Legal
Privacy Policy
What reaches this company, what is done with it, how long it is held, and what you can ask for. Including the part most testing companies leave out: what is seen on your site while it is being tested, and what happens to it.
How to read the marks
Every clause below carries two marks: whether it bears on somebody buying as a consumer, outside any trade or business of their own, and whether it bears on somebody buying for a business. A good deal of what follows applies to one and not the other, and the 14-day right to cancel is the clearest case of it.
- Applies The clause holds for that kind of buyer as it is written.
- In part It holds with the limit the clause itself sets out. Read it rather than the mark.
- Does not apply It has no effect on that kind of buyer. Nothing is being taken away from anyone: it was never theirs.
Data protection law protects people, not organisations, so most of the clauses here fall on both sides of the table: a business is not a data subject, but everybody who writes from one is.
This edition
16 September 2026
The edition on this page is the one in force. A changed page is published here carrying a new date, and the edition that governs an order is the one in force on the day its confirmation was sent.
Who decides what happens to your data
The company below decides why and how the personal data described on this page is used. It is the controller for that data under the UK General Data Protection Regulation and the Data Protection Act 2018.
- Registered name
- WebGlory LTD
- Company number
- 17457459
- Registered in
- England and Wales
- Registered office
- 167-169 Great Portland Street, London, England, W1W 5PF
- Website
- webglory.org
- connect@webglory.org
What this notice covers
Personal data that reaches this company when somebody reads this site, sends a request through the form, writes by email, commissions a test run or pays an invoice.
It does not cover what happens on the site being tested. Your own site is yours: you are the controller for the data on it, your own privacy notice governs it, and nothing here displaces that. Clause P-05 sets out the separate question of what we may see on it while testing.
There is no account to open here, no login, no basket and no customer area.
What reaches us
- What the request form produces. Your name, your email address, the organisation you write for if you give one, the address of the site, the list of pages, the devices that matter to you, the shape of run you have in mind, your authorisation declaration and anything you add in the last box. The form is assembled in your own browser: pressing the button opens your own email application with the message already written. This website transmits nothing and has no server to transmit it to, so the request reaches us only when you send it yourself, from your own email account. Leaving the page discards it.
- What you write to us. Whatever is in an email, including anything you choose to attach.
- Access you give us. Where a site is behind a password, a staging login, a test account or a shared credential, we hold what you send us for as long as the run needs it. See P-06 for what happens to it afterwards.
- Order and payment records. The billing details on an invoice, what was agreed, what was delivered, and the fact and date of payment. Card numbers are not part of this: see P-09.
- Technical records of this site. Our hosting provider keeps ordinary server logs - the IP address a request came from, the date and time, the page asked for and the browser's own description of itself. They exist to keep the site up and to spot abuse, and they are not used to build a picture of anybody.
No cookies and nothing written to your browser
This site sets no cookies. It runs no analytics, no advertising tags and no tracking pixels, and it embeds nothing from anybody else: the typefaces are served from this site, so reading a page here sends no request anywhere else.
Nothing is written to your browser's storage either. That is why you are not asked to accept anything and why there is no panel of switches: there is nothing on your device to consent to under regulation 6 of the Privacy and Electronic Communications (EC Directive) Regulations 2003, and nothing to withdraw. The law does not require a separate cookie policy where there are no cookies, so there is not one.
What we see on your site while testing it
This is the clause that belongs to this trade rather than to a checklist. Testing a live site means opening it and using it, and a live site often has other people's personal data on it: an order in a basket, a name in an account area, a message in an inbox, an address in a delivery step.
- Where we can, we ask for a staging copy or test accounts, so that nothing belonging to a real customer of yours is seen at all. That is the first thing proposed in any quotation for a site that has a logged-in area.
- Where a live site is the only option, we work on the pages the order names and no further, and we do not search for, export, copy or keep any record found on it.
- Screenshots are part of the report, so anything visible on screen when a fault appears is in the picture. Where personal data would be in shot, it is obscured before the screenshot goes into the report, or the page is put into a state where it is not there.
- In that work this company is your processor, not a controller. We act on your written instructions for it, and where the work involves any real personal data on your site, the order carries the terms Article 28 requires.
Why it is held
- To answer a request and work out what testing your site would involve.
- To write and send a quotation.
- To carry out a run: to reach the pages, to record what is found and to write the report.
- To retest after fixes, which needs the original findings to still exist.
- To invoice, to take payment and to keep the accounting records the law requires.
- To keep this site available and to deal with abuse of it.
- To answer a complaint, and to bring or defend a legal claim if it comes to that.
Credentials are a special case and are treated as one. Any login, key or token you send is held only for the run it belongs to and is deleted when the run and its retesting are finished, or sooner if you ask. We ask you to change a shared password afterwards, and a quotation says so where credentials are involved.
None of this is used for marketing. There is no mailing list and no newsletter.
The lawful bases, one by one
- A contract, and the steps before one. Article 6(1)(b). Requests, quotations, the correspondence around an order, running the tests, delivering the report, retesting, and answering questions about any of it.
- A legal obligation. Article 6(1)(c). Invoices and accounting records are kept because company law and tax law require them to be kept.
- Legitimate interests. Article 6(1)(f). Three of them, each named rather than left vague: keeping this site available and free of abuse; keeping a durable record of what was quoted, agreed, found and delivered, so a disagreement can be settled by looking at it rather than by recollection; and dealing with complaints and legal claims. The interest is being able to show what was agreed and what was done. We have weighed that against the people concerned and consider it does not override them, because nothing here goes beyond ordinary business correspondence held for a stated period. You can object, and P-12 says how.
