1. Who We Are

NacSites (“NacSites,” “we,” “us,” or “our”) is a web design and development company. Our website is located at nacsites.com. This Privacy Policy explains how we handle personal information collected through this website and in connection with our services.

If you have questions about this policy or our data practices, please contact us at the address provided in Section 12.

---

2. Information We Collect

Information you provide directly

We collect personal information you voluntarily submit through our contact and booking form. This may include:

• First and last name
• Email address
• Phone number (optional)
• Business name
• Industry type
• Project details you include in your message

We do not collect payment card details through this website. Any payment information is collected separately through a secure, third-party payment processor at the time of invoicing.

Information collected automatically

When you visit our website, we and our third-party analytics providers automatically collect certain technical information, including:

• IP address (anonymized where required by law)
• Browser type and version
• Operating system
• Pages visited and time spent on each page
• Referring URL
• Device type (desktop, mobile, tablet)

This information is collected via cookies and similar tracking technologies (see Section 4).

---

3. How We Use Your Information

We use the information we collect for the following purposes:

• To respond to your inquiry — When you submit our contact form, we use your contact details to follow up and schedule a consultation.
• To provide our services — If you become a client, we use your contact and business details to deliver and manage your website project.
• To improve our website — Aggregate, anonymized analytics data helps us understand how visitors use our site so we can improve content and user experience.
• To comply with legal obligations — We may process your data where required to comply with applicable law.

We do not use your information for automated decision-making or profiling, and we do not send marketing communications unless you have explicitly opted in.

---

4. Cookies and Tracking Technologies

Our website uses cookies — small text files placed on your device — and similar tracking technologies. We use the following categories of cookies:

Strictly necessary cookies

These are required for the website to function and cannot be switched off. They include cookies that remember your language preference (stored locally on your device under the key ns_lang). No personal data is transmitted in these cookies.

Analytics cookies

We use Google Analytics to understand how visitors interact with our website. Google Analytics sets cookies that collect information such as pages visited, session duration, and general geographic location (country/region level only). This data is aggregated and anonymized — it does not identify you personally.

We have enabled IP anonymization in our Google Analytics configuration. For users in the EU/EEA, we process analytics data on the legal basis of legitimate interests and, where required, your consent.

You can opt out of Google Analytics tracking at any time by installing the Google Analytics Opt-out Browser Add-on.

Your cookie choices

You can control cookies through your browser settings. Disabling all cookies may affect site functionality (e.g., language preferences will not persist between visits). Most browsers allow you to:

• View what cookies are set
• Delete cookies individually or in bulk
• Block cookies from specific sites
• Block all third-party cookies

---

5. How We Share Your Information

We do not sell, rent, or trade your personal information.

We may share your information only in the following limited circumstances:

• Service providers: We use Google Analytics (analytics) and may use email service providers to receive form submissions. These providers are contractually bound to use your data only to provide services to us and in compliance with applicable privacy laws.
• Legal requirements: We may disclose your information if required by law, court order, or governmental authority, or if we believe disclosure is necessary to protect our rights or the safety of others.
• Business transfers: In the event of a merger, acquisition, or sale of all or part of our business, your data may be transferred as part of that transaction. We will notify you of any such change and the resulting privacy implications.

---

6. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes described in this policy:

• Contact form submissions that do not result in a project are retained for up to 12 months and then deleted.
• Client project records (contact details, project communications) are retained for up to 3 years following project completion for accounting and legal compliance purposes, then securely deleted.
• Analytics data is retained by Google Analytics per their standard data retention settings (default: 14 months). We do not retain raw analytics data ourselves.

You may request earlier deletion of your personal data at any time. See Section 7 or 8 for how to exercise this right.

---

7. Your Rights Under GDPR (EU / UK Residents)

If you are located in the European Union, the United Kingdom, or the European Economic Area, you have the following rights under the General Data Protection Regulation (GDPR) and applicable national data protection laws:

• Right of access — You may request a copy of the personal data we hold about you.
• Right to rectification — You may request that we correct inaccurate or incomplete personal data.
• Right to erasure (“right to be forgotten”) — You may request that we delete your personal data where we have no legitimate reason to continue processing it.
• Right to restriction of processing — You may request that we limit how we use your data in certain circumstances.
• Right to data portability — You may request a copy of your data in a structured, machine-readable format.
• Right to object — You may object to our processing of your data where we rely on legitimate interests as our legal basis.
• Right to withdraw consent — Where we process data based on your consent (e.g., analytics cookies), you may withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us using the details in Section 12. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection authority (e.g., the ICO in the UK, or your national supervisory authority in the EU).

Legal basis for processing: We process your data on the basis of (a) contractual necessity when delivering services you have engaged us for; (b) legitimate interests for analytics and website improvement; and (c) consent where explicitly obtained (e.g., cookie consent).

---

8. Your Rights Under CCPA (California Residents)

If you are a California resident, the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) grant you the following rights:

• Right to know — You may request disclosure of the categories and specific pieces of personal information we have collected about you, as well as the purposes for which we use it.
• Right to delete — You may request deletion of your personal information, subject to certain exceptions.
• Right to correct — You may request correction of inaccurate personal information.
• Right to opt out of sale or sharing — We do not sell or share personal information with third parties for cross-context behavioral advertising. No opt-out is necessary, but you may contact us to confirm this.
• Right to non-discrimination — We will not discriminate against you for exercising any of your CCPA rights.

To submit a CCPA request, contact us using the details in Section 12. We will verify your identity and respond within 45 days as required by law.

---

9. Children’s Privacy

Our website and services are not directed to children under the age of 13. We do not knowingly collect personal information from anyone under 13. If you believe a child under 13 has provided us with personal information, please contact us immediately and we will delete that information.

---

10. Data Security

We take reasonable technical and organizational measures to protect your personal information against unauthorized access, loss, or disclosure. These measures include secure form transmission (HTTPS/TLS encryption), restricted internal access to personal data, and regular review of our data practices.

However, no method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your personal information, we cannot guarantee its absolute security. In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and applicable authorities as required by law.

---

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or service offerings. When we make material changes, we will update the “Last updated” date at the top of this page. We encourage you to review this policy periodically.

Your continued use of our website after any changes constitutes acceptance of the updated policy.

---

12. Contact Us

If you have questions about this Privacy Policy, wish to exercise your data rights, or want to report a privacy concern, please contact us:

• Email: nacsites@gmail.com
• Website: nacsites.com/contact

We will acknowledge your request within 5 business days and respond fully within the timeframe required by applicable law.