Website privacy and cookies pack for a tradesperson

A trade website is a quote form, a phone number, a gallery of jobs and a review widget, built on a hosted platform or by a local developer, with analytics and a call-tracking script the marketing company added; each of those collects personal data or sets a cookie, and the business is responsible for all of it. The pack gives the business the privacy notice, the cookie notice and the consent guidance drafted for a trade site, with a note on the practical steps for a business that runs from a phone and a van. For £595, fixed, with delivery in five working days, I draft the privacy notice and the cookie notice for the business and set out how the consent mechanism should work.

Who this is for

Plumbers, electricians, builders, roofers, decorators, gardeners, cleaners and other trades in England and Wales with a website that generates enquiries, whether built by a platform, a local developer or a marketing company.

What matters in a tradesperson's website pack

What a trade site collects and the pack that covers it

Being the controller, the business is required by Article 13 of the UK GDPR to tell enquirers and customers what it does with their data, and a trade site collects enquiry and quote details (name, address, phone, the job), callback requests, photographs the customer uploads of the problem, booking details where the site books, and the device and usage data the analytics and call-tracking scripts record; the pack's privacy notice describes each with its basis (the steps before a contract under Article 6(1)(b) for quotes, legitimate interests under Article 6(1)(f) for the site's operation and security, consent for marketing and cookies), the cookie notice lists what the site sets, and the consent guidance makes the banner work.

Quote forms, callbacks and call tracking

The quote form should collect what a quote needs and link to the notice, the callback request should say when the business will call and that the number is used for that, and call-tracking scripts (which swap the displayed number so that the marketing company can attribute calls, and record which visitor called) set cookies and process the caller's number, which the cookie notice should list and the privacy notice should explain, naming the marketing company as a processor; call recording, where the business or its answering service records calls, needs the caller told at the start and a retention period, which the notice should state.

Review widgets, directories and the data they pass

Review platforms embedded on the site load the platform's scripts and cookies, and the review invitations the business sends pass the customer's name and email to the platform as a controller for the review it publishes; trade directories and lead generation sites pass enquiries to the business under their own notices and keep their own copy; and the business should name the categories in the privacy notice, say what each receives, and make sure the review invitation is covered (a review request that promotes the business is marketing under regulation 22 of the Privacy and Electronic Communications (EC Directive) Regulations 2003, needing consent or the soft opt-in, which a customer who has just had the work done usually supplies).

The builder, the booking tool and the banner

Regulation 6 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 requires consent before non-essential cookies and similar technologies are placed, and the consent guidance covers the banner the builder provides or a consent tool, configured to block analytics, call tracking, marketing and embedded-content cookies until consent, with reject as prominent as accept and the choice recorded; the booking tool, where the site has one, is a processor holding customer and address data, often outside the United Kingdom under the safeguards Article 46 of the UK GDPR requires, which the privacy notice states; the Data (Use and Access) Act 2025 opt-out exception for some analytics cookies applies once in force and where the conditions are met.

Photographs, portfolios and the customer's home

The gallery of past jobs is personal data where the property, the street or the people are identifiable, and the privacy notice should say that the business photographs work for its records and uses images in its portfolio only with the customer's agreement, without the address or the customer's name unless they agree, and that a customer may ask for an image to come down; the uploads the customer sends with an enquiry (a photograph of the boiler, the fuse board, the leak) are kept with the enquiry and deleted on the same retention, and the business should not forward them to suppliers or subcontractors without saying so in the notice.

The note on the practical steps for a business run from a van

The note that comes with the pack lists the steps that make the documents true for a trade business: the registration with the Information Commissioner's Office under the Data Protection (Charges and Information) Regulations 2018 which most trades need, the retention the business will apply (enquiries that go nowhere deleted after a stated period, job records kept for tax law and the guarantee period plus the limitation period for claims, photographs on the same basis), the phone and the laptop protected with a passcode and backed up, the accounting software's data processing terms accepted, the marketing company told what it may and may not do with the enquiry data, and the banner tested; the privacy notice also covers the rights the individual has (to access, correct, erase, restrict, port and object), the way to exercise them, the month the business has to respond, and the route to the Information Commissioner's Office.

What it costs

Website privacy and cookies pack, £595. Privacy notice, cookie notice and consent guidance. Five working days.

DPA and privacy terms, £795. Data processing agreement plus privacy notice. Five working days.

Buying online forms the engagement on payment. The scope is what the data protection agreements and privacy terms page describes, you accept the Terms of Service at checkout, and I email you within four working hours to get started. If you would rather ask something first, email me.

What you get

• A data processing agreement that meets the statutory requirements and can be used as a schedule to your main contract
• A privacy notice written for people to read rather than to be scrolled past
• Clear allocation of controller and processor roles, which is where most confusion starts
• International transfer provisions where you use overseas suppliers
• Sub-processor and security provisions proportionate to what you do
• A note on the operational steps the documents assume you are taking

What is not included

• Full compliance audits and data mapping exercises
• ICO registration, which you do yourself
• Breach response and regulatory correspondence
• Cyber security certification such as Cyber Essentials
• Advice on data protection law outside the UK and EU

Questions I am often asked

Our marketing company added call tracking to the site. Is that our responsibility?

Yes: the business is the controller for the callers' data and the cookies the script sets, with the marketing company as processor. The cookie notice lists it, the privacy notice explains it and the banner should block it until consent.

Can we send review requests to every customer?

A review request that promotes the business is marketing, so it needs consent or the soft opt-in, which a customer who has just had the work done and could refuse usually supplies. The notice says which basis the business relies on.

We just have a brochure site with a phone number. Do we need all this?

A site with analytics or embedded content needs the cookie notice and the banner; a site that collects enquiries needs the privacy notice; and the business needs registration either way. The pack is sized to the site the business has.

Related guidance and services

• Data protection agreements and privacy terms, £595, the service this page describes
• Terms and conditions drafting, £995
• SaaS and technology contracts, £995
• Privacy notice for a tradesperson with a website
• Website privacy and cookies pack for a small business

This page is general guidance for businesses in England and Wales, not advice on your own circumstances. Last reviewed: October 2026. Email geoffrey@caesar.co.uk.