Privacy Policy

Last updated: 23 August 2026

This policy explains what personal data LENSO Web Design collects when you use this website or engage us, why we collect it, who we share it with, and the rights you have over it. It is written to satisfy the UK and EU GDPR, India's Digital Personal Data Protection Act 2023, and the California Consumer Privacy Act.

We have tried to write it in plain language. If anything is unclear, email us and we will explain it.

1. Who we are

LENSO Web Design ("LENSO", "we", "us") is a web design and development studio based in Jalandhar, Punjab, India. For the personal data described in this policy, we are the data controller.

• Email: hello@lensowebdesign.com
• Privacy enquiries: privacy@lensowebdesign.com
• Phone: +91 91155 29576
• Postal address: available on request by email, and stated in full on any contract or invoice we issue.

2. What we collect

We only collect data you choose to give us, plus the minimum our web server records automatically.

• When you submit a form on this site (the contact form, quote builder, or demo request): your name, business name, email address, phone number if you provide one, the country or region you tell us you are in, your budget range, and whatever you write in the project details field.
• When you email, call or message us on WhatsApp: your contact details and the contents of the conversation.
• Automatically, in our web server logs: your IP address, browser type, the pages you requested and the time you requested them. These logs are generated by our hosting provider for security and troubleshooting. We do not use them to build any profile of you.

We do not collect payment card details on this website. If you engage us, invoicing and payment happen through a separate payment provider or bank transfer, and your card details never reach us.

We do not knowingly collect special category data (health, biometrics, religion, political opinions and similar). Please do not send us any in a form field.

3. Why we use it, and our lawful basis

• To reply to your enquiry and prepare a quote. Lawful basis: steps taken at your request before entering a contract, and our legitimate interest in responding to people who contact us.
• To deliver a project you have engaged us for. Lawful basis: performance of a contract.
• To send you occasional follow-up about your enquiry. Lawful basis: consent, which you give by ticking the consent box on the form and can withdraw at any time.
• To keep records for tax, accounting and legal purposes. Lawful basis: legal obligation.
• To keep this website secure and working. Lawful basis: our legitimate interest in operating a functioning, secure site.

We do not sell personal data, and we do not share it with anyone for their own marketing. We do not use your data to train any AI model, and we do not paste client data into public AI tools.

4. Cookies, analytics and tracking

This website sets no cookies. It runs no analytics, no advertising pixels, no session recording and no third-party tracking scripts, and it stores nothing in your browser's local storage. That is why you are not seeing a cookie consent banner: there is nothing to consent to.

If we add analytics in future, we will update this policy and ask for your consent first, with a genuine option to refuse. Our Cookie Policy sets this out in more detail.

5. Who we share it with

We share personal data only with the service providers we need to run the business. Each of them processes it on our instructions.

• Hosting. Bluehost / Newfold Digital, which hosts this website and its email, in India.
• Email. Google (Gmail / Google Workspace), used to receive and send our business email.
• WhatsApp. Meta Platforms, if you choose to contact us that way. Anything you send over WhatsApp is also subject to Meta's own privacy policy.
• Professional advisers. Our accountant and, if ever necessary, our lawyers.

We will also disclose data if we are legally required to. We do not otherwise give it to anyone.

6. International transfers

We are based in India. If you contact us from the UK, EU, EEA, Switzerland, the United States, Canada or Australia, your data will be transferred to and stored in India, and with the providers named above, which may store it elsewhere.

For transfers of UK and EU personal data we rely on the UK International Data Transfer Addendum and the European Commission's Standard Contractual Clauses, together with the safeguards our providers have in place. If you are a business client and need these clauses executed as part of your own compliance, ask us and we will sign them.

7. How long we keep it

• Enquiries that do not become projects: 24 months from your last contact with us, then deleted.
• Client project records: for the length of the engagement and 7 years afterwards, which is the period Indian tax law requires us to retain financial records.
• Web server logs: retained by our host on their standard rolling schedule, typically a few weeks.
• Files you send us for a data-entry project: returned or securely deleted on completion, or on request, as set out in section 9.

8. Your rights

Wherever you are, you can ask us to:

• tell you what personal data we hold about you, and give you a copy;
• correct anything inaccurate;
• delete it, where we are not legally required to keep it;
• restrict or object to how we use it;
• send it to you, or to another provider, in a portable format;
• withdraw consent you have given, at any time, without affecting anything done before you withdrew it.

To exercise any of these, email privacy@lensowebdesign.com. We will respond within 30 days and we will not charge you for it.

If you are in California, you also have the right to know what we collect and why, the right to delete, and the right to opt out of the sale or sharing of personal information. We do not sell or share personal information, so there is nothing to opt out of, and we will never discriminate against you for exercising a right.

If you are in India, you may nominate another person to exercise your rights in the event of your death or incapacity, and you may raise a grievance with us at the address above before approaching the Data Protection Board.

9. Data we process for our clients

If you engage us for data entry, back-office support, CRM or automation work, you will often be handing us files that contain other people's personal data — your customers, your staff, your suppliers. In that arrangement you are the controller and we are your processor.

For that work we will:

• sign a Data Processing Agreement with you before the work starts, which we can provide;
• process the data only on your documented instructions;
• keep it confidential, and bind anyone working on it to confidentiality;
• not engage a sub-processor without telling you first;
• return or delete the data at the end of the engagement, at your choice;
• tell you without undue delay if there is a personal data breach affecting it, and help you meet your own notification duties.

10. How we protect it

• This site is served over HTTPS, and form submissions are encrypted in transit.
• Client files are held in access-controlled storage, shared only with the people working on your project.
• Accounts that hold client data use multi-factor authentication.
• We sign an NDA as standard on any project involving your data, before you send it.

No system is perfectly secure. If we ever suffer a breach that is likely to put your rights at risk, we will tell you and the relevant regulator without undue delay.

11. Children

This website is aimed at businesses and is not intended for children. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us their data, email us and we will delete it.

12. Changes to this policy

If we change this policy we will update the date at the top. Where a change materially affects your rights, we will say so clearly rather than quietly amending the text.

13. Complaints

If you are unhappy with how we have handled your data, please tell us first at privacy@lensowebdesign.com so we can put it right.

You also have the right to complain to a regulator: the Information Commissioner's Office in the UK, your national supervisory authority in the EU or EEA, or the Data Protection Board of India.

Cookie Policy · Terms and Conditions