Our Privacy Policy

If we ever process special category data, we will rely on appropriate additional conditions (e.g. explicit consent or employment-related exceptions).

You have the right to withdraw consent where processing is based on consent; this will not affect processing based on other lawful bases.

5. How We Use Personal Data

We use personal data for purposes including (but not limited to):

• Responding to enquiries, providing services, and fulfilling contracts

• Sending newsletters, marketing campaigns, promotional materials

• Analytics, monitoring website usage and performance

• Optimising and personalising content and user experience

• CRM and client relationship management (via HubSpot etc.)

• Fraud prevention, security, billing, record keeping

• Meeting legal, tax, audit, and regulatory obligations

6. Sharing / Disclosing Personal Data

We may share your data with:

Third-party service providers / processors, including:

• Website hosting and CMS (Wix)

• Analytics providers (Google Analytics)

• Email marketing / automation (Mailchimp, HubSpot)

• CRM platforms (HubSpot)

• Advertising networks and other marketing partners

• Payment and billing providers, if relevant

• Professional advisors (legal, accounting, auditing)

• Law enforcement, regulators, or courts, if legally required or to protect rights

• Acquirers / successor entities, in the event of merger, sale, or reorganisation

Whenever we engage a third-party processor, we ensure there is a data processing agreement in place requiring compliance with data protection law and requiring them to implement appropriate security measures.

7. International Transfers of Personal Data

Because we use some third-party tools and services based (or with servers) outside the UK/EEA, data may be transferred to countries without an “adequacy decision.” We take the following safeguards:

• Wix may store and process data in data centres located in the United States, Ireland, and elsewhere. Wix uses Standard Contractual Clauses (SCCs) or other legal mechanisms for transfers outside adequacy territories. 

• Mailchimp commits to transferring and processing European / UK data under SCCs and under the EU-U.S and UK Data Privacy Framework as applicable. 

Where applicable, we put in place SCCs and additional technical, organisational safeguards to ensure an adequate level of protection.

We will inform you about the risks of transfers to third countries and your rights in respect of such transfers, on request.

8. Data Security & Breach Response

We implement appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing, and against accidental loss, destruction, or damage.

Examples of security measures include:

• Encryption in transit (TLS) and at rest

• Access controls and authentication mechanisms

• Regular security testing, vulnerability scanning, monitoring

• Segregation of data, logging, audit trails

• Incident response plans and disaster recovery

If a personal data breach occurs that is likely to result in a risk to individuals’ rights and freedoms, we will notify the UK Information Commissioner’s Office (ICO) within 72 hours (unless the breach is unlikely to result in risk), and communicate the breach to affected individuals as required by law.

9. Data Storage & Retention

​

Our company is hosted on the Wix.com platform. Wix.com provides us with the online platform that allows us to sell our products and services to you. Your data may be stored through Wix.com’s data storage, databases and the general Wix.com applications. They store your data on secure servers behind a firewall.  

​

All direct payment gateways offered by Wix.com and used by our company adhere to the standards set by PCI-DSS as managed by the PCI Security Standards Council, which is a joint effort of brands like Visa, MasterCard, American Express and Discover. PCI-DSS requirements help ensure the secure handling of credit card information by our store and its service providers.

We retain personal data for no longer than necessary for the purposes for which it was processed, including to satisfy legal, accounting, or reporting requirements.

Typical retention periods:

• Marketing contacts and subscribers: up to 3–5 years (unless unsubscribed)

• Client and project records: 6 years (for legal / tax audits)

• Inactive leads: 2 years

• Analytics / log data: anonymised or aggregated after 1–2 years

When data is no longer needed, we securely delete or anonymise it.

10. Your Rights

Under UK GDPR, you have the following rights (where applicable):

• Right to access your personal data

• Right to correct inaccurate or incomplete data

• Right to erase (right to be forgotten)

• Right to restrict processing

• Right to data portability

• Right to object to processing (including marketing)

• Right to withdraw consent (for processing based on consent)

• Right to complain to the ICO or other supervisory authority

To invoke any of these rights, please contact us using the contact details above. We will respond without undue delay and in any event within one month (or, if more complex, up to three months, with explanation).

11. Cookies, Tracking & Similar Technologies

We use cookies, pixels, tags, and other tracking technologies to collect and store information.