Privacy and Cookies Policy

Last updated: 26 June 2026

Kirsty M Design Ltd respects your privacy and is committed to protecting your personal information.

This policy explains how we collect, use, store and share personal information when you:

  • visit this website;

  • contact us about our services;

  • schedule or attend a call;

  • join our mailing list;

  • purchase a website template;

  • choose to create a customer account; or

  • otherwise interact with Kirsty M Design.

It also explains how this website uses cookies and similar technologies.

1. Who we are

Kirsty M Design Ltd is a company registered in Scotland under company number SC806869, trading as Kirsty M Design.

Our registered office is:

55 Myrtletown Park
Westhill
Inverness
Scotland
IV2 5JE

For the purposes of UK data-protection law, Kirsty M Design Ltd is the controller of the personal information described in this policy.

For questions about this policy, to exercise your data-protection rights or to contact us about how your information is used, please email:

hello@kirstym.com

2. The information we collect

The personal information we collect depends on how you interact with us.

Information you provide through enquiries and bookings

When you complete an enquiry form, schedule a meeting or otherwise contact us, we may collect:

  • your name;

  • your email address;

  • your telephone number;

  • your business name;

  • your website address;

  • information about your business;

  • information about your proposed project, requirements, budget and timescale;

  • your meeting availability;

  • answers submitted through forms or questionnaires;

  • correspondence and messages between us; and

  • notes relating to an enquiry or meeting.

Our enquiry forms, questionnaires and meeting scheduler are provided through Dubsado.

Information collected during client projects

If you become a client, we may collect and use:

  • your contact and business details;

  • contracts, proposals and invoices;

  • project questionnaires and briefs;

  • website copy, photographs, branding and other project materials;

  • access details you provide for relevant platforms;

  • project correspondence and approval records;

  • call and meeting notes;

  • information needed to design, build or support your website; and

  • records of payments and transactions.

Please do not provide sensitive personal information unless it is genuinely required for your project and we have agreed how it will be handled.

Calls and meetings

Online calls may be conducted through Google Meet.

Google may process information needed to provide the meeting, including your name, email address, IP address, device information and meeting-participation details.

We do not routinely record Google Meet calls. If we wish to record a call, we will tell you beforehand and obtain any consent required.

Template purchases

When you purchase a website template, we may collect:

  • your name;

  • email address;

  • billing address;

  • telephone number, where provided;

  • details of the template purchased;

  • order and transaction information;

  • invoice and tax information;

  • communications about the purchase; and

  • order-support or refund information.

Optional customer accounts

You may be given the choice to create a customer account when purchasing a website template. Creating an account is optional, and customers can normally complete a purchase as a guest.

If you create an account, Squarespace may store information connected with the account, including:

  • your name and contact details;

  • billing information;

  • order history;

  • saved addresses;

  • shopping-cart information; and

  • payment-method information you choose to save.

Complete card details are stored by the payment processor rather than being directly accessible to Kirsty M Design Ltd.

Payment information

Template payments are processed through Stripe.

Stripe may collect and process:

  • your name;

  • email address;

  • billing address;

  • payment-card or other payment-method details;

  • transaction information;

  • IP address;

  • device information; and

  • security and fraud-prevention information.

Kirsty M Design Ltd does not normally receive or store your complete payment-card number.

Mailing-list information

When you join our mailing list or request a free resource, we may collect:

  • your first and last name;

  • email address;

  • subscription date and source;

  • email preferences;

  • information about emails delivered, opened or selected; and

  • records of consent and unsubscribing.

Information collected when you visit the website

When you use this website, we and Squarespace may collect:

  • your IP address;

  • browser and device information;

  • network information;

  • approximate location derived from your IP address;

  • the website or page that referred you to us;

  • pages viewed;

  • links selected;

  • date and time information;

  • website activity and navigation information; and

  • cookie identifiers and consent preferences.

Squarespace may process some information in an aggregated or de-identified form.