Consent is not relied on for any of this, and none of it is a condition of anything else. If consent is ever asked for something new, it will be asked for in plain words and may be withdrawn at any time, with no effect on anything done before.
Whether you have to give us anything
There is no obligation, in law or in contract, to give us anything at all. You may read every page of this site without telling us who you are.
The limits are practical ones. Without a name and an address to reply to we cannot answer. Without the address of a site and a list of pages we cannot quote. Without the authorisation declaration nothing can be run at all. Not supplying any of it means there is no order, and there is no other consequence.
Who else handles it
- The hosting provider that serves this site and keeps its server logs.
- The email provider that carries our correspondence.
- The payment providers behind an invoice or a payment link, which are Stripe and PayPal. Card details are entered on their own pages and go to them, never to us: we see that a payment was made, by whom and for what, and nothing more. They are controllers in their own right for the payment itself, under their own terms.
- An accountant, and where a matter needs it, professional advisers or insurers.
That is the whole list. Nothing is sold, nothing is shared for advertising and nothing goes to a data broker. The hosting and email providers are named in writing on request.
Outside the United Kingdom
We do not send personal data out of the United Kingdom ourselves. Some of the providers in P-09 are international companies, and data may be processed by them outside the UK.
Where that happens the transfer rests either on adequacy regulations made by the Secretary of State, or on the International Data Transfer Agreement or Addendum issued by the Information Commissioner, with whatever further safeguards those require. Ask, and we will tell you which arrangement applies to a particular provider.
How long each kind of record is kept
Records are not kept indefinitely. Each kind has a period, and it runs from the event beside it.
| Record | Kept for | Why that long |
|---|---|---|
| A request that does not become an order | 12 months from the last message | A request often comes back later, and the earlier thread saves repeating it |
| Correspondence and the order record for a run | 6 years from the end of the contract | The period in which a claim on a simple contract may be brought in England and Wales (Limitation Act 1980, section 5) |
| Invoices and accounting records | 6 years from the end of the accounting period they fall in | Required by company law and by HMRC |
| Reports, findings and their screenshots | 24 months after the run, unless the order says otherwise | So a retest, or a later run on the same site, can be measured against what was found before |
| Logins, keys and test-account credentials | Deleted when the run and its retesting are finished, or sooner on request | They are the most sensitive thing we hold and the least useful to keep |
| Server logs of this website | The period the hosting provider sets for its own security retention, confirmed in writing on request | Security and diagnosis only; they are not copied anywhere else |
At the end of a period the record is deleted, or the personal details in it are removed so that what is left identifies nobody. Where you ask for something to be deleted sooner and it may lawfully be deleted, it is deleted sooner.
What you can ask for
These rights are yours over your own personal data. Write to connect@webglory.org to use any of them.
- Access. A copy of the personal data held about you, and an explanation of what is done with it.
- Rectification. Correction of anything inaccurate, and completion of anything incomplete.
- Erasure. Deletion, where there is no longer a good reason to keep it.
- Restriction. A pause on using it, for instance while a disagreement about its accuracy is settled.
- Objection. An objection to anything done on the footing of a legitimate interest. We then stop, unless we can show grounds that override yours or the data is needed for a legal claim.
- Portability. The data you gave us, in a structured, commonly used, machine-readable form, sent to you or to someone you name where that is technically feasible.
- Withdrawing consent. Where consent is ever the basis for something, withdrawal at any time, with no effect on what was done while it stood.
We answer within one month. A request that is complex, or one of several, may take up to two months longer; if that happens we say so inside the first month and say why. There is no charge, unless a request is manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse it and give the reason. We may ask for enough information to be satisfied who you are, and for nothing beyond that.
None of these rights is absolute. An invoice the law obliges us to keep cannot be deleted, and where a right does not apply to something we say so and say why.
No automated decisions and no profiling
Every reply, every quotation, every finding and every priority is decided by a person. There is no automated decision-making producing legal or similarly significant effects, of the kind Article 22 deals with, and no profiling.
Nothing on this site scores, ranks, sorts or categorises the people who read it.
Keeping it safe
Correspondence, reports and screenshots sit in accounts with long, unique passwords and two-step sign-in where the provider offers it, on devices with encrypted storage. Credentials you send are kept apart from the rest and deleted as P-11 says. Access is kept to what the work requires. This site is served over an encrypted connection and holds no personal data of its own, because it has no database and no backend.
No arrangement is proof against everything. If a breach happens that is likely to put somebody's rights at risk, it is reported to the Information Commissioner within 72 hours of our becoming aware of it, and the people affected are told where the law requires it.
Complaining, to us and to the regulator
Tell us first if you can: write to connect@webglory.org and we will look into it and answer. Coming to us first is not a condition of anything, but it is the quickest way to have something put right.
You may complain to the Information Commissioner's Office at any time, whether or not you have raised it with us.
Information Commissioner's Office Wycliffe House Water Lane Wilmslow Cheshire, SK9 5AF ico.org.ukThis edition, and writing about it
This notice is dated 16 September 2026.
A changed notice is published on this page carrying a new date, and the version on the page is always the one in force. Where a change materially affects how data about you is used and we hold an address for you, you will be written to before it takes effect rather than left to notice it.
Questions about anything on this page, and any of the requests in P-12, go to connect@webglory.org or by post to the address in P-01. WebGlory LTD is not required to appoint a data protection officer and has not appointed one, so there is no separate office to write to: a message to that address reaches whoever decides these things.