Privacy
This Privacy Policy explains what personal information Morris Standard may collect, why it is used, how it is handled, who it may be shared with and the choices available to you.
Last updated 23 September 2026
At a glance
The diagram summarises the journey from an enquiry through use, protected storage and eventual retention or deletion. The detailed sections below explain the specific purposes, providers, lawful bases and rights that apply.
Who is responsible
The data controller is Ian Morris trading as Morris Standard, 27 High Street, Builth Wells, LD2 3DL. Privacy enquiries and data protection rights requests can be sent to privacy@morrisstandard.co.uk.
This notice covers the Morris Standard website, contact and quote enquiries, consumer cancellation notices, project questionnaires, the Standard Check, email, telephone, WhatsApp and SMS communications, occasional social-media messages, the WHMCS client area and support system, and CCTV at the business premises.
Morris Standard’s services are intended for adults and business customers. Morris Standard does not knowingly collect personal information directly from children.
When Morris Standard accesses personal information held in a client’s own website, hosting account or other system solely to provide that client’s service, Morris Standard may act as a processor on the client’s instructions. Appropriate client terms will apply where required.
Information collected
Morris Standard aims to collect only the information needed to answer an enquiry, provide and support a service, administer a client relationship, operate the Standard Check, protect the website and premises, or meet a genuine business or legal requirement.
Your name, email address, telephone number, postal address where relevant, business or website details, cancellation notice details and the content you choose to send by website form, email, WhatsApp, SMS or occasional social-media message. Telephone calls are not recorded.
Your name, business name, email address and project answers or requirements. The website questionnaire does not accept file uploads; project files may instead arrive by email, WhatsApp or a WHMCS support ticket.
Your name, business email, website address, selected goal, acceptance of the Terms and your optional marketing choice, a hashed IP address, browser information, public website evidence and activity connected with the private report.
WHMCS may hold your name, postal address, email, telephone number, invoices, payment status, support tickets and attachments. Bank-transfer records may also contain your name, payment reference and transaction details.
Server and security systems may record IP addresses, requested pages, timestamps, browser or device details, errors and security events. This includes logs used by Worldstream, Wordfence and Imunify360 to operate and protect the service.
Purpose and lawful basis
The lawful basis depends on the relationship and purpose. In particular, contract-based processing applies directly where the person is the prospective or actual contracting party; legitimate interests will often apply where an individual is acting for a company or other organisation.
To respond to a request and scope possible work. Legitimate interests may apply where the contact is acting for a company or other organisation rather than contracting personally.
To provide the service, communicate about it, administer the client relationship, keep appropriate records and provide support. Legitimate interests may apply to organisational contacts.
To identify the relevant agreement, record and act on the cancellation notice, communicate about it and keep proportionate evidence of the request.
To prepare the website review requested, protect the service from misuse and provide a private report that may lead to a later discussion about work.
To understand how visitors use the public website and improve services. GA4 is only permitted after you grant Analytics consent through CookieYes, and you can withdraw that consent later.
To secure the website, systems and premises, prevent misuse and crime, troubleshoot problems and investigate incidents in a proportionate way.
To meet applicable legal and tax duties and to keep proportionate records for payments, disputes and the establishment, exercise or defence of legal rights.
Morris Standard is not currently sending newsletter or promotional email campaigns. If identifiable personal details such as an individual’s name, photograph, testimonial or quotation are to be published in a case study, permission will be obtained first.
Saved drafts and project briefs
If you save a project questionnaire to return later, the draft is stored privately in WordPress and a secure return link is emailed to the address you provide.
The secure return link is valid for 30 days from your latest save. Anyone with that link can open the saved draft, so you should keep it private.
Unfinished saved drafts are automatically deleted 30 days after the latest save. The return link expires at the same time. Saving the draft again starts a new 30-day period.
When you submit the completed questionnaire, the brief remains non-public. If the enquiry does not become a project, it normally follows the 12-month enquiry period. If work proceeds, the brief may form part of the client or project record.
The questionnaire itself does not accept file uploads. Files needed for a project may instead be supplied by email, WhatsApp or through WHMCS.
Sharing and service providers
Morris Standard does not sell your personal information. Routine access to Morris Standard client and enquiry information is limited to Ian Morris, apart from service providers or professional advisers where access is genuinely necessary.
Worldstream. The Morris Standard website, business email and self-hosted WHMCS client system run on a dedicated Worldstream server in the Netherlands. Worldstream may access the server when necessary for hosting support, maintenance or troubleshooting.
Google services. Google is used for Google Search Console, Google PageSpeed Insights within the Standard Check, Google Password Manager for necessary client credentials, Google-backed WhatsApp backups and Google Analytics 4. GA4 is consent-controlled through CookieYes and is not permitted to run until Analytics consent is granted.
