Data protection, privacy rights and GDPR-focused digital service practices

We may process personal data to prepare quotes, communicate with clients, