Web Development · United Kingdom

Web Development Company UK

A remote web team building sites for UK companies that meet PECR cookie rules, display pricing correctly, and hold up under public sector accessibility scrutiny.

Get a project estimate Talk to a developer

NDA on request · Free, no-obligation estimate · Reply within one business day

London skyline with Tower Bridge, the Shard and the City over the Thames

Wide monitor showing a website on a bright desk with an ergonomic chair

NDA before discovery

You own the code and IP on payment

Code in your repository from day one

A working demo every two weeks

Senior engineers do the work

How we work

A website built for a UK company runs into two rules almost immediately that a US-focused build wouldn't: PECR governs what a cookie banner has to offer before tracking starts, and consumer law expects prices shown to include VAT for anything sold to the public. A web development company working with UK businesses treats both as build requirements from the first sprint rather than a compliance pass added before launch.

Public sector and charity clients add a further layer, since anything reasonably connected to a public function needs to meet the Public Sector Bodies Accessibility Regulations 2018, which in practice means WCAG 2.2 AA and a published accessibility statement rather than a design that merely looks accessible.

Market

What buyers in the UK need from this work

PECR governs the cookie banner, not just UK GDPR
Non-essential cookies and tracking scripts, analytics, ad pixels, embedded video, need clear consent under PECR before they fire, not a banner that loads them by default with an opt-out buried in settings. We build the consent layer to block those scripts until consent is given, which is a stricter standard than many cookie banners actually meet.
VAT-inclusive pricing for consumer-facing sites
UK consumer protection rules expect prices shown to consumers to include VAT where it applies, rather than adding it at checkout as a surprise. We build the pricing display and the checkout total to match, since a mismatch between the advertised price and the checkout price is a common source of complaints and refund requests.
Public sector accessibility rules where they apply
A site built for or adjacent to the public sector (a council-funded service, an NHS-adjacent charity, a housing association) falls under the Public Sector Bodies Accessibility Regulations 2018, which requires WCAG 2.2 AA and a published accessibility statement, not just a general effort toward accessibility.
Data residency preferences
Some UK buyers, particularly in the public sector or financial services, prefer hosting inside the UK or EEA over a US region by default, which changes the hosting provider and region selected during the build rather than something adjusted after launch.
Donation and payment forms need Strong Customer Authentication
A donation form, retainer payment or any card transaction taken directly on the site falls under the UK's Strong Customer Authentication rules, which generally require 3D Secure-style verification rather than a single-step card charge. We build the payment flow to support that verification step, since a form that skips it risks declined transactions once a card issuer enforces the requirement.
The accessibility statement is a published artifact, not just conformant code
The Public Sector Bodies Accessibility Regulations require a published accessibility statement covering known gaps, a review date and a feedback route for reporting problems, on top of WCAG 2.2 AA conformance in the code itself. We draft and publish that statement as a deliverable alongside the build rather than treating conformant code as satisfying the regulation on its own.

Compliance we plan for

PECR for cookies, tracking and marketing email consent
UK GDPR and Data Protection Act 2018 for data collected through the site
WCAG 2.2 AA and Public Sector Bodies Accessibility Regulations 2018 where applicable
VAT-inclusive pricing display for consumer-facing sites

How the engagement runs

Sites are typically quoted as a fixed-scope build for the first phase, with content and feature work moving to a retainer once the site is live. A data processing agreement covering any personal data the site collects sits inside the same contract as the statement of work.

Delivery runs against UK working hours, and the codebase and hosting account are set up under the client's own accounts so there's no dependency on us to keep the site running after launch. Invoicing is in GBP against agreed milestones.

Industries

Industries we often work with here

FAQ

Frequently asked questions

Does our cookie banner need to block scripts until someone consents?

Under PECR, yes, for anything non-essential, analytics, ad pixels, embedded video. A banner that loads those scripts by default and treats the banner as decoration doesn't meet the standard, even if it displays an accept and reject option.

Do we need to show prices including VAT on our site?

For anything sold to consumers, yes, UK consumer protection rules expect the advertised price to include VAT rather than adding it as a surprise at checkout. B2B pricing can be shown exclusive of VAT if that's clearly labelled.

Does our charity website need to meet accessibility regulations?

If the site delivers a public sector-adjacent service, funded through a council or the NHS, it likely falls under the Public Sector Bodies Accessibility Regulations 2018, which requires WCAG 2.2 AA and a published accessibility statement, not just a general accessibility effort.

Can you host our site in the UK or EEA instead of the US?

Yes. We select the hosting region during setup based on the client's data residency preference, which is common among public sector and financial services buyers, without it affecting site performance for UK visitors.

How do you handle our site's GDPR data processing agreement?

The DPA is bundled into the same contract as the build, covering what personal data the site collects (form submissions, analytics, newsletter sign-ups) and how it's processed and retained, so there's one document rather than a separate negotiation.

Does our donation form need to support Strong Customer Authentication?

Yes, if it takes a card payment directly. UK Strong Customer Authentication rules generally require a 3D Secure-style verification step rather than a single-step charge, and skipping it risks declined transactions once a card issuer enforces the requirement.

Is a published accessibility statement required, or is WCAG-conformant code enough?

Both are required. The Public Sector Bodies Accessibility Regulations expect a published statement covering known gaps, a review date and a feedback route, in addition to WCAG 2.2 AA conformance in the code. We draft and publish that statement as part of the build rather than treating conformant code alone as sufficient.