OpenAI. The live Standard Check uses the OpenAI API to help with report wording and visual observations. It may send the submitted website address, public website evidence, findings and, where used, an automated website screenshot. The name and email address entered for the Standard Check are not included in the material sent to OpenAI.
Security and communication services. Wordfence and Imunify360 are used for website and server security. If Morris Standard enables a non-essential embedded third-party service, it will be reviewed and consent-controlled where required before optional tracking is enabled. Occasional direct messages normally remain within the relevant social platform, and WhatsApp messages are processed through WhatsApp with chat backups stored through the linked Google account.
CCTV. CCTV recordings are stored using Wansview Cloud. Access to the account is restricted to Ian Morris. Wansview states that it is headquartered in China, currently uses data centres in the United States and may process information internationally. Relevant footage may be provided to the police, insurers or another competent authority where this is reasonably necessary for security, an incident, a legal claim or a legal obligation.
Accounting and payments. Relevant invoice or accounting information may be shared with a UK-based accountant or bookkeeper where needed, including for year-end accounting and tax work. Bank-transfer information is also processed through the relevant banking systems.
The main Worldstream server is in the Netherlands. The Netherlands is within the EEA and is covered by the UK’s adequacy regulations. Other service providers may process information in countries outside the UK.
Where a restricted transfer occurs, UK data protection law requires it to be covered by a permitted mechanism, such as adequacy regulations, appropriate safeguards or an applicable exception. Morris Standard keeps its use of international service providers under review. You can ask privacy@morrisstandard.co.uk for more information about a particular provider.
Retention
Enquiries and quote requests that do not become client work, including relevant email, WhatsApp, SMS and social-media correspondence, are normally kept for up to 12 months.
Standard Check reports are normally retained for 30 days. Expired Standard Check records are removed automatically. Information may be removed sooner where there is a valid reason to do so.
Completed project briefs, consumer cancellation notices, relevant project correspondence, WHMCS records, support tickets and attachments, and normal client or project files are normally retained for up to 6 years after the project or client relationship ends, unless a longer period is required for tax, accounting, legal or dispute purposes.
Server logs and Wordfence and Imunify360 security logs are normally kept for 90 days. CCTV recordings are normally kept for 7 days, unless footage needs to be preserved for a specific incident.
Routine encrypted backup copies are retained on a rolling 90-day cycle. Credentials and temporary working copies are removed sooner when they are no longer needed for the work.
Security
The main Morris Standard PC is password-protected, used only by Ian Morris and protected by Windows Device Encryption, antivirus and firewall controls. Key accounts use two-factor authentication where available, and the website, WHMCS client area and email and webmail use encrypted HTTPS/SSL connections.
Routine local backups are stored on an encrypted and password-protected external USB drive kept in a secure locked location at 27 High Street. Access is limited to Ian Morris.
Where client or customer information has to be copied locally to complete work, temporary copies are normally deleted when they are no longer needed. Morris Standard keeps its normal records digitally rather than in a paper filing system.
Client credentials may be kept in Google Password Manager while needed for a project or continuing Website Care access and should be removed when that access is no longer required. The phone used for Morris Standard communications is protected by device security and used only by Ian Morris.
No online or electronic system can guarantee absolute security. If you believe information has been sent to Morris Standard in error or exposed, email privacy@morrisstandard.co.uk promptly.
Cookies and third-party content
CookieYes provides the website’s cookie-consent banner and preference controls. Necessary storage can operate where it is essential for the website or a feature you request; non-essential categories are denied by default.
Google Analytics 4 is used only after you grant Analytics consent through CookieYes. Morris Standard uses GA4 to understand website use and improve services, not for Google Ads, remarketing or advertising profiling. You can reject Analytics or withdraw a previous choice through the CookieYes controls.
See the Cookie Policy for the current explanation of cookies and related technologies used by this website.
Your information rights
Your exact rights depend on the lawful basis and circumstances, and some rights are not absolute. Depending on the circumstances, you may have the following rights under UK data protection law.
Where Morris Standard relies on legitimate interests, you may have the right to object to that use of your personal information. The circumstances will be considered and processing will stop where the law requires it.
The Standard Check uses automated and AI-assisted analysis to help prepare a website report, but Morris Standard does not use the personal information covered by this notice to make solely automated decisions about you that have legal or similarly significant effects.
Questions, requests or complaints
If you want to exercise a data protection right, correct something or raise a concern, contact Morris Standard directly.
Ian Morris trading as Morris Standard
27 High Street, Builth Wells, LD2 3DL
privacy@morrisstandard.co.uk
07485 091111
If you remain unhappy with how your information has been handled, you also have the right to complain to the Information Commissioner’s Office (ICO), the UK data protection regulator.
Make a data protection complaint to the ICONeed to ask something?
If something in this notice is unclear, or you want to know how a particular piece of information is being used, email privacy@morrisstandard.co.uk or contact Morris Standard directly.
Contact Morris Standard