6 years afterwards to meet our tax and accounting obligations.

If you ask us to delete your data, we will do so promptly, unless we are legally required to keep it.

YOUR RIGHTS

Under UK data protection law, you have the right to:

  • Access the personal data we hold about you

  • Ask us to correct inaccurate data

  • Ask us to delete your data

  • Ask us to restrict how we process your data

  • Object to processing based on legitimate interests

  • Ask us to transfer your data to another provider (data portability)

  • Withdraw your consent to cookies at any time

  • Lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk

To exercise any of these rights, email us at hello@itoteki.co.uk. We will respond within one month.

COOKIES

A cookie is a small file stored on your device. Our website uses two kinds.

Essential cookies are needed for the site to work, so we do not ask for consent to set them:

  • crumb - prevents cross-site request forgery on our contact form. Expires at the end of your browser session.

  • RecentRedirect - prevents redirect loops. Expires after 30 minutes.

  • Test - checks whether your browser accepts cookies. Expires at the end of your browser session.

  • ss_cookieAllowed - remembers your cookie choice. Expires after 30 days.

Analytics cookies are set by Squarespace to tell us how visitors use the site. We only set these if you accept them:

  • ss_cid - identifies a unique visitor. Expires after 2 years.

  • ss_cvr - identifies a unique visitor and tracks sessions. Expires after 2 years.

  • ss_cpvisit - tracks a visitor's sessions. Expires after 2 years.

  • ss_cvisit - identifies a visit. Expires after 30 minutes.

  • ss_cvt - identifies a visit. Expires after 30 minutes.

When you first visit our site you can accept or decline analytics cookies. If you decline, none of the analytics cookies above will be set. You can change your mind at any time by clearing cookies in your browser settings, which will bring the banner back.

CHANGES TO THIS POLICY

We may update this policy from time to time. Changes will be posted on this page.

Last updated: 2 August 2026