3. How we obtain your information

We collect personal information:

  • directly from you;

  • through Dubsado enquiry forms, questionnaires and scheduling tools;

  • when you communicate with us by email;

  • during Google Meet calls;

  • when you enter into a contract with us;

  • when you purchase a website template;

  • when you choose to create a customer account;

  • when you subscribe to our mailing list;

  • through cookies, analytics and similar technologies;

  • through recommendations and referrals;

  • from payment and ecommerce providers; and

  • from publicly available business sources, such as your company website or professional social-media profile.

4. How and why we use your information

UK data-protection law requires us to have a lawful basis for using personal information.

Depending on the circumstances, we rely on:

  • contract, where processing is needed to take steps at your request before entering into a contract or to perform an agreement with you;

  • legitimate interests, where processing is reasonably necessary to operate, improve or protect our business and your rights do not override those interests;

  • legal obligation, where we must process information to comply with the law; or

  • consent, where you have made an informed and freely given choice, such as agreeing to receive marketing emails or accepting optional cookies.

Responding to enquiries

We use information submitted through Dubsado, email or other communications to:

  • respond to your enquiry;

  • understand your requirements;

  • assess whether our services are suitable;

  • arrange an introductory call;

  • prepare a quotation or proposal; and

  • follow up regarding a potential project.

Our lawful basis is taking steps at your request before entering into a contract. We may also rely on our legitimate interest in managing enquiries and developing our business.

Scheduling and conducting meetings

We use Dubsado and Google Meet to:

  • offer appointment times;

  • schedule and manage meetings;

  • send booking confirmations or reminders;

  • conduct discovery calls and project meetings; and

  • maintain appropriate notes and records.

Our lawful basis is taking steps before entering into a contract, performing our contract with you or our legitimate interest in communicating effectively with prospective and existing clients.

Providing website-design services

We use client and project information to:

  • plan and manage projects;

  • provide website-design, development and support services;

  • communicate with you;

  • prepare contracts, proposals and invoices;

  • produce project work;

  • request and record feedback or approvals;

  • provide tutorials and handover information;

  • manage payments;

  • provide agreed support; and

  • maintain appropriate business and project records.

Our lawful bases are performance of our contract, compliance with legal obligations and our legitimate interest in managing and protecting our business.

Processing template purchases

We use order and customer information to:

  • process and fulfil template purchases;

  • provide access to purchased materials;

  • send order confirmations and essential service messages;

  • provide customer support;

  • deal with refunds, disputes or chargebacks;

  • prevent fraud and misuse; and

  • maintain accounting and tax records.

Our lawful bases are performance of our contract, compliance with legal obligations and our legitimate interest in protecting our business.

Providing optional customer accounts

If you choose to create a customer account, we use your information to:

  • create and maintain the account;

  • authenticate your access;

  • display your order history;

  • provide access to relevant customer features;

  • remember information for future checkouts;

  • store payment details where you actively choose this option; and

  • administer security and support requests.

Our lawful basis is performance of our contract and providing the account functionality you requested.

Email marketing

We may use your name and email address to send:

  • website-design advice;

  • newsletters;

  • free guides and resources;

  • information about our services;

  • information about templates or other products; and

  • occasional promotional messages.

We normally rely on your consent to send marketing emails.

Where permitted by law, we may send limited marketing to an existing customer about our own similar products or services. You will be given an opportunity to opt out.

You can unsubscribe at any time by selecting the unsubscribe link in an email or contacting us.

Unsubscribing from marketing does not prevent us from sending essential communications about an enquiry, project, purchase, account or contract.

Website analytics and improvement

Subject to your cookie choices, we may use Squarespace Analytics and related information to:

  • understand how visitors find and use the website;

  • measure page views and website engagement;

  • analyse traffic sources;

  • monitor website and sales performance;

  • identify popular content;

  • diagnose technical problems; and

  • improve our website, content and services.

Where cookies or similar technology are used to collect analytics information from your device, we rely on your consent unless a legal exemption applies.

Affiliate links

Some pages may contain affiliate links. If you follow one of these links and make a purchase or take another qualifying action, we may receive a commission or referral payment.

Affiliate links may include an identifier that enables the relevant provider or affiliate network to attribute the referral to Kirsty M Design.

