Privacy Policy
This policy explains what personal data we collect when you contact us or use this website, why we collect it, how long we keep it, and the rights you have over it.
Last updated: 3 August 2026
Who we are
CDF Design is a trading name of Carmello & John Ltd, a company registered in England and Wales, company number 17159080. We are the data controller for the personal data described in this policy, and we are registered with the Information Commissioner's Office under reference ZC215392.
If you have any question about this policy or about your data, email [email protected].
What we collect
We only collect what we need in order to reply to you and to do the work you ask us to do.
| When you send an enquiry | Your name, company name, email address, phone number, and whatever you write in the message field. |
|---|---|
| When you email us directly | Your email address and the contents of your message. |
| When you become a client | Billing details, project information, and any account or content access you choose to share with us so we can carry out the work. |
| When you visit this website | Standard technical information such as IP address, browser type and pages visited, collected by our hosting provider for security and performance. Analytics are only collected if you accept them, and we use no advertising cookies at all. |
Why we use it, and our lawful basis
- To reply to your enquiry and prepare a quote. Lawful basis: legitimate interests, namely responding to someone who has asked us to get in touch.
- To carry out work you have commissioned. Lawful basis: performance of a contract.
- To keep records for accounting and tax. Lawful basis: legal obligation.
- To keep this website secure and working. Lawful basis: legitimate interests.
We do not send marketing emails unless you have asked us to. If we ever do, the lawful basis will be your consent and every message will carry a one-click unsubscribe.
What we never do
- We never sell your personal data. Not to anyone, for any amount.
- We never share your enquiry with third-party lead brokers or marketing lists.
- We do not run advertising trackers or profiling on this website.
Who we share it with
We use a small number of trusted suppliers to run the business. They only process your data on our instructions, under contract, and only as far as needed to provide their service. These include our website hosting and email providers, our accounting software, and payment processors if you become a client.
We may also disclose data if we are legally required to, for example by a court order or a regulator.
Where a supplier processes data outside the UK, we make sure appropriate safeguards are in place, such as UK International Data Transfer Agreements or adequacy regulations.
How long we keep it
| Enquiries that do not become work | Up to 12 months, then deleted. |
|---|---|
| Client project records | For the duration of the relationship and 6 years afterwards, to meet accounting and legal requirements. |
| Accounting records | 6 years, as required by HMRC. |
| Website server logs | Short-term only, as set by our hosting provider. |
How we protect it
This website is served over HTTPS. Access to enquiry data is limited to the people who need it, accounts are protected with strong authentication, and we keep the systems we control patched and backed up. No system is perfectly secure, but we take this seriously and we will tell you promptly if anything happens that affects your data.
Cookies
We use one thing that needs your permission: Google Analytics, so we can see which pages help people and which ones do not. It is switched off until you accept it. If you decline, nothing is stored on your device and the site works exactly the same.
We do not use advertising cookies, we do not sell anything about you, and there is no Meta or Facebook tracking on this site.
| What | Why | How long |
|---|---|---|
| Your cookie choice | Remembers whether you accepted or declined, so we stop asking. This one is set either way, because without it we cannot honour a decline. | Until you clear your browser storage |
| Google Analytics (_ga, _ga_*) | Counts visits and shows which pages are read. Only set if you accept. Google signals and ad personalisation are switched off. | Up to 2 years |
| Campaign tags | If you arrive from an advert or a link we shared, we keep the tag for the length of your visit so we know which one brought you. Only if you accept. | Until you close the tab |
You can change your mind at any time: change your cookie choice.
Your rights
Under UK GDPR you have the right to:
- Ask for a copy of the personal data we hold about you.
- Ask us to correct anything that is wrong or incomplete.
- Ask us to delete your data, where we have no continuing legal reason to keep it.
- Ask us to restrict how we use it, or object to us using it.
- Ask for your data in a portable format.
- Withdraw consent at any time, where consent was the basis we relied on.
To exercise any of these, email [email protected]. We will respond within one month. There is no charge.
If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk, or by calling 0303 123 1113.
Changes to this policy
If we change this policy we will update the date at the top of this page. If the change is significant, we will tell affected clients directly.
Contact
CDF Design, a trading name of Carmello & John Ltd (company 17159080)
Registered office: 4th Floor Office, 205 Regent Street, London, England, W1B 4HB
VAT number: GB 517 8015 94
Email: [email protected]
Phone: 020 3930 0359