Websites built for UK buyers and UK rules

The Office for National Statistics estimates that 28.8% of retail sales were made online in August 2026, with online sales values 8.9% higher than a year earlier. Checkout should match how those customers pay. Stripe's UK guide says debit cards remain the most popular payment method overall and that 57% of UK adults were registered for a mobile wallet in 2024. Bank payments are growing too: by July 2026 more than one billion open banking payments had been made since launch, 40.16 million of them in June alone.

We connect the payment gateway you choose and test it on phones before launch. With Stripe, for example, Pay by Bank lets a customer approve a payment in pounds with their own bank, and Bacs Direct Debit suits subscriptions, although the first payment on a new mandate can take up to seven business days to confirm. Since 15 July 2026 the FCA has regulated buy now, pay later lending, so any instalment option at checkout should come from a lender that is FCA-authorised or in its temporary permissions regime.

Pricing has rules too. The standard VAT rate is 20%, and under the Price Marking Order the selling price shown to consumers includes VAT. Drip pricing has been banned since 6 April 2025, and the CMA's guidance says the total price should include mandatory charges, with delivery included wherever it can reasonably be calculated. The CMA can now fine businesses up to 10% of global turnover for breaking consumer law. We build product, basket and checkout templates so the first price a customer sees is the price they pay, before optional extras. For trade sellers, e-invoicing becomes mandatory for business-to-business VAT invoices from 2029, so B2B portals need clean order data.

The Consumer Contracts Regulations 2013 set out what a customer must be told before buying online: who you are and your geographical address, the total price including taxes, any delivery charges, and the conditions and time limit for cancelling. For goods, the cancellation period ends 14 days after the goods arrive; for services, 14 days after the contract is made. If you do not give the cancellation information, the period can run for up to 12 months longer. Delivery restrictions and accepted payment methods must be clear at the start of the ordering process, and the order button must make plain that ordering means paying, or the customer is not bound.

We build these into the store rather than a terms page: delivery and payment information before checkout starts, cancellation terms in the checkout and the order confirmation email, which doubles as the saveable copy of the contract GOV.UK guidance asks for, a returns page with a cancellation route, and an order button worded as your adviser approves. Company details come from one setting. A UK company must show on its website its registered name, the part of the UK where it is registered, its registered number and its registered office address, and the Electronic Commerce Regulations add an email address and any VAT number.

Since April 2025, fake reviews and hidden incentivised reviews have been banned, and businesses that publish consumer reviews must take reasonable and proportionate steps to prevent and remove fake ones. The ASA's advertising code covers marketing claims on your own website, not only paid ads. New subscription rules are due in January 2027, with clearer upfront information, reminders, an easier way out and a 14-day cooling-off period after a trial ends or a long-term contract renews. Review sections we build show genuine reviews only, which is also why this page shows project work rather than client quotes.

Data protection in the UK is governed by the UK GDPR and the Data Protection Act 2018, and most of the data protection changes in the Data (Use and Access) Act 2025 took effect on 5 February 2026. Privacy information has to be given when you collect data from people, in clear and plain language. Since 19 June 2026 organisations must also make it easy to raise a data protection complaint, for example with a complaint form that can be completed electronically, and acknowledge each complaint within 30 days. We add privacy notices where data is collected, an online complaint form, and forms cut to the fields you use.

Cookie rules changed on the same date. Analytics used only to improve your own site, and settings that remember how a visitor wants it to look, no longer need consent, provided visitors get clear information and a simple, free way to object. Advertising cookies and pixels still need consent. The ICO's final guidance, published in April 2026, says refusing must be as easy as accepting, non-exempt technologies need a positive action first, and consent must be as easy to withdraw as to give. PECR fines can now reach £17.5 million or 4% of global turnover. Before launch we list every tag, separate exempt uses from those needing consent, and configure the banner to match.

Working with us raises one more question. Pakistan is not covered by UK adequacy regulations, and the ICO counts making personal information accessible to an organisation outside the UK as a transfer. So we build and test with dummy data, keep live data in hosting, CRM and analytics accounts your business owns, limit our access to what support needs, and sign a data processing agreement with the terms Article 28 of the UK GDPR requires. Where our team needs access to personal data, your adviser chooses the safeguard, such as the ICO's transfer agreement or addendum.

The Equality Act 2010 requires service providers to make reasonable adjustments for disabled people. Because the duty is owed to disabled people generally, it is anticipatory: you plan for barriers before anyone meets them. GOV.UK guidance confirms this applies to all UK service providers, not only public bodies. The Act sets a duty rather than a technical checklist, so the practical benchmark is WCAG 2.2 AA, the standard public sector websites must meet. The Family Resources Survey counted 16.7 million disabled people in the UK in 2024 to 2025, 25% of the population.

WCAG 2.2, published in October 2023, added nine success criteria, among them focus that is not hidden behind sticky headers, minimum sizes for click and touch targets, alternatives to dragging, and sign-in without memory or puzzle tests. We build to WCAG 2.2 AA: semantic markup, full keyboard use, visible focus, checked contrast, labelled form fields with clear errors, and alt text planned with the content. Before launch we run automated and manual checks and hand over a written list of anything outstanding. No agency can promise a site will never draw a complaint; we can show how it was built against the standard.

Copy and interface text are set for UK readers, following the conventions in the GOV.UK style guide: organise rather than organize, dates written as 4 June 2026, times as 5:30pm, and prices in pounds without pence unless there are any. If you also sell in the US, we can build separate UK and US English versions with hreflang tags, so each audience gets its own spelling and prices.