Who handles your information
Finn Digital Media Ltd is the controller responsible for personal information handled through WebWasp. WebWasp and First Search Digital are trading names of Finn Digital Media Ltd, company number 14351302, registered in England and Wales. Registered office: C/O Brennan Herriott & Co, 1 Blatchington Road, Hove, East Sussex, BN3 3YP, United Kingdom. Contact us about privacy at [email protected].
Recovery enquiries
When you use the enquiry form, we receive your name, email address, website address, description of the problem, when you noticed it, the access you still have and whether the site takes payments or bookings. We use these details to assess your request, carry out the initial investigation and respond with the next step or a quote.
The form sends an email to [email protected]. A copy is forwarded to [email protected] for handling by the business. The custom form does not create a separate database of enquiry submissions. The emails remain in the business mailboxes and may also be included in their backups.
We do not use the enquiry form to subscribe you to marketing. Please do not include passwords, customer records, private access links or complete backup files.
Why we use the information
Where you ask about services for yourself, we use the information to take steps at your request before entering a contract and, if you become a customer, to perform the agreed contract. Where you enquire on behalf of a business, our legitimate interest is to assess and respond to a business request. We also have a legitimate interest in protecting the website and preventing misuse. We will meet applicable legal record-keeping obligations where these apply.
Website checks and security records
The basic website checker receives the address you enter and requests a limited sample of public pages and internal links. Requests go to that website’s hosting service, which may record them. You must own the website or have permission to check it. The report is shown in your browser and can be downloaded by you; the custom scanner does not save the report as a WordPress submission.
To limit misuse, the custom enquiry form stores a keyed, hashed version of the connecting IP address with a sending counter for up to one hour after the last accepted attempt. The website checker uses a similar counter for up to ten minutes after the last attempt. These counters do not contain the enquiry text or scan report. Hosting and security services may separately record access and security events, including IP addresses.
Website cookies
WordPress and security tools may use cookies for sign-in, administration or security functions. The custom enquiry form and website checker do not add advertising cookies. Before optional analytics, advertising or other tracking is introduced, we will review its purpose, explain the use and provide any consent or choice required.
The current WebWasp pages do not load optional analytics or advertising scripts. WordPress sign-in cookies apply when an authorised user logs in to administer the site; they are not required to send a recovery enquiry or run the public website check. You can manage cookies in your browser. Disabling essential cookies may affect sign-in and security functions.
Who receives information
Authorised people handling the enquiry and service work can access the information they need. Hosting, email and backup providers process information to provide their services. The website and [email protected] mailbox are hosted through 20i. The website hosting package is located in London, UK. Enquiries are also forwarded to the business mailbox described above. If the services used to handle your information change, we will update this notice and put the required protections in place for any restricted international transfer. Read 20i’s privacy and retention information.
If recovery work needs additional access, file copies or specialist providers, we will agree the arrangements separately. Do not use the initial form to send credentials or sensitive site data.
How long information is kept
If an enquiry does not lead to work, we keep the enquiry correspondence for six months after our last contact, then delete it unless there is a specific outstanding issue or legal reason to retain it. Where work goes ahead, we retain the records needed to deliver the agreed service, manage follow-up and meet applicable accounting and legal obligations; a dispute or legal hold may require relevant records to be kept longer. We limit retained information to what is needed for those purposes.
Deleted information can remain in protected backup copies until the provider’s backup rotation removes it. Retention depends on the provider and backup type. Legacy copies from the previous HostPresto service may remain in its protected backups for up to 90 days after deletion, according to its published guidance. Backups are used for recovery rather than day-to-day enquiry handling. The custom rate-limit counters expire as described above.
Your information rights
Depending on the circumstances and the basis for processing, you may ask for access to your personal information, correction, deletion, restriction or a portable copy, and you may object to processing based on legitimate interests. We may need enough information to verify your identity before acting on a request.
Contact [email protected]. You can also raise a concern with the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint/.
Changes to this notice
We will update this notice when the service or the way information is handled changes. Last reviewed: 1 November 2026.