Your privacy

Privacy policy

Updated 31 October 2026

This notice explains how your information is handled when you browse welengoda.com or contact me about digital marketing services. It covers the UK GDPR and, where applicable, the EU GDPR.

Who is responsible?

Amila Welengoda, an independent digital marketing strategist based in Bedford, United Kingdom, is the controller of the personal information described here. For privacy questions or requests, email amila@welengoda.com.

Information collected and why

The enquiry form asks for your name, email address and message. I also receive anything you choose to send by email. Please avoid sending sensitive personal information. Providing this information is voluntary, but I need contact details to reply.

I use enquiries to answer questions and discuss potential work. This is based on my legitimate interest in managing business enquiries, or taking steps at your request before a contract. Client work is processed to perform our agreement. Records required for tax or other statutory duties are processed to meet legal obligations. I do not add enquiry contacts to marketing lists automatically.

Hosting and form providers may process technical information, including IP addresses, request times and browser information, to deliver and protect the service. The purpose is reliable operation and prevention of misuse. This site does not use automated decisions with legal or similarly significant effects.

Cookies and browser storage

This version of the website does not install analytics or advertising cookies, tracking pixels or embedded social-media feeds. Fonts, illustrations and platform icons are hosted with the website. LinkedIn receives a visit only when you follow its link.

When you choose “Got it” in the cookie notice, a first-party local-storage entry named aw-privacy-notice-v1 remembers that choice for six months. It contains a version and expiry time, not your enquiry. It is used only to remember your requested notice setting. You can reopen the notice using “Cookies & privacy” in the footer, or remove the saved setting there. Your browser settings also let you clear site storage.

No optional tracking is enabled by dismissing the notice. If optional tracking is introduced later, this notice and the controls will be updated and any required consent obtained before it starts. Infrastructure providers may use essential security technologies to serve and protect their services.

Service providers and international processing

Enquiries are sent to Formspree for processing and delivery to my email inbox. Formspree may also process technical request information for security and service operation. Its infrastructure includes the United States. Hosting and email providers also process information needed to run the website and handle correspondence.

International processing can be subject to different laws. Applicable transfer arrangements depend on the provider and account terms. Contact me for details of the safeguards applying to your information. I do not sell your personal information. Information may also be disclosed where required by law or necessary to establish or defend legal claims.

How long information is kept

My retention policy is to keep enquiry correspondence for up to two years after the enquiry or the end of a subsequent working relationship, whichever is later. Client business records are kept for six years after the relationship ends where needed for accounting or legal purposes. Information no longer needed is deleted or anonymised, subject to any legal requirement to retain it. Copies in the form service, email system and backups must be managed under this policy.

Your choices and rights

Depending on the circumstances, you can request access to your information, correction, deletion, restriction of processing or a portable copy. You can object to processing based on legitimate interests. Where consent is used, you can withdraw it without affecting earlier lawful processing.

Email amila@welengoda.com to exercise your rights. I may need to verify your identity. Requests are normally answered within one month. Some rights have legal exceptions, and any permitted extension will be explained.

You may complain to the UK Information Commissioner’s Office. If EU GDPR applies, you can also complain to the supervisory authority in the EU country where you live, work or believe an infringement occurred.

Security and updates

Reasonable technical and organisational measures are used to protect information. No online transmission or storage system is completely risk-free. This service is intended for business enquiries, rather than children. If a child has supplied information, contact me so it can be reviewed and removed where appropriate.

This notice will be updated when the website or its processing changes. The date above identifies the latest revision.