The external website or affiliate provider is responsible for the information it collects after you follow the link. Its own privacy and cookies policies will apply.

Security and legal compliance

We may use personal information to:

  • protect our website, accounts and systems;

  • prevent and investigate fraud or misuse;

  • establish, exercise or defend legal claims;

  • enforce our contracts and policies;

  • respond to disputes or complaints;

  • comply with accounting and tax requirements; and

  • respond to lawful requests from courts, regulators or public authorities.

Our lawful bases are compliance with legal obligations and our legitimate interest in protecting our business and legal rights.

5. Who we share information with

We do not sell or rent your personal information.

We may share information with trusted service providers where reasonably necessary to operate our website and business.

Squarespace

This website is hosted by Squarespace.

Squarespace provides services including:

  • website hosting and security;

  • website analytics;

  • mailing-list and email-campaign functionality;

  • ecommerce and checkout;

  • order processing;

  • optional customer accounts; and

  • shopping-cart and customer functionality.

Squarespace may process technical information about website visitors, mailing-list information, customer-account information and information connected with template purchases.

Dubsado

We use Dubsado for functions that may include:

  • contact and enquiry forms;

  • questionnaires;

  • meeting scheduling;

  • customer relationship management;

  • proposals;

  • contracts;

  • invoices; and

  • project administration.

Dubsado may process personal and business information submitted through these systems.

Google

We use Google Meet for online calls and meetings.

We may also use Google Workspace for business email, calendars, documents, file storage and business administration.

Google may process account, communication, device and technical information when these services are used.

Stripe

Stripe processes payments for template purchases.

Stripe may process payment details, contact information, billing information, transaction information, device information and fraud-prevention data.

Stripe may act as our processor for some activities and as an independent controller when it uses information to meet its own legal, regulatory, fraud-prevention and security responsibilities.

Other business service providers

We may use providers that support:

  • accounting and bookkeeping;

  • project and task management;

  • cloud storage and backups;

  • video tutorials and client communications;

  • website hosting and technical support;

  • business banking;

  • insurance;

  • professional advice; and

  • IT and information security.

These providers may include FreeAgent, Asana and Loom where relevant to our work.

Professional advisers and authorities

We may disclose information to:

  • accountants and bookkeepers;

  • insurers;

  • legal advisers;

  • IT or security professionals;

  • courts and dispute-resolution bodies;

  • law-enforcement agencies;

  • HM Revenue & Customs;

  • regulators; and

  • other public authorities.

We will only do this where reasonably necessary or legally required.

Business transfers

If Kirsty M Design Ltd is sold, reorganised or transferred, personal information may be disclosed to prospective purchasers and their professional advisers where appropriate safeguards are used.

6. International transfers

Some of our service providers are based outside the United Kingdom or may process information using systems located in other countries, including the United States.

These providers may include Squarespace, Dubsado, Google, Stripe and other cloud-service providers.

Where personal information is transferred outside the UK, we take reasonable steps to ensure that an appropriate transfer mechanism or safeguard applies.

Depending on the provider and destination, this may include:

  • UK adequacy regulations;

  • the UK International Data Transfer Agreement;

  • the UK Addendum to the EU Standard Contractual Clauses;

  • participation in a recognised data-protection framework; or

  • another safeguard permitted under UK data-protection law.

You may contact us for further information about the safeguards relevant to a particular provider.

7. How long we retain personal information

We keep personal information only for as long as reasonably necessary for the purposes for which it was collected.

Our usual retention periods are:

Enquiries that do not become projects: Up to two years after our last meaningful contact

Dubsado enquiry, booking and questionnaire information: Up to two years after the enquiry ends, or transferred to the relevant client record if a project proceeds

Client contracts, proposals, invoices and project correspondence: Up to six years after the project or contractual relationship ends

Project files and client-supplied materials: For the duration of the project and a reasonable handover or support period, normally up to two years afterwards unless longer storage is agreed or required

Meeting notes and records: For as long as reasonably needed for the enquiry, project or related legal record

Template orders, transactions and invoices: At least six years after the end of the relevant financial year, or longer where legally required

Customer-account information: While the account remains active and afterwards where required for order support, accounting, security or legal purposes

Mailing-list records: Until you unsubscribe or we determine that the information is no longer current or required

Unsubscribe or suppression records: As long as necessary to ensure that we continue to respect your request

Cookie-consent records: For an appropriate period needed to record, demonstrate and respect your choices

Website analytics: In accordance with the retention settings applied within Squarespace or the relevant analytics service

We may retain information for longer where reasonably necessary in connection with a dispute, complaint, legal claim, fraud investigation or regulatory requirement.

