Privacy Policy

Westbridge Limited ("Westbridge", "we", "us", "our") respects your privacy. This policy explains what personal data we collect when you use westbridgelimited.xyz or engage our services, why we collect it, and your rights under the UK GDPR and the Data Protection Act 2018.

1. Who we are

Westbridge Limited is a marketing and advertising firm registered in England and Wales (Company No. 17216146). Our registered office is 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. We are the data controller for personal data processed through our website and services. For any privacy enquiry, contact legal@westbridgelimited.xyz.

2. Information we collect

We collect personal data only where we have a lawful basis. Specifically:

2.1 Information you give us

• Account data when you register: name, email address, password (stored as a salted hash, never in plain text).
• Order data when you submit a purchase request: name, email, project description, selected service, payment method.
• Communications when you contact us via email, the contact form, or any other channel.

2.2 Information collected automatically

• Technical data: IP address, browser type and version, time-zone, operating system, device type. Used for security, fraud prevention and to deliver the site correctly.
• Usage data: pages visited, time spent, referring URL. Limited to what we need to keep the site working - we do not use third-party analytics that profile you across the web.
• Cookies and similar technologies: see our Cookie Policy.

2.3 Information from third parties

• Payment data from our payment processors (NOWPayments for crypto). We do not store full payment details on our servers - we only see transaction status, amount and order reference.

3. Why we use your data

We use your personal data to:

• Create and manage your account.
• Provide the services you ordered and process payments.
• Send transactional emails (order confirmations, payment receipts, password resets, security alerts).
• Respond to your enquiries and provide support.
• Keep records required by UK tax, accounting and anti-fraud laws.
• Detect, prevent and investigate fraud, abuse and security incidents.
• Improve the site and our services.

4. Legal bases for processing

Under UK GDPR Article 6, we rely on the following lawful bases:

• Contract (Article 6(1)(b)) - to deliver the services you order and operate your account.
• Legitimate interests (Article 6(1)(f)) - to keep our services secure, prevent fraud, communicate with prospects who reach out, and improve our offering. We balance this against your rights and freedoms in every case.
• Legal obligation (Article 6(1)(c)) - to keep accounting records and respond to lawful requests from authorities.
• Consent (Article 6(1)(a)) - for non-essential cookies. You can withdraw consent at any time via the cookie banner or your browser settings.

5. Who we share your data with

We share your personal data only with carefully selected service providers (sub-processors) who help us run the site and deliver our services. Each one is bound by contractual data-protection terms.

We do not sell or rent your personal data, and we do not share it for advertising. We may disclose data if legally required (court order, regulatory request, anti-fraud investigation).

6. International transfers

Some sub-processors operate outside the UK / EEA (mainly the US). When we transfer personal data outside the UK we rely on safeguards permitted by UK GDPR Articles 45-46:

• Adequacy decisions where available (e.g. for the EU and qualifying jurisdictions).
• Standard Contractual Clauses (UK IDTA / EU SCCs) with providers in countries without an adequacy decision.

7. How long we keep your data

• Account data - while your account is active and for up to 12 months after closure to handle disputes and comply with legal obligations.
• Order and payment records - 6 years from the end of the relevant tax year (HMRC requirement).
• Marketing communications - until you unsubscribe.
• Server logs - up to 90 days, then deleted or anonymised.

8. Your rights

You have the following rights under UK GDPR:

• Be informed about how we use your data (this policy).
• Access the personal data we hold about you.
• Have inaccurate data corrected.
• Have your data erased (where applicable).
• Restrict or object to processing.
• Receive your data in a portable format.
• Withdraw consent at any time (where consent is the basis).
• Lodge a complaint with the ICO.

See our GDPR Policy for detail on each right and how to exercise them.

9. Security

We apply reasonable technical and organisational measures to protect your data: HTTPS / TLS for all connections, password hashing, role-based access control, and reliance on sub-processors that provide encryption at rest by default (Supabase, Vercel). No system is perfectly secure, so we encourage you to choose a strong, unique password and notify us immediately if you suspect unauthorised access.

10. Children

Our services are intended for businesses and individuals aged 18+. We do not knowingly collect personal data from children. If you believe a child has given us their data, contact legal@westbridgelimited.xyz and we will delete it.

11. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top reflects the most recent version. For material changes (e.g. new categories of recipients), we will notify you by email or a prominent notice on the site.

12. Contact and complaints

For privacy questions or to exercise any of your rights, email legal@westbridgelimited.xyz.

If you are not satisfied with our response, you can lodge a complaint with the UK Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Phone: 0303 123 1113
• Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF