Privacy Policy

Last updated: 17 September 2026

This Privacy Policy explains how AfterWorks collects, uses, stores and protects personal information when you visit https://afterworks.space, contact us, receive a business-to-business communication from us, purchase a website or use our hosting and related services.

AfterWorks is the controller of the personal information described in this Privacy Policy.

Our contact details are:

AfterWorks
Unit 10a, Cockshades Farm
Stock Lane
Wybunbury
Nantwich
CW5 7HA
United Kingdom

Email: hello[at]afterworks.space

This Privacy Policy is intended primarily for business contacts, prospective customers and customers. AfterWorks provides its services on a business-to-business (“B2B”) basis only.

1. What personal information we collect

The information we collect depends on how you interact with AfterWorks.

We may collect and process the following categories of personal information.

1.1 Contact information

This may include:

your name;
job title or role;
business or organisation name;
business address;
email address;
telephone number;
website address or domain name; and
other business contact details.

1.2 Enquiry and communication information

When you contact us, we may collect:

the contents of your enquiry;
emails and other messages exchanged with us;
notes of telephone calls or conversations;
information you provide about your existing website;
project requirements;
requests, feedback and support information; and
records of our communications with you.

1.3 Prospect information

As part of our website redesign and business development activities, we may identify businesses that we believe could benefit from an improved website.

We may collect limited professional or business-related information about relevant business contacts, including:

name;
business name;
professional role;
business email address;
business telephone number;
business website;
publicly available business information;
publicly available information about an existing website;
the source from which the information was obtained;
records of our contact with the business; and
whether the person or business has asked us not to contact them again.

We aim to limit prospecting information to what is reasonably relevant to our B2B services.

1.4 Customer and project information

If you become a customer, we may process:

contact details;
quotation and order information;
project specifications;
website content;
approvals and instructions;
domain and DNS information supplied for the project;
technical information needed to build or host the website;
support and maintenance history;
invoice and payment records; and
records relating to hosting renewals or additional work.

1.5 Payment information

Where payments are processed through a third-party payment provider such as Stripe, that provider may collect and process payment card and transaction information.

AfterWorks does not generally need to receive or store your full payment card number.

We may receive transaction information such as:

payment status;
payment amount;
transaction reference;
billing name and address;
the last digits or type of payment method where provided by the payment processor; and
information required for invoicing and accounting.

1.6 Website and technical information

When you visit our website, we or our service providers may collect technical information such as:

IP address;
browser type and version;
device type;
operating system;
approximate location derived from IP address;
pages viewed;
referring website or source;
dates and times of visits;
website interaction information;
error or security logs; and
cookie or analytics identifiers where applicable.

1.7 Analytics information

Where enabled, we may use analytics services such as Google Analytics and Cloudflare Web Analytics to understand how visitors use our website.

Depending on the service and configuration used, analytics information may include:

pages visited;
visit duration;
referring sources;
device and browser information;
approximate geographic information;
interaction information; and
technical identifiers.

Where the law requires consent before analytics cookies or similar technologies are used, we will seek that consent.

1.8 Personalised proposal activity

When a personalised proposal is opened, we record an event linked to that proposal. We may also record clicks on key proposal actions, such as opening the website preview, reviewing the offer or choosing to proceed.

The Studio event record contains the proposal and prospect references, the type of event, and the date and time. It does not contain enquiry text, form submissions, an IP address or a device fingerprint. Hosting and security providers may separately process ordinary technical request information as described above.

2. How we collect personal information

We collect personal information in several ways.

2.1 Information you give us directly

You may provide information when you:

submit an enquiry form;
email or telephone us;
ask us to review or rebuild a website;
accept a quotation;
purchase a website;
request hosting or support;
make a payment;
provide website content or project information; or
otherwise communicate with AfterWorks.

2.2 Information from publicly available sources

We may obtain business contact information and other relevant information from public sources as part of our B2B prospecting and website-rebuild activities.

These sources may include, for example:

a business’s own website;
public business directories;
search engines;
mapping and business-listing services;
Companies House;
professional networking websites;
social media pages used for business purposes;
industry directories;
public company records;
trade or local business websites; and
other publicly accessible sources.

The fact that information is publicly available does not remove our obligations under data protection law. We assess whether our proposed use is appropriate and proportionate.

2.3 Information from third parties

We may receive information from:

customers;
suppliers;
business partners;
payment processors;
technology providers;
public databases;
referral sources; or
other organisations lawfully providing business information.

If we use third-party data providers in future, we will take reasonable steps to assess whether the information has been obtained and supplied lawfully.

2.4 Automatically through our website and systems

When optional brochure analytics is enabled, we ask before recording interaction events or retaining campaign labels in session storage. These events contain an action name, a broad page category and campaign labels, rather than enquiry content, email addresses or personalised preview URLs. You can change this choice using Analytics preferences in the footer. Declining leaves the enquiry form available. We retain the preference in browser storage.