8. Email marketing and unsubscribing

You can stop receiving marketing emails at any time by:

  • selecting the unsubscribe link in a marketing email; or

  • contacting us using the details at the beginning of this policy.

We may retain a minimal suppression record, usually consisting of your email address, so that we can continue to respect your request and do not accidentally add you back to the mailing list.

9. Security

We use reasonable technical and organisational measures intended to protect personal information from accidental loss, misuse, unauthorised access, alteration or disclosure.

These measures may include:

  • password protection;

  • multi-factor authentication where available;

  • access controls;

  • secure cloud services;

  • encrypted connections;

  • software updates;

  • backups; and

  • limiting access to people who reasonably need the information.

No internet transmission or storage system can be guaranteed to be completely secure.

Please do not submit passwords, payment-card details or other highly sensitive information through a standard enquiry form or ordinary email unless we have specifically asked you to use an agreed secure method.

10. Your data-protection rights

Depending on the circumstances, you may have the right to:

  • request access to the personal information we hold about you;

  • ask us to correct inaccurate or incomplete information;

  • ask us to delete your information;

  • ask us to restrict how your information is used;

  • object to processing based on legitimate interests;

  • object to direct marketing;

  • withdraw consent at any time;

  • receive certain information in a portable format; and

  • complain to the Information Commissioner’s Office.

These rights are not absolute and may be subject to legal conditions or exceptions.

To exercise a right, contact us using the details at the beginning of this policy.

We may need to request information to verify your identity. We may also ask for clarification where necessary to understand and respond to your request.

You will not normally have to pay a fee. We may charge a reasonable fee or refuse to act where the law permits, including where a request is manifestly unfounded or excessive.

Withdrawing consent does not affect the lawfulness of processing carried out before consent was withdrawn.

11. Complaints

Please contact us first if you have a concern about how we use your personal information. We will take your concern seriously and aim to resolve it promptly.

You also have the right to complain to the UK supervisory authority:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Information about making a complaint is available on the Information Commissioner’s Office website.

12. Children

Our website, services and templates are intended primarily for businesses and adults.

We do not knowingly collect personal information directly from children under 13 through this website.

If you believe that a child has provided personal information without appropriate permission, please contact us so that we can investigate and, where appropriate, delete it.

13. Third-party websites

This website contains links to external websites and services.

We are not responsible for the privacy, security or content of third-party websites. When you follow an external link, the privacy and cookies policies of the relevant third party will apply.

14. Automated decision-making

We do not use personal information collected through this website to make solely automated decisions that produce legal or similarly significant effects on you.

Cookies Policy

15. What cookies are

Cookies are small text files stored on your computer, phone or other device when you visit a website.

Similar technologies, including local storage, pixels and tracking links, can perform related functions. References to cookies in this policy include similar technologies where appropriate.

Cookies may be:

  • session cookies, which expire when you close your browser; or

  • persistent cookies, which remain on your device for a specified period or until you delete them.

Cookies may also be:

  • first-party cookies, set by this website or Squarespace on our behalf; or

  • third-party cookies, set by an external service used through the website.

16. Categories of cookies used

Strictly necessary cookies

These cookies are required for the website to operate securely and provide features you request.

They may support:

  • website security;

  • network and session management;

  • cookie-consent preferences;

  • website navigation;

  • enquiry or scheduling functionality;

  • customer-account login;

  • shopping baskets;

  • checkout;

  • payment security;

  • authentication; and

  • fraud prevention.

Strictly necessary cookies do not require consent because the website or requested service cannot operate properly without them.

Analytics and performance cookies

These cookies help us understand how people find and use the website.

