The answers before you have to ask for them.
The creative conversation goes well, and then it meets legal, finance and IT. This page is what they ask for, published in advance — entity and contracting, intellectual property, data protection, security posture, accessibility and continuity.
Print this page for your supplier file. Nothing here is asserted unless it has been confirmed; where something is still outstanding it says so, along with what is needed. The binding documents are our Terms & Conditions and Privacy Policy — where this summary and those differ, those govern.
6 items are marked To confirm. They are administrative facts — registration numbers, insurance schedules, a jurisdiction clause — that belong to the company record rather than to a web page, and we would rather show the gap than fill it with something plausible. Ask and they are supplied same-day, under NDA if you need them to be.
We contract in whatever form your procurement function requires. Where you have a standard agreement we work to it; where you do not, we supply ours.
Each party keeps what it already owned. You grant us a licence to use your materials as needed to do the work; nothing about your brand, content or data becomes ours.
Subject to full and cleared payment of everything due on the project, we assign or license the final bespoke deliverables to you to the extent set out in the statement of work. That last phrase matters and we would rather draw attention to it than let it be discovered later: the scope of the transfer is defined per engagement, so if you need outright assignment of specific items — source code, design files, a name — say so during contracting and it is written into the statement of work. Before full payment you hold a revocable licence to review the work only.
What stays with us by default: our pre-existing and reusable tools, methods, code modules, libraries, design systems and automation components. Where those are embedded in something you have paid for, you get a perpetual, non-exclusive, non-transferable licence to use them as part of that deliverable. Concepts not selected, drafts and working production files also stay with us unless the statement of work transfers a named item.
Third-party and open-source materials — typefaces, stock, plugins — remain under their own licences, and any ongoing fees are yours. We identify those before they are used rather than after.
On domains, hosting and platform accounts, you nominate the legal owner. We will administer them for convenience, but we do not become the beneficial owner and you should not want us to be. Renewals, credential custody and independent backups sit with the account owner.
We may show your name, logo and publicly launched work in our portfolio and pitches, without disclosing confidential performance data. A confidentiality restriction agreed in writing before launch overrides that, which is the normal arrangement for marine and other sensitive clients.
For personal data belonging to your customers, you are the controller and we act as processor on your documented instructions. For the contact details of your own staff working with us, we are controller for the limited purpose of running the engagement.
Third parties that may process personal data on your behalf as part of delivery. You are notified before any addition to this list.
| Subprocessor | Purpose | Region |
|---|---|---|
| Vercel | Application hosting and content delivery | Global edge, primary region configurable |
| PageSpeed Insights measurement; analytics where enabled | Global |
Project-specific subprocessors — a payment gateway, an email platform, a CRM — are the ones you already use, and are named in the statement of work rather than assumed here.
We are a small senior team, not an enterprise with a security department. What follows is what we actually do, stated plainly, rather than a policy library written for the questionnaire.
We target WCAG 2.2 Level AA on core journeys as standard, not as an upsell. Automated tooling runs in the build; the remainder is a manual pass with a keyboard and a screen reader, because automated testing catches roughly a third of the criteria and the third it catches is the easy third.
Our own site publishes its accessibility position on its specification page, including the parts not yet measured. If you require a formal conformance report or a VPAT for a specific deliverable, that is a defined piece of work we will quote rather than a claim we will assert.
The honest position: we are a small team, and concentration of knowledge in a small number of people is the principal risk of engaging us. We would rather set that out here than have it discovered during a due-diligence call.
What we do about it. Two technical owners hold overlapping knowledge of every engagement, so no project has a single point of understanding. Decisions are recorded in a written log rather than held in someone’s memory. Everything is built on mainstream, widely supported technology — Next.js, React, WordPress, Shopify, Supabase — specifically so that another competent team could take it over. Domains, hosting and platform accounts are registered in your name from the start, so the assets are not stranded with us at any point. And a documented handover is a defined deliverable in the statement of work rather than a favour at the end of one.
One thing to be clear about, because it is in our terms and buyers should see it here rather than find it in clause 21: on termination we release paid-for final deliverables, and we are not obliged to release unpaid work, working files or credentials to systems we own. That is a payment-protection mechanism, not a hostage mechanism — it is why the handover deliverable and the ownership-of-accounts arrangement above matter, and why they are agreed at the start.
What we do not have: a bench deep enough to absorb both owners being unavailable simultaneously. If your risk assessment requires that, a larger supplier is the correct answer and we will say so during procurement rather than after.
Need this on your own form?
Most procurement teams have a supplier questionnaire they would rather we completed than read a page. Send it over — we will complete it and return it, and if there is a question we have to answer “no” to, the answer will be no.