Personalised proposal events are recorded in Studio when the proposal is opened or a key proposal action is selected. These events are linked to the proposal and are used separately from optional brochure analytics. They do not rely on the brochure site’s analytics preference.

The enquiry form uses Cloudflare Turnstile to check for automated submissions. Contact details and the message are sent to our receiving service only after server-side validation. You can also contact hello@afterworks.space directly.

Certain technical information may be collected automatically through:

website hosting;
server logs;
security systems;
analytics services; and
cookies or similar technologies where applicable.

3. Why we use personal information

We use personal information only where we have a lawful reason to do so.

Our main purposes are described below.

3.1 To respond to enquiries

We use contact and enquiry information to:

respond to questions;
discuss our services;
provide information requested by you;
prepare quotations; and
follow up on genuine enquiries.

Our lawful basis will usually be legitimate interests or, where the enquiry is made with a view to entering into a contract, taking steps at your request before entering into a contract.

3.2 To provide our services

We use customer and project information to:

design and build websites;
configure and launch websites;
provide hosting;
provide support;
carry out requested changes;
manage projects;
communicate about the work;
manage renewals; and
fulfil our contractual obligations.

Our lawful basis is generally performance of a contract or taking steps before entering into a contract.

3.3 To process payments and maintain financial records

We use relevant information to:

issue quotations and invoices;
collect and reconcile payments;
manage refunds where applicable;
keep accounting records; and
comply with tax and financial obligations.

Our lawful bases may include performance of a contract and compliance with a legal obligation.

3.4 To identify relevant businesses that may benefit from our services

AfterWorks may research businesses and their existing websites in order to identify organisations that may benefit from website redesign or rebuild services.

Where personal information is involved, we may rely on our legitimate interests in:

promoting and growing our business;
identifying potential business customers;
presenting relevant website improvement opportunities;
contacting appropriate business decision-makers; and
keeping accurate records of our business development activity.

We consider the nature of the information, the business context, how the information was obtained, whether the recipient would reasonably expect business contact, and the likely privacy impact.

We do not regard legitimate interests as an automatic permission to contact anyone. We apply it only where we consider the processing to be necessary, proportionate and appropriately balanced against the individual’s rights and interests.

3.5 To send relevant one-to-one B2B communications

Our prospecting is intended to be targeted and relevant. We may contact a business to show it a website redesign or explain how we believe its existing website could be improved.

Where permitted, we may rely on legitimate interests to process professional contact information for B2B direct marketing.

The rules for electronic marketing differ according to the type of recipient.

In particular:

companies, limited liability partnerships and certain other incorporated organisations may be treated as corporate subscribers under UK electronic marketing rules;
sole traders and some partnerships are treated differently and may receive stronger protections; and
where consent is legally required for a particular communication, we will not rely on legitimate interests instead of that required consent.

Our marketing communications will identify AfterWorks and provide a straightforward way to ask us to stop contacting you.

3.6 To maintain suppression records

If you tell us that you do not want marketing communications from us, we may retain a minimal record such as your email address or other identifier on a suppression list.

We keep this information so that we can respect your objection and avoid contacting you again for direct marketing.

Our lawful basis is our legitimate interests in complying with your request and maintaining effective suppression records, together with our legal obligations where applicable.

3.7 To operate, protect and improve our website and systems

We may use technical and usage information to:

operate our website;
detect faults;
prevent abuse;
maintain security;
investigate suspicious activity;
understand website performance; and
improve our services.

For personalised proposals, we also use view and key-action events to understand whether a proposal has been considered and to plan relevant personal follow-up.

Our lawful bases may include legitimate interests, consent where required for particular cookies or analytics technologies, and legal obligations where applicable.

3.8 To establish, exercise or defend legal rights

We may keep and use relevant information where reasonably necessary to:

manage disputes;
enforce agreements;
obtain professional advice;
establish or defend legal claims; or
protect AfterWorks, our customers or others.

Our lawful basis will usually be legitimate interests and, where applicable, compliance with legal obligations.

4. Legitimate interests

Where we rely on legitimate interests, we consider:

the purpose we are trying to achieve;
whether processing personal information is necessary for that purpose; and
whether our interests are outweighed by the individual’s rights, freedoms or reasonable expectations.

Examples of our legitimate interests include:

developing and promoting our B2B services;
identifying relevant prospective business customers;
communicating with appropriate business contacts;
responding to business enquiries;
maintaining customer and prospect records;
improving our services and website;
protecting our systems and preventing fraud or misuse;
maintaining suppression lists; and
managing and defending our legal rights.

Where appropriate, we maintain internal records of our assessment.

