Website Compliance Audit

Privacy Notice page created

UK-focused privacy notice at /privacy-notice covering data collection, lawful bases, sharing, retention, rights, and ICO complaint information. Accurately reflects the site's contact forms and authentication.

Cookie Policy page created

At /cookie-policy — documents only strictly necessary cookies (auth session, app cache, notice preference). Confirms no analytics, marketing, or tracking cookies are used.

Terms & Conditions page created

At /terms — covers website use, service information, pricing, enquiries/quotes, IP, external links, liability, and governing law (England & Wales).

Disclaimer page created

At /disclaimer — clarifies that site content is general information, not professional construction/engineering advice. Covers project images and no-guarantee language.

Cookie notice implemented

Informational (non-consent-gate) cookie notice shown on first visit. Dismissible, stored in localStorage. No consent banner needed because only strictly necessary cookies are used — no analytics or marketing tracking.

Platform analytics disabled

Base44 SDK initialised with analytics opt-out to ensure no platform-level analytics tracking runs without explicit consent.

Forms audited and updated

Both contact forms (Home page and Contact page) collect only necessary information (name, phone, service, extra info). Privacy explanation and link to Privacy Notice added. Required fields clearly marked.

Footer updated with legal links

Footer now includes links to Privacy Notice, Cookie Policy, Terms & Conditions, and Disclaimer.

Accessibility improvements

Skip-to-content link added. Select elements given aria-labels. Form labels verified. Alt text reviewed across images. Heading hierarchy checked on legal pages.

Security audit performed

No exposed API keys or secrets found in frontend code. Forms submit via SDK (not exposed publicly). No sensitive data in URLs. Auth handled securely by Base44 platform.

No AI chatbot present

No AI chatbot or AI assistant exists on the website. AI safety handling and AI disclosure requirements are not applicable.

Data retention period for enquiry emails

The Privacy Notice uses a placeholder. Client must confirm how long enquiry form submissions (sent via email) are retained. Example: "enquiry emails retained for 12 months."

Data retention for customer records

Client must confirm how long customer project records are retained after work is completed. This may be relevant for tax/accounting requirements.

International data transfers

The Privacy Note mentions Base44 may use cloud infrastructure outside the UK with appropriate safeguards. Client should confirm if they are aware of specific transfer arrangements.

Pricing information on the site

Terms state that any pricing displayed is indicative. Client must confirm whether any pricing is shown on the site and whether it is current. Currently no pricing is displayed.

Quote and contract process

Terms describe a general quote-to-contract process. Client must confirm the specific process: how quotes are provided, deposit requirements, and how contracts are formed.

Cancellation and refund policy

Terms use a placeholder for the standard cancellation policy, deposit terms, and refund conditions. Client must provide these details.

Business address discrepancy

The footer lists "54a Main Street, Cockermouth, CA13 9LU" but the Areas section describes the business as "Based in Maryport." Client must confirm the correct business address for legal documents.

Second email recipient (mike@stanwixautomations.com)

Contact forms send to both northwestdomesticconstruction@gmail.com and mike@stanwixautomations.com. Client must confirm this is intended and that mike@stanwixautomations.com is authorised to receive customer enquiry data. The Privacy Notice discloses this recipient.

Data controller registration with ICO

Client should confirm whether the business is registered with the ICO as a data controller if required. This is a legal obligation independent of this website.

AI chatbot / AI assistant

No AI chatbot exists on the website. AI disclosure and AI safety handling are not applicable.

Newsletter / marketing

No newsletter signup or marketing consent functionality exists.

Google Analytics

No Google Analytics or similar analytics service is used.

Meta Pixel / advertising

No Meta Pixel or advertising/tracking scripts are used.

Maps

No map embeds (Google Maps, etc.) are used.

YouTube / video embeds

No video embeds are used.

Social media embeds

Only links to Facebook/Google profiles — no embedded social content that sets third-party cookies.

Booking systems

No booking or scheduling system exists.

Payment systems

No online payment or checkout functionality exists.

Cookie consent banner

Not required — the site uses only strictly necessary cookies. An informational cookie notice is provided instead.

ICO registration

Confirm ICO registration as a data controller if the business processes personal data. This is a legal requirement independent of the website.

Professional indemnity / public liability insurance mention

Consider adding a statement about insurance coverage on the website to build customer trust. [CLIENT TO CONFIRM: insurance details]

Page title and meta description for SEO/accessibility

The current page title ("Best construction company, cumbria, near me...") is keyword-stuffed. Consider a cleaner title and adding a meta description for both SEO and screen reader clarity.

Areas page links

Several "Areas" links in the header and footer point to "#" (non-functional). Consider creating individual area pages or removing the links.

Form error handling

Contact forms currently do not display inline error messages if the email fails to send. Consider adding error feedback for users.

Data retention automation

Currently enquiry data is sent via email with no automated deletion. Consider implementing a data retention policy with automated deletion after a defined period.

Accessibility testing

Recommend conducting a full WCAG 2.2 AA audit with automated tools (e.g., axe DevTools) and manual screen reader testing.

Regular review

Review all legal pages and this compliance report at least annually, or when the website's functionality changes (e.g., if analytics, payments, or a chatbot are added).