Privacy policy.

This notice explains how Webing Ltd processes the personal data of people contacting us through the form on www.webing.com, representatives of clients and prospective clients, and other business contacts. Last updated: 14 October 2026.

Introduction

This notice is provided under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and the UK GDPR. It explains how Webing Ltd processes the personal data of people contacting us through the form on www.webing.com, representatives of clients and prospective clients, and other business contacts (data subjects).

1. Data controller

The data controller is Webing Ltd., registered at 86-90 Paul Street, London EC2A 4NE, United Kingdom, company number 07033016, VAT GB107776889 (Webing or the controller).

For questions about personal data processing or to exercise the rights in section 9, please contact privacy@webing.com.

Webing has not appointed a Data Protection Officer (DPO), as the conditions requiring one under Article 37 GDPR do not apply.

2. Personal data we process

We process ordinary personal data, including identification and contact details, obtained directly from you through our website form, email, telephone or meetings. For business representatives, data may also come from their organisation, publicly available professional sources and professional databases such as Apollo.io. This includes:

first name, surname, company and, where provided, role and telephone number;
work email address;
preferred demo date and time, notes, enquiries and correspondence;
for clients, tax and administrative details needed for invoicing;
consent choices and interactions with communications sent by Webing;
only where marketing cookies have been accepted, website pages visited and associated with your contact record.

We do not request or process special categories of personal data under Article 9 GDPR. Please do not include such information in free-text form fields.

3. Purposes and legal bases

3.1 Enquiries and pre-contractual and contractual relationships

We process data to:

respond to enquiries submitted through the form or other channels;
send proposals, quotations, presentations and commercial information about Webing services related to your enquiry, arrange calls or meetings and follow up;
manage contractual relationships, including invoicing, payments, support and service communications;
comply with legal obligations.

Legal basis: taking steps at your request before entering into a contract and performing a contract (Article 6(1)(b) GDPR); compliance with legal obligations (Article 6(1)(c) GDPR).

3.2 Legal claims

Data may be processed to establish, exercise or defend Webing’s legal rights, in or out of court.

Legal basis: the controller’s legitimate interests (Article 6(1)(f) GDPR).

3.3 Marketing

With your specific consent, we may use data to send newsletters, updates on Webing products and services, event invitations and promotional communications unrelated to a specific enquiry, by email, telephone or messaging.

Legal basis: your consent (Article 6(1)(a) GDPR), which is optional and can be withdrawn at any time.

3.4 Communications to clients about similar services

Webing clients may receive emails about services similar to those already purchased without additional consent, subject to their right to object at any time, including through the link in each communication.

Legal basis: the controller’s legitimate interests, within the limits of Article 130(4) of Italian Legislative Decree 196/2003 and regulation 22(3) of the UK Privacy and Electronic Communications Regulations 2003.

3.5 Website visits linked to contact records

If you accept marketing cookies through the website banner, pages visited may be linked to your contact record in our CRM (HubSpot), and visiting companies may be identified through Apollo.io. This helps us understand interests and make responses and commercial proposals more relevant.

Legal basis: consent given through the cookie banner (Article 6(1)(a) GDPR and Article 122 of Italian Legislative Decree 196/2003), which can be withdrawn at any time in cookie preferences. Details are in our Cookie Policy.

4. Providing data and the consequences of declining

Providing data for the purposes in sections 3.1 and 3.2 is necessary. Without it, we cannot respond to your enquiry or manage the contractual relationship.

Providing data and consent for the purposes in sections 3.3 and 3.5 is optional. Declining consent does not affect your enquiry or the provision of services.

5. How we process data

Authorised, trained personnel process data mainly using electronic tools, following the principles of lawfulness, fairness and data minimisation. Appropriate technical and organisational measures protect confidentiality, integrity and availability within an ISO/IEC 27001-certified management system.

We do not make decisions based solely on automated processing within the meaning of Article 22 GDPR.

6. Retention periods

Enquiries not resulting in a contract (section 3.1): no longer than 24 months after the last interaction.
Contractual relationships (section 3.1): for the contract’s duration and subsequently for the period required by applicable administrative, accounting and tax law, up to 10 years.
Legal claims (section 3.2): for the duration of any dispute and until the time limits for appeals expire.
Marketing (section 3.3): until consent is withdrawn and, in any event, no longer than 24 months after the last interaction.
Client communications (section 3.4): no longer than 24 months after the relationship ends, unless you object earlier.
Website visits linked to contacts (section 3.5): until cookie consent is withdrawn and, in any event, no longer than 12 months after the last interaction.

Following withdrawal or objection, we retain only the contact address on a suppression list to prevent further communications. At the end of retention periods, data is deleted or irreversibly anonymised.

7. Data recipients

Where strictly necessary, data may be disclosed to:

Webing personnel authorised to process it;
suppliers processing data on our behalf as processors under Article 28 GDPR, bound by written agreements, including: HubSpot (CRM and email delivery); Google Workspace (email and productivity); Apollo.io (business database and company information enrichment); Cloudflare (form spam protection); Vercel (website hosting and form submission processing in the Paris EU region);
analytics and advertising service providers listed in the Cookie Policy, only for the cookie categories you have accepted;
advisers and professionals, including legal, tax and accounting advisers, banks and payment institutions acting as independent controllers;
public authorities where required by law.

Data is not made public or sold to third parties for their own marketing purposes. An up-to-date list of processors is available on request from privacy@webing.com.

8. International transfers

Webing is based in the United Kingdom, a country recognised by the European Commission as providing an adequate level of protection under Article 45 GDPR.

Where suppliers process data outside the UK and European Economic Area, transfers rely on adequacy decisions, including the EU-US Data Privacy Framework and its UK extension where applicable, or European Commission-approved Standard Contractual Clauses, supplemented by the International Data Transfer Addendum for data subject to UK law. Copies of the safeguards can be requested from privacy@webing.com.

9. Your rights

Under Articles 15 onwards of the GDPR and UK GDPR, you may at any time:

obtain confirmation that we hold your data and access it;
request correction or updates;
request erasure where applicable;
request restriction of processing;
receive data in a structured, commonly used, machine-readable format (data portability);
object to processing based on legitimate interests and, in all cases, to processing for marketing;
withdraw consent without affecting the lawfulness of processing carried out before withdrawal.

Send requests to privacy@webing.com. We respond within one month of receipt. This may be extended by two months for complex requests, and we will notify you of the extension.

You may also complain to the UK Information Commissioner’s Office (ICO) (ico.org.uk) or the supervisory authority in the EU member state where you live or work. In Italy, this is the Garante per la protezione dei dati personali (garanteprivacy.it).

10. Cookies

Information about cookies and tracking technologies used on this website, and how to manage consent, is in our Cookie Policy.

11. Changes

We may update this notice, including in response to legal or organisational changes. Significant changes will be clearly communicated on the website. The last updated date appears at the beginning.