Privacy Policy

Privacy Policy
Last updated: 05/08/2026

1. Introduction
Another Web is Possible ("AWIP", "we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard information when you visit our website.

2. Information We Collect

2.1 Contact Information
When you contact us through email or contact forms, we collect the information you provide, such as your name, email address, and any details included in your message. We use this information solely to respond to your enquiry.

2.2 Professional Services
If you engage us for consulting services, we will collect information necessary to provide those services as detailed in our separate service agreements.

2.3 Analytics Data
We use Umami, a privacy-focused, self-hosted analytics tool, to understand how visitors interact with our website. Umami does not use cookies, does not collect personal data, and does not track visitors across websites. The data collected is limited to anonymised usage information such as pages visited, referral sources, device type, and approximate location at country level. All analytics data is stored on our own servers and is never shared with third parties.

This website is built on Webflow and served via Cloudflare. Static assets may be delivered through third-party content delivery networks including Cloudflare, AWS CloudFront, and jsDelivr. These services process limited technical data such as IP addresses solely for the purpose of delivering website content. They are not used for analytics.

2.4 Newsletter
If you subscribe, we collect your name and email address and pass them to Buttondown, our newsletter platform, who store them and send the emails on our behalf. Buttondown is based in the United States. We also pass along any utm_source, utm_medium and utm_campaign values present in the URL when you signed up, so we can see which pieces of writing bring people in. These are trimmed to 120 characters before being sent.

Unsubscribe from any email and you're off the list. We don't keep a suppression record beyond what Buttondown needs to honour the unsubscribe.

2.5 Booking a call
The booking calendar on our contact page is an embedded service from neetocal. When that page loads, neetocal's own scripts run in your browser and their servers see your IP address, whether or not you book anything. If you do book, the name, email and any details you enter go to neetocal and to us. We didn't build that embed and we don't control what it loads. Their privacy policy governs their side of it.2.6 Spam prevention, and what Turnstile actually does

Both forms on this site are protected by Cloudflare Turnstile.
Turnstile works by examining your browser: what it supports, how it renders graphics, how it behaves.
That amounts to device fingerprinting, and we'd rather say so plainly than describe it as a security cookie and leave it there.

Cloudflare state that they don't use the data for cross-site tracking or advertising, and we've no reason to doubt them, but it is more than a cookie and you deserve to know. We use it because the forms were getting hammered by bots and the alternative was a CAPTCHA that makes you identify traffic lights, which is worse for you and worse for anyone using a screen reader.

If you'd rather not be fingerprinted, email jon@anotherwebispossible.co.uk directly.

We're reviewing whether we can drop it. If we find something that works without fingerprinting, we'll switch and update this page.

3. How We Use Your Information
Under UK GDPR we have to tell you why we're allowed to process your data. For each thing we do:
Responding to your enquiry: legitimate interests. You contacted us and expect a reply.
Providing consulting services: performance of a contract.
Sending the newsletter: consent, which you gave by subscribing and can withdraw with the unsubscribe link in every email.
Analytics: legitimate interests. We've weighed this against your privacy by choosing a self-hosted tool that sets no cookies and collects no personal data.
Spam prevention on forms: legitimate interests in keeping the site usable.
Meeting legal and accounting obligations: legal obligation.

Where we rely on legitimate interests you can object at any time, using the details in section 12.

4. Data Storage and Security
Contact information and correspondence are stored securely. We implement appropriate technical and organisational measures to protect your data against unauthorised access, alteration, or destruction. Analytics data is processed and stored on our own self-hosted infrastructure and is not shared with or processed by third-party services.

4.1 How long we keep things
Enquiries and correspondence: three years from our last contact, then deleted.
Client records: seven years after the engagement ends, which is what HMRC requires for the financial side.
Newsletter subscribers: until you unsubscribe.
Analytics: aggregated at collection, so there's nothing tied to you to delete. We keep the aggregate indefinitely.
Booking data: held by neetocal under their retention policy, and by us for three years.

5. Data Sharing
We do not sell, rent, or share your personal information with third parties for marketing purposes.
We may share information only with service providers who assist in our operations, when required by law or to protect our legal rights, or with your explicit consent.

5.1 International transfers
Some of our processors are outside the UK. Buttondown, Cloudflare, neetocal and Webflow are all US-based. Transfers rely on the UK International Data Transfer Addendum or on adequacy regulations, depending on the provider.

6. Your Rights
Under UK GDPR, you have the right to access personal information we hold about you, request correction of inaccurate information, request deletion of your information, object to processing of your information, request restriction of processing, and data portability.
To exercise these rights, please contact us using the details below.

7. Cookies
Umami sets no cookies. We use no analytics cookies and no advertising cookies. There is no cookie banner on this site because there is nothing to consent to.

Cloudflare sets a cookie for bot management and security. It's strictly necessary under PECR and doesn't require consent. Cloudflare Turnstile, described in 2.6, also examines your browser in ways that go beyond a cookie.

The neetocal booking embed on our contact page may set its own cookies when that page loads. Those are neetocal's, not ours.

We use sessionStorage for campaign parameters, covered in 2.7. It isn't a cookie and it's gone when you close the tab.

8. Third-Party Links
Our website may contain links to external sites. We are not responsible for the privacy practices of these third-party websites. We encourage you to review their privacy policies.

9. Children's Privacy
Our website is not intended for children under 16. We do not knowingly collect information from children.

10. Changes to This Policy
We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated revision date. Continued use of the website following changes constitutes acceptance of the updated policy.

11. Contact Us
If you have questions about this Privacy Policy or wish to exercise your data rights, please contact us.

12. Complaints
If you believe we have not handled your data properly, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

Website: https://ico.org.uk
Telephone: 0303 123 1113