Your details.Used for the conversation you started.

01 / Who is responsible

Who we are

Hexlay Ltd is the controller of personal information collected through this website.

02 / What and why

Information we collect and how we use it

Our enquiry forms collect your name, email address, message and, where you provide them, your phone number, business name and selected plan. Free-text answers may also include your website, service area, project timing and the commercial context you choose to share. Web3Forms may also process technical information such as an IP address, timestamp and referrer to deliver and protect the form.

We do not use form details for unrelated marketing, sell them or make decisions about you using solely automated processing. Fields marked as required are not required by law, but without them we may be unable to understand or answer the enquiry.

03 / Processors and transfers

Who receives the information

Web3Forms, operated by Web3Creative, processes website submissions for Hexlay and forwards them to our email. Its current Data Processing Agreement lists infrastructure and anti-spam providers including Amazon Web Services, Cloudflare, Hetzner, CleanTalk and Akismet.

Web3Creative operates from India and its providers may process information in the United States and other countries. Its agreement incorporates the Standard Contractual Clauses and the UK International Data Transfer Addendum for transfers that require them. You can read the Web3Forms Data Processing Agreement.

We may also disclose relevant information to professional advisers, IT providers or public authorities when reasonably necessary or legally required. We do not sell personal information.

Vercel hosts this website and provides privacy-focused Web Analytics. It processes aggregate page-view and event information for Hexlay. We configure custom events so names, email addresses, phone numbers and free-text form answers are not sent to the analytics service.

If you accept measurement, Google Tag Manager may load Google Analytics and Google Ads conversion tags for Hexlay. Google may then process consent state, page and referrer information, campaign and ad-click identifiers, and device or browser information. We do not place names, email addresses, phone numbers, business names or enquiry messages in analytics events or the tag-manager data layer, and we do not use Google user-provided-data matching for those contact details. Google processes measurement information under its applicable service and data-processing terms. Google operates infrastructure globally and says it uses applicable adequacy mechanisms, the UK Extension to the EU–US Data Privacy Framework and Standard Contractual Clauses for relevant international transfers. See Google’s advertising and analytics transfer information.

04 / Retention

How long we keep it

• Ordinary enquiries that do not become client work: up to 12 months after the last meaningful contact.
• Client, contract, project and invoice records: normally up to six years after the relationship ends where needed for tax, accounting or legal claims.
• Web3Forms states that submission data has a maximum three-year time-to-live, with shorter visibility or deletion available depending on the account and service settings.
• Google Analytics user-level and event-level data is set to a 14-month retention period. Google states that this control does not govern its standard aggregated reports. We review advertising conversion records at least annually and remove account data we no longer need.
• Consented first-touch campaign attribution stored by this site expires 90 days after it is first captured, or sooner if you choose Essential only.

We may keep a specific record for longer where the law requires it or it is reasonably needed to establish, exercise or defend a legal claim.

05 / Your choices

Your data protection rights

Depending on the circumstances, you may ask for access to your information, correction, deletion, restriction, objection or a portable copy. Some rights are limited where we must keep information by law or need it for a legal claim.

You have the right to object to processing based on our legitimate interests. Tell us what you object to and why, and we will review the request.

Email hello@hexlay.co.uk to exercise a right. We may need to confirm your identity. You can also complain to the Information Commissioner’s Office. We would welcome the chance to address the issue first.

06 / Website tracking

Analytics, cookies and updates

We use Vercel Web Analytics to understand aggregate visits and key actions such as a project link being selected or an enquiry form succeeding. Vercel states that this service does not use third-party cookies, permanently identify a visitor, or associate a page view with an IP address. It may process the page path, filtered query parameters, referrer, approximate country, device and browser details for aggregate reporting.

Vercel Web Analytics remains active when you choose Essential only because it is cookie-free aggregate measurement. Custom analytics events are limited to defined actions and do not include your name, contact details or free-text form answers.

If you choose Accept measurement, the site may load Google Tag Manager with Google Analytics and Google Ads conversion measurement. The site also uses local browser storage to keep the first landing-page path, referring website origin, campaign labels and ad click identifiers for up to 90 days from first capture. URL query strings and full referrer paths are excluded. Personalised advertising remains disabled. Essential only prevents the initial Google tag request, leaves persistent campaign storage off and removes attribution previously stored by this version of the site.

Before you choose, the same non-contact campaign context may be held only in page memory so accepting later during the same open visit does not lose the original landing. It is not written to browser storage or sent to Google before consent, and disappears when the page is reloaded or closed. If you choose Essential only, this transient copy is not used unless you later accept measurement during that open visit.

We keep your measurement choice in local browser storage so we can respect it on later visits. This preference is essential storage: it contains only “granted” or “denied”, and you can change it at any time through the Privacy choices button. If you submit an enquiry without accepting measurement, the current page path and referring website origin may still accompany the form, but campaign labels and advertising click identifiers are marked as not consented and are not sent with the submission.

Before you choose, Google Analytics, Google Tag Manager and advertising measurement tags are not requested. Accept measurement permits analytics storage, advertising measurement storage and the use of consented ad-click data for conversion reporting. We keep Google ad personalisation denied and do not use the choice to build cross-site behavioural advertising profiles. You can withdraw the choice through Privacy choices at any time; if Google tags were already loaded, the site reloads with those tags blocked. Google Analytics may set first-party _ga and _ga_* cookies with an expiry of up to two years, and advertising measurement may set _gcl_*cookies for up to 90 days. Browser policies or our Google configuration may shorten those periods. Withdrawing does not erase measurements Google has already received, and existing Google cookies may remain until they expire or you clear them in your browser. Google publishes a fuller advertising and measurement cookie list.

We review this notice when our forms, providers or uses of personal information change. The latest version is published on this page.