You have the right to object to processing based on legitimate interests.

Where personal information is used for direct marketing, your right to object is absolute. If you tell us to stop using your information for direct marketing, we will stop doing so.

5. Information obtained from public or third-party sources

If we obtain your personal information from somewhere other than directly from you, we aim to provide appropriate privacy information within the time required by law.

Where we contact you using information obtained from a public or third-party source, we may provide this Privacy Policy at or before our first communication with you.

The categories of information we obtain are generally limited to:

identity and professional role information;
business contact information;
business or organisation details;
publicly available website and business information; and
the source from which the information was obtained.

If you would like to know the particular source from which we obtained your information, you can contact us.

6. Direct marketing and your right to object

AfterWorks uses targeted one-to-one B2B outreach rather than general consumer marketing.

We may contact relevant business contacts about website redesign, rebuild and related services where we believe the communication is relevant and legally permitted.

Every individual has the right to object at any time to the use of their personal information for direct marketing.

You can ask us to stop by:

using any opt-out method included in our communication;
replying to our message and asking us not to contact you; or
emailing hello[at]afterworks.space.

We will action direct-marketing objections as soon as reasonably practicable.

We may keep a limited suppression record after an objection so that we do not inadvertently contact you again.

We do not sell personal information to third parties for their own marketing.

7. Cookies and analytics

Our website may use cookies and similar technologies.

7.1 Essential technologies

Some technologies may be necessary for:

website security;
network management;
fraud prevention;
basic website operation; or
remembering privacy choices.

Where a technology is strictly necessary for the service requested by the user, consent may not be required.

7.2 Google Analytics

Where enabled, we may use Google Analytics to understand how visitors use our website.

Google Analytics may use cookies or similar technologies and may process technical and usage information.

Where consent is required under UK law, Google Analytics will only be activated after the appropriate consent has been obtained.

7.3 Cloudflare Web Analytics

Where enabled, we may use Cloudflare Web Analytics or related Cloudflare services to understand website performance, traffic and security.

The precise information processed depends on the Cloudflare products and configuration we use.

7.4 Managing cookies

Where our website uses non-essential cookies or similar technologies that require consent, visitors will be provided with an appropriate choice.

You can also control cookies through your browser settings, although blocking some technologies may affect website functionality.

We do not currently intend to use advertising pixels or behavioural advertising technologies such as Meta Pixel.

If our use of cookies or tracking technologies changes materially, we will update this Privacy Policy and any cookie information shown on the website.

We may share personal information with trusted service providers where necessary to operate AfterWorks.

These may include:

8.1 CRM and database providers

We use Convex as part of our CRM and operational systems. Prospect and customer information may therefore be stored or processed using Convex infrastructure.

8.2 Hosting and website infrastructure providers

We may use providers such as Cloudflare to provide:

website hosting;
content delivery;
DNS-related services where relevant;
network security;
performance services; and
analytics.

8.3 Analytics providers

Where enabled, analytics information may be processed by providers such as:

Google; and
Cloudflare.

8.4 Payment providers

Where we offer card or online payment, we may use a provider such as Stripe.

Payment providers process information under their own terms and privacy arrangements where they act as independent controllers, and may also process information on our behalf for certain functions.

8.5 Email and communications providers

We use third-party business email and communications infrastructure to send, receive and store business communications.

8.6 Professional advisers

We may share information where reasonably necessary with:

accountants;
legal advisers;
insurers;
IT or security advisers; and
other professional advisers.

8.7 Authorities and legal recipients

We may disclose information where required or permitted by law, including to:

courts;
regulators;
law enforcement;
tax authorities; or
other competent authorities.

8.8 Business transfers

If AfterWorks or its business assets are sold, reorganised or transferred, relevant customer and business records may be transferred as part of that transaction, subject to applicable data protection law.

We require service providers that process personal information on our behalf to handle it appropriately and in accordance with applicable data protection requirements.

9. International transfers

Some of the technology and service providers we use may process personal information outside the United Kingdom.

Where personal information is transferred internationally and UK data protection law requires additional protection, we take reasonable steps to ensure that an appropriate transfer mechanism is in place.

Depending on the circumstances, this may include:

UK adequacy regulations;
the UK International Data Transfer Agreement;
the UK Addendum to approved standard contractual clauses;
other legally recognised safeguards; or
an applicable legal exception where permitted.

Where appropriate safeguards are required, we also consider whether the transferred information will receive a standard of protection that meets applicable UK legal requirements.

You may contact us if you would like more information about the safeguards relevant to a particular transfer.

10. How long we keep personal information

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, including legal, accounting, security and dispute-resolution requirements.

Our general retention approach is as follows.

10.1 Customers

Core customer, contractual, payment and project records may generally be retained for the duration of the customer relationship and for up to six years afterwards, where appropriate for contractual, tax, accounting or legal purposes.

