Last updated: 16 Aug 2026
This policy explains what personal data PerrfectSite collects, why, how long it is kept, and what rights you have over it. It covers the website at perrfect.site and the working relationship that follows an enquiry.
Clients and visitors come from several countries, so this policy is written to the standard of the General Data Protection Regulation as it applies in the European Union and in the United Kingdom. Where local law grants stronger rights than those described here, the local law applies.
Who is responsible
PerrfectSite Ltd, [692-696, Stratford Road, Sparkhill, Birmingham, England, B11 4AT], is the data controller for the information described here, with operations in [the United Kingdom, Romania, and Hungary].
SC CURCUBEUL SRL, [Tomis 2, Brasov, Romania], is the data controller for the information described here, with operations in [the Romania, and Hungary].
Company number 15958820. Data protection registration [ZC008445].
Questions and data requests go to [email protected].
Controller or processor
Two different situations apply, and the distinction matters.
For enquiries, calls, and everything on this website, PerrfectSite acts as the controller. The purposes and methods described below are decided here.
For client project work, PerrfectSite usually acts as a processor. When a website or an application is built, maintained, or migrated, the client remains the controller of the personal data inside their systems, and PerrfectSite handles it only under written instruction. Those arrangements are set out in a data processing agreement rather than in this policy.
What gets collected
Contact form and email
The contact form collects a name, an email address, and whatever is written into the message field. A phone number and a company name are optional.
Anything sent by email is retained in the mailbox it arrived in.
Files shared through the site
Documents, briefs, and assets uploaded through the site are stored on PerrfectSite infrastructure for the purpose of the project or enquiry they relate to.
Uploading personal data belonging to third parties, such as a customer database or staff records, should be arranged separately rather than sent through a web form. Ask before uploading anything of that kind and a controlled route gets set up.
Please do not send sensitive material through this route. The upload form is built for project briefs and design assets. Health records, financial account details, identity documents, credentials, and personal data belonging to your customers or staff should never be sent through it.
Anything of that kind arriving without a prior arrangement is deleted rather than stored, and the sender is told. Material disclosed accidentally, outside an agreed transfer route and without being requested, is handled carefully and removed promptly, though responsibility for the consequences of that disclosure sits with the sender.
Calls
Calls are recorded only with consent, requested at the start of the call. Declining changes nothing about how the conversation proceeds.
AI notetaking is treated the same way. Consent is requested separately from consent to record, because they are separate things. A call can be recorded without AI notes, and notes can be taken by a person instead.
Recordings and transcripts exist to capture requirements accurately rather than to monitor anyone. Consent given at the start of a call can be withdrawn afterwards, and the recording gets deleted on request.
Website measurement
Site statistics are collected through a first-party tool that sets no cookies, alongside Google Analytics which runs only with consent. The Cookie Policy covers this in detail.
Why, and on what lawful basis
| Purpose | Data | Lawful basis |
|---|---|---|
| Responding to an enquiry | Contact details, message content | Legitimate interests, and steps prior to a contract |
| Delivering a project | Contact details, files, correspondence | Contract |
| Recording a call | Voice recording, transcript | Consent |
| AI notetaking | Transcript, generated summary | Consent |
| Analytics beyond first-party statistics | Usage data | Consent |
| Invoicing and accounting records | Billing details, transaction records | Legal obligation |
| Keeping systems secure | Access logs | Legitimate interests |
Where consent is the basis, it can be withdrawn at any time without affecting anything that happened before the withdrawal.
Who can see it
Access follows need rather than seniority. A person working on a project sees what that project requires.
Every employee and every contractor has signed a non-disclosure agreement before being granted any access. No exceptions and no verbal arrangements. Those obligations continue after an engagement ends, so someone who finished a project two years ago remains bound.
Personal data is never sold, rented, or shared for anyone else’s marketing.
Third parties involved
| Provider | Role | Location |
|---|---|---|
| [Kinsta] | Website hosting | [EU or UK region] |
| [Sevalla] | Application and file hosting | [region] |
| Analytics and appointment booking | US, with transfer safeguards | |
| [Email provider] | Business email | [region] |
| 1Password | Credential storage | [region] |
| Infisical | Environment secrets | [region] |
| [Payment and accounting provider] | Invoicing and payment processing | [region] |
| Other providers agreed per project | Whatever a specific engagement requires | Varies |
Some projects need tools beyond the list above, such as a customer relationship system, an email delivery service, or a payment gateway chosen by the client. Providers of that kind are introduced only where the work requires them and the client has agreed in writing, and they are named in the agreement covering that project rather than added quietly here.
Where a transfer leaves the European Economic Area or the United Kingdom, it relies on the safeguards the provider has in place. That means an adequacy decision where one exists, and otherwise the European Commission’s Standard Contractual Clauses together with the UK International Data Transfer Addendum.
Providers are selected with data protection terms in mind and are bound by their own processing agreements. The list gets updated when it changes.
AI and personal data
Client data is never used to train, fine-tune, or improve any AI model, and vendor settings permitting retention for model improvement are turned off.
Personal data, credentials, and confidential material do not go into AI tools. Where a task genuinely requires processing sensitive material with AI, it happens under written client consent on models running on internal hardware with no external inference provider involved.
Full detail sits on the AI Responsibility page.
How long things are kept
| Data | Retention |
|---|---|
| Enquiry that did not become a project | 5 years from last contact |
| Client project records and correspondence | 5 years after the relationship ends |
| Call recordings and transcripts | 5 years, or until deletion is requested |
| Files uploaded through the site | 5 years, or until deletion is requested |
| Invoices and accounting records | As required by the tax law of each country of operation |
| Analytics data | As set out in the Cookie Policy |
Anything past its retention period is deleted rather than archived indefinitely.
Security
Devices are company-managed and encrypted, access runs through named accounts with the minimum permissions a role requires, and credentials are held in a password manager rather than shared over chat or email.
The practical detail, including how to verify that a message really came from PerrfectSite, is on the security page.
Your rights
Under the GDPR and its UK equivalent you can ask for a copy of the personal data held about you, ask for it to be corrected, ask for it to be deleted, ask for processing to be restricted, object to processing based on legitimate interests, ask for your data in a portable format, and withdraw any consent previously given.
Residents of other jurisdictions have comparable rights under their own laws. Requests from anywhere are handled the same way rather than assessed against where someone happens to live.
Requests go to [email protected] and receive a response within 7 days. A complex request may take longer to complete, and never longer than the one month the law allows. No charge applies in ordinary circumstances.
If a request concerns data held on behalf of a client, it gets forwarded to that client, since they are the controller in that situation.
Complaints
Anyone unsatisfied with how a request was handled can complain to a data protection supervisory authority, normally the one for the country where you live or work.
In the United Kingdom that is the Information Commissioner’s Office at ico.org.uk. Within the European Union, each member state has its own authority, and the European Data Protection Board publishes the full list.
Raising the matter directly first is welcome, and usually faster.
Children
This site is not directed at children, and personal data relating to children is not knowingly collected.
Changes
Any change to this policy updates the date at the top. Material changes affecting an existing relationship are communicated directly rather than published quietly.