Privacy Policy
Version: 2026-10-13. This notice explains what happens to your information when you use the Buka Web Agency website, send us a brief or become a website rental customer.
1. Who is responsible for your data
Burak Kahriman trading as Buka Web Agency. Correspondence address — no customer visits: 118 Warham Road, London N4 1AU, United Kingdom. Contact: [email protected].
2. What we collect and why
| When | What | Why and lawful basis |
|---|---|---|
| You send a request through a form on this website (proposal request, quick offer or website rental enquiry) | What you type into the form: for example your name, email address, phone number, business name, website address, what you are interested in and your message | To respond to your request and prepare a proposal or quote (steps before a contract). |
| You send the short brief | Business name, what the business does, the area you serve, your current website address if given, your main goal, your email address, and your optional marketing choice | To respond to your request and prepare your website project (steps before a contract). Marketing emails only if you tick the separate, unticked box (consent). |
| You order a website rental on this website | Your business name, your name, email address and optional phone number; which version of the terms and of the offer you accepted, the time of acceptance, your rental confirmation and your separate marketing choice; a technical record of the browser used and a keyed hash of your IP address (not the address itself); the status of your payment and Direct Debit as GoCardless reports it | To take your order and payment, evidence what was agreed (contract) and keep business and tax records (legal obligation). Marketing emails only if you tick the separate, unticked box (consent). |
| You complete the brief after payment | Your answers to the brief and any logo or photos you upload. They are saved with your order on our order server, not in your browser | To plan and build your rented website (contract). |
| You become a customer | Contact details, the content, photographs, services and brand files you supply, access details you share for your domain or email, correspondence and the project record, invoices and payment records | To deliver and support the rented website (contract) and to keep business and tax records (legal obligation). |
| You visit this website | Technical data processed by our hosting and content-delivery providers (IP address, browser type, requested pages) and your cookie choice | To run and secure the website (legitimate interests). Optional analytics (Google Tag Manager and Google Analytics 4) and marketing measurement (Meta Pixel) run only with your choice; see the Cookie Policy. |
We do not ask for sensitive or unnecessary personal data in the brief. Please do not send passwords in the form; access details are agreed separately.
3. Who handles data with us
Providers are listed by their legal role. Tools that receive no personal data (for example the software that runs our server) are not listed.
| Provider | Role | What they do and which data |
|---|---|---|
| IONOS | Processor | Hosts this website, our order server and the websites we rent to customers: technical connection data, orders, confirmation records and briefs, and customer website content |
| Cloudflare, Inc. | Processor | Security and content delivery in front of this website: technical connection data (IP address, browser, requested pages) |
| Google (Google Workspace) | Processor | Our business email: your emails and attachments |
| Web3Forms (Web3Creative, India) | Processor, under its data processing addendum | Delivers the forms on this website to our email: the fields you submit, your IP address and the time. Web3Forms keeps submissions for up to three years and uses its own sub-processors (for example AWS, Cloudflare and spam filtering services) |
| Google (Google Tag Manager) | Processor | Loads only after you accept Analytics or Marketing, and then starts only the tags your choice allows. Loading it sends Google the technical connection data needed to deliver it (such as your IP address and browser) |
| Google (Google Analytics 4) | Processor | Optional analytics, only after you accept Analytics: pages visited and actions such as a form being sent. If you accept only Marketing, nothing is sent to Google Analytics. Names, email addresses, phone numbers and what you type into forms are not sent to analytics |
| Meta Platforms (Meta Pixel) | Joint controller with us for collecting and sending the data; Meta is a controller for its own later use | Optional marketing measurement, loaded only after you accept Marketing: page views and enquiry events. No personalised advertising is switched on |
| AI tools: ChatGPT (OpenAI), Artlist, Claude (Anthropic) | Software provider we use | Help us plan and write website content, prepare images and video, and build websites. When a task needs it, we upload customer briefs, content drafts and photos, which can include personal information. Our working rule is to upload only what the task needs and to remove other personal details first, and never to upload passwords, payment details or access keys. Our ChatGPT business workspace is set so that OpenAI does not use its data to train its models (checked 13 October 2026). |
| GoCardless Ltd | Independent controller (its own privacy notice applies) | Takes the first payment from your bank and sets up the Direct Debit for the monthly payments, on its own secure pages: your name, email address and the bank details you enter there; the payment and mandate status. We see only what GoCardless shares with the businesses it collects for (for example the account holder name and the last digits of the account number), never your full bank details or your bank login. |
4. Your website's visitors
For the websites we build and host for customers, the customer is the controller of their own visitors' data and we act only on the customer's instructions as their processor. The customer's own privacy notice covers their visitors.
5. How long we keep information
We keep personal information only for as long as we need it for the purpose we collected it for, and then delete it:
| Information | How long | Why |
|---|---|---|
| Invoices, payments and other accounting records | At least 5 years after the 31 January filing deadline of the tax year they belong to | UK tax rules for self-employed records |
| Your order, the terms and offer version you accepted, your confirmation record and our correspondence about the contract | 6 years after the rental ends | The time in which a contract claim can be made |
| Your brief answers, logo, photos and other content you supply | For the rental, then 3 months, after which we delete them unless you ask us to return them | To build and run your website; the short period allows a restart or a handover |
| Enquiries and briefs that do not lead to an order, and orders that are never paid | 12 months | To answer follow-up questions |
| Your choice about marketing emails | While we send you marketing; if you say no or withdraw, we keep only your email address and the date on a do-not-contact list, so that we never email you again | Information Commissioner's Office guidance on respecting people's preferences |
| Analytics data in Google Analytics (only with your choice) | 14 months | The retention set in our analytics account |
| Personal data on the websites we rent to customers (for example their visitors' form messages) | As the customer instructs; returned or deleted at the end of the rental | Website rental terms, section 15 |
6. International transfers
Where a provider may process data outside the UK, this is the safeguard it names in its own terms:
- IONOS: its processing terms say processing takes place in the UK or another country of the European Economic Area. Its listed support providers in the European Union and Switzerland are covered by the UK's adequacy regulations; Cloudflare as below.
- Cloudflare: the EU Standard Contractual Clauses with the UK Addendum, and the UK Extension to the EU–US Data Privacy Framework.
- Google (Analytics, Tag Manager): the UK Extension to the EU–US Data Privacy Framework, with Standard Contractual Clauses as a fallback.
- Google Workspace: the UK Extension to the EU–US Data Privacy Framework, with the EU Standard Contractual Clauses and the UK International Data Transfer Addendum as a fallback (Google Cloud Data Processing Addendum).
- Meta: Meta's UK Data Transfer Addendum (the international data transfer addendum to the EU Standard Contractual Clauses).
- AI tools (ChatGPT, Artlist, Claude): these providers can process data outside the UK. We limit what we upload to them as described in section 3.
- Web3Forms: the EU Standard Contractual Clauses with the UK Addendum (Web3Forms data processing addendum, section 10).
- GoCardless: as an independent controller, GoCardless is responsible for its own transfers under its privacy notice.
7. Your rights
You can ask for a copy of your data, ask us to correct or delete it, object to or restrict processing, and withdraw marketing consent at any time by emailing [email protected]. You can complain to the Information Commissioner's Office at ico.org.uk.
8. Cookies
See the Cookie Policy. You can change your choice at any time from the footer link.
9. Changes
This notice is dated above. We will update it when the way we use data changes.