Some records may need to be retained longer where required by law or where a dispute or legal claim is ongoing.

10.2 Prospective customers

Where a business does not become a customer, prospect and business-development information will generally be retained for up to 24 months from the last meaningful interaction or review, unless:

it remains reasonably relevant to an active business opportunity;
you have asked us to delete information that we are not required to retain;
you have objected to direct marketing; or
there is another lawful reason to retain the information.

10.3 General enquiries

General enquiry and correspondence records may normally be retained for up to 24 months, unless they form part of an ongoing customer relationship or there is a reason to keep them longer.

10.4 Suppression records

Where you object to direct marketing, we may keep a minimal suppression record for as long as reasonably necessary to make sure your preference continues to be respected.

10.5 Analytics and technical logs

Analytics information, server logs and security records are retained according to our configuration, operational requirements and the settings of the relevant service provider.

We periodically review retention and aim not to keep identifiable information longer than reasonably necessary.

10.6 Backups

Personal information may remain in backups for a limited period after it has been deleted from live systems. Backup copies are protected and are not routinely used for other purposes.

11. How we protect personal information

We use reasonable technical and organisational measures designed to protect personal information from:

unauthorised access;
accidental loss;
misuse;
alteration;
unauthorised disclosure; and
destruction.

Measures may include, where appropriate:

access controls;
account authentication;
secure hosting;
encryption in transit;
restricted administrative access;
software and infrastructure updates;
backups;
monitoring and logging; and
use of reputable service providers.

No internet service or electronic storage method can be guaranteed to be completely secure.

12. Your data protection rights

Depending on the circumstances, UK data protection law may give you rights including the following.

12.1 Right of access

You may ask for confirmation of whether we process your personal information and request a copy of the personal information we hold about you.

12.2 Right to rectification

You may ask us to correct personal information that is inaccurate or incomplete.

12.3 Right to erasure

In certain circumstances, you may ask us to delete your personal information.

This right is not absolute. We may need to retain information where there is a lawful reason to do so.

12.4 Right to restrict processing

In certain circumstances, you may ask us to restrict how we use your personal information.

12.5 Right to object

You may object to processing based on our legitimate interests in certain circumstances.

You have an absolute right to object to the use of your personal information for direct marketing.

12.6 Right to data portability

Where the legal requirements are met, you may have the right to receive certain information in a structured, commonly used and machine-readable format or ask for it to be transferred to another organisation.

Where we rely on consent, you may withdraw that consent at any time.

Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

12.8 Rights concerning automated decisions

You may have rights relating to decisions made solely by automated means where those decisions produce legal or similarly significant effects.

AfterWorks does not currently use solely automated decision-making to make decisions about individuals that produce legal or similarly significant effects.

13. Exercising your rights

To exercise a data protection right, contact:

hello[at]afterworks.space

You do not normally need to pay a fee.

We may need to request reasonable information to confirm your identity before acting on a request.

We aim to respond within the time required by applicable data protection law.

Some rights are subject to exemptions and do not apply in every situation.

14. Complaints

If you have concerns about how AfterWorks uses your personal information, please contact us first so that we can investigate.

You also have the right to complain to the UK’s data protection regulator:

Information Commissioner’s Office (ICO)
https://ico.org.uk

You can contact the ICO directly using the contact options published on its website.

15. Providing personal information

Where we need information to enter into or perform a contract with you, failure to provide the necessary information may mean that we cannot provide some or all of the requested services.

For general website browsing, you are not required to provide identifying information directly to us, although some technical information may be processed automatically as described above.

16. Sensitive personal information

AfterWorks does not intentionally seek special category personal information as part of its normal website design, prospecting or customer relationship activities.

Please avoid sending sensitive personal information unless it is genuinely necessary.

If we receive sensitive information unexpectedly, we will handle it in accordance with applicable law and will not use it for unrelated purposes.

17. Children’s information

AfterWorks provides B2B services and does not offer services to children.

Our website and services are not intentionally directed at anyone under the age of 18, and we do not knowingly collect children’s personal information for marketing purposes.

18. Links to third-party websites

Our website may contain links to websites operated by other organisations.

This Privacy Policy applies only to AfterWorks.

We are not responsible for the privacy practices of third-party websites and recommend that you review their privacy information separately.

19. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect:

changes to our services;
changes to the technologies we use;
changes to our suppliers;
changes to our processing activities; or
changes to legal or regulatory requirements.

The latest version will be published on https://afterworks.space with an updated revision date.

Where a change materially affects how we use existing personal information, we will take reasonable steps to provide additional notice where appropriate.

20. Contact us

For questions about this Privacy Policy, the personal information we hold about you, or your data protection rights, contact: