Privacy notice · updated 16 August 2026
Useful data. Clear purpose.
Foundry Works Ltd, trading as Hello Foundry, is the controller for the personal information described here. Questions or rights requests can be sent to [email protected].
What we collect
When you apply for the Free Website Programme we collect the authorised contact’s name, role, work email, phone number, business details, location, current website status, brand and content inputs, website goals, domain plan, supplied links and assets, agreement confirmations, submission times and a privacy-preserving network reference used for security and evidence. We do not ask for payment-card details.
Why we use it
- To assess the application and take steps requested before agreeing a build.
- To create the business, contact, opportunity, communications and delivery records needed to administer the programme.
- To generate the build brief and applicant agreement, confirm scope and schedule accepted work.
- To protect the forms, prevent abuse, resolve failures and keep an audit trail.
- To send general marketing only when the applicant has made the separate optional marketing choice.
Our legal bases are taking steps at your request before a contract, performing any accepted agreement, and our legitimate interests in operating, securing and evidencing the programme. Consent is used for optional email marketing and can be withdrawn at any time.
Who receives it
Application records are handled in Foundry’s CRM and ClickUp delivery workspace. Cloudflare processes web requests. A minimal operational alert is sent to Jason’s private Telegram chat for each submission. The approved-email workflow and its delivery provider process an onboarding email only after human approval. Suppliers act under their own terms and, where applicable, data-processing arrangements. We do not sell applicant data.
How long we keep it
Incomplete or declined applications are normally removed or anonymised within 12 months. Accepted briefs, agreement evidence and delivery records may be kept for up to seven years after completion where needed to establish the agreed scope, comply with law or resolve a claim. Security logs are normally kept for no more than 90 days. Optional marketing records remain until consent is withdrawn or the record is removed through routine inactivity review.
Your rights
Depending on the circumstances, you may ask for access, correction, deletion, restriction, portability or an objection to processing. You can withdraw marketing consent at any time without affecting earlier lawful use. We may need to verify identity before acting. You may also complain to the UK Information Commissioner’s Office at ico.org.uk.
International processing and security
Some suppliers may process data outside the United Kingdom. Where required, we rely on recognised safeguards such as adequacy regulations or approved contractual protections. We use access controls, signed onboarding links, restricted documents and approval gates, but no internet service can promise absolute security.
About the onboarding link
The link is signed, expires after 14 days and contains the application reference, business name and work email needed to connect the brief to the correct record. Do not forward it. The onboarding page is marked noindex, noarchive and no-referrer, and it does not load Google Analytics.
Marketing is optional. Declining the marketing box does not affect the application. We will still send service messages needed to process a submitted application.
Return to the Free Website Programme · Read the programme terms