They may collect information about:

  • page views;

  • website visits and sessions;

  • traffic and referral sources;

  • navigation;

  • device and browser type;

  • approximate location;

  • engagement;

  • sales and conversion performance; and

  • website errors or performance.

We use analytics and performance cookies only where you have consented or where a specific legal exemption applies.

At present, our principal website analytics service is Squarespace Analytics.

Functional cookies

Functional cookies support optional website features or remember choices you have made.

These may relate to:

  • embedded Dubsado forms;

  • appointment scheduling;

  • customer-account features;

  • remembered preferences; or

  • other third-party functionality.

Where these technologies are not strictly necessary, they will be used only in accordance with your cookie choices.

Payment and checkout cookies

Squarespace and Stripe may use cookies and similar technology during checkout for:

  • processing payments;

  • authenticating users;

  • securing transactions;

  • preventing fraud;

  • remembering checkout progress; and

  • complying with financial and regulatory obligations.

Cookies that are strictly necessary to complete and secure a purchase may operate without optional cookie consent.

17. Services that may use cookies

Depending on the pages you visit and the features you use, cookies and similar technologies may be associated with the following services.

Squarespace

Squarespace hosts this website and may use strictly necessary cookies to:

  • securely deliver website pages;

  • operate the cookie banner;

  • remember cookie preferences;

  • provide customer accounts;

  • manage shopping carts and checkout;

  • process orders;

  • secure the website; and

  • prevent fraud or misuse.

Where you have consented, Squarespace may also use analytics and performance cookies to provide information about website traffic, activity, sales and performance.

Dubsado

Dubsado provides enquiry forms and meeting-scheduling features.

Dubsado may use cookies or similar technical storage where necessary to:

  • display and process forms;

  • maintain a form or booking session;

  • submit information;

  • prevent abuse; and

  • provide appointment-scheduling functionality.

Any non-essential technology used by Dubsado should operate in accordance with your cookie choices.

Stripe

Stripe may use cookies and similar technologies during payment and checkout for security, authentication, fraud prevention and payment processing.

Affiliate links

Some pages may contain affiliate links.

Affiliate links may include a referral identifier. If you follow one, the relevant external provider or affiliate network may use cookies or similar technology to record that you arrived through our link and attribute a subsequent purchase or action to Kirsty M Design.

The third-party website is responsible for the cookies it places after you visit it.

Domain-verification tags

This website may contain verification tags for services including Impact and Pinterest.

These tags are used to confirm that Kirsty M Design controls the domain. The verification meta tags themselves are not intended to provide behavioural advertising or cross-site visitor tracking.

We do not currently use Microsoft Clarity, Google Analytics, the Meta Pixel or the Pinterest advertising tag on this website.

If we introduce additional analytics or advertising technology in future, we will update our cookie controls and this policy as appropriate.

18. Managing your cookie choices

When you first visit the website, the cookie banner allows you to:

  • accept optional cookies;

  • decline optional cookies; or

  • manage your preferences.

Optional analytics and performance cookies should not be placed until you have made the relevant choice.

You can change or withdraw your cookie choices later using the Manage Cookies or equivalent cookie-preference link on the website.

Declining optional cookies should not prevent you from accessing the main website, although some optional or embedded features may not function as intended.

You can also delete or block cookies using your browser settings. Browser controls vary, so consult your browser’s help information for instructions.

Blocking all cookies may affect essential features such as customer accounts, shopping baskets or checkout.

19. Information about individual cookies

The cookies used by Squarespace vary depending on the website features enabled and may change when Squarespace updates its services.

Further information about Squarespace’s currently used cookies, their purposes and typical duration is available through the link to The cookies Squarespace uses provided in our cookie banner or cookie-preference panel.

The cookie-preference panel should be treated as the most current description of the optional cookie categories available on this website.

20. Changes to this policy

We may update this policy to reflect changes to:

  • our website;

  • our services or products;

  • the providers we use;

  • our data-processing activities;

  • applicable law; or

  • regulatory guidance.

The latest version will be published on this page with an updated date.

We encourage you to review this policy periodically.