Privacy Notice
Make and Ship Limited
Effective from: 24 September 2026
Last reviewed: 24 September 2026
Website consent wording updated: 12 October 2026
Policy Owner: Simon Heys
Privacy contact: hello@makeandship.com
Who this notice covers
This notice explains how Make and Ship Limited uses personal information about visitors to our website, people who contact us, and our client and supplier contacts. We are the controller of that information.
Our company number is 09347446. You can write to us at 66 Paul Street, London, England, EC2A 4NA, or use the privacy contact above.
Where we process personal information on a client’s instructions to deliver their service, the client’s privacy notice explains that use.
Information we use and why
Information | Purpose | Lawful basis |
|---|---|---|
Name, contact details, role, organisation and correspondence | Answer enquiries, discuss work and manage client and supplier relationships | Our legitimate interests in communicating with business contacts and running our business. Where you contract with us personally, taking steps at your request before a contract and performing that contract. |
Contact, contract, invoice and payment information | Administer contracts, invoices and payments, and keep required accounting records | Our legitimate interests in managing business relationships; contract where you are personally a party; legal obligation for statutory records. |
IP address, browser and device information, requested pages and technical logs | Deliver and secure the website, diagnose faults and prevent abuse | Our legitimate interests in operating a reliable and secure website. |
Name, email address and your marketing preferences | Send news and marketing email you have opted in to | Consent. You can unsubscribe at any time using the link in each email or by contacting us. |
Website activity and advertising interactions | Understand website use and measure advertising | Consent for optional analytics and advertising, including cookies and cookieless measurement. See the website section below. |
We receive information directly from you and from people at the organisations we work with. Website technology also collects technical information when you visit. If you do not provide the information needed to answer an enquiry or perform a contract, we may be unable to do so.
Website analytics and choices
With your analytics consent, we use Google Analytics and Vercel Web Analytics to measure website use. With your marketing consent, we use a Google Ads tag to test advertising measurement. These services receive technical information such as the page visited and browser and device information.
Our Google Analytics settings allow Google to use aggregated, de-identified measurement data for modelling and benchmarking, and to access Analytics data for technical support and business recommendations.
Use Privacy Settings in the website footer to reject both optional categories, allow Analytics or Marketing separately, or allow both. You can change your choice at any time. Continuing to browse does not give consent.
We use c15t to save your choice in your browser so it can be applied on later visits, and to record your choices and when they were made on our servers.
Google Tag Manager loads only after you allow Analytics or Marketing, and each service follows its own category choice. Allowing Analytics alone does not enable Google Ads; allowing Marketing alone does not enable Google Analytics or Vercel Web Analytics. Before you make a choice, or when you reject both optional categories, the website does not load these services or send tracking requests to them.
Withdrawing consent stops subsequent tracking for that category, including when you move between website pages, and removes the related first-party tracking cookies that the website can access. The page reloads when you withdraw consent. Withdrawal does not delete information already collected or cookies set by other websites; you can manage other cookies through your browser settings.
Vercel Web Analytics uses a temporary visitor identifier rather than analytics cookies. Hosting and security services also process technical request information to deliver and protect the website.
For provider information, see Google’s explanation of data use on partner sites and Vercel Web Analytics privacy information.
Who receives information
We use company-controlled Google Workspace and OneDrive accounts for documents and correspondence, Xero for invoices and payment records, and Kit to store website enquiries and send marketing email to people who opt in. We use DocuSign to arrange electronic signatures on agreements. Our external accountant also has access to our Xero records. Website hosting providers and Google receive the website information described above.
We may share relevant information with professional advisers and with public authorities where required by law, or where necessary to establish, exercise or defend legal claims.
Overseas processing
Some of our providers store or access personal information outside the UK, including in Europe and the United States. Selecting a UK or European storage region does not necessarily restrict all support access or processing to that region.
For overseas transfers, we require protection through UK adequacy arrangements or appropriate safeguards, such as approved contractual clauses with the UK addendum. Contact us for details of the safeguards relevant to your information or a copy of them.
How long we keep information
We keep information for the purpose for which it is needed:
- Routine enquiries and unsuccessful proposals: until the enquiry, proposal and any agreed follow-up are complete and the information is no longer needed. Where correspondence forms part of a contract or dispute, we retain it with the relevant records.
- Contracts, invoices and related correspondence: for applicable tax and other statutory record-keeping periods and while needed to resolve outstanding payments, disputes or claims.
- Marketing email list: until you unsubscribe or withdraw consent. We keep a minimal record of the opt-out so we do not contact you again.
- Technical records: according to the time needed to detect and investigate faults or security incidents.
- Google Analytics: event data is retained for 2 months and user data for 14 months. New activity resets the user-data retention period. These settings do not determine how long aggregated reports are kept.
- Vercel Web Analytics: Vercel discards its visitor identifier after 24 hours. Reporting data is kept longer; its reporting window is not a deletion deadline. See Vercel’s reporting information.
We delete or anonymise information when it is no longer needed. A specific legal requirement or unresolved claim may require us to retain relevant records longer.
Your rights
Depending on the circumstances, you can ask to access, correct or erase your personal information, restrict its use, or receive a portable copy. Where we rely on consent, you can withdraw it at any time without affecting earlier lawful use.
You can object to direct marketing at any time. You can also object, for reasons relating to your situation, where we rely on legitimate interests.
Contact us using the privacy contact above to exercise your rights. We may need information to confirm your identity. We will explain any applicable limits or exceptions when responding.
Complaints
You can raise a data protection complaint through the privacy contact above or by post. We will acknowledge it within 30 days, investigate without undue delay, keep you informed and explain the outcome.
You also have the right to complain to the Information Commissioner’s Office.
Changes
We will update this notice when our use of personal information changes and bring material changes to your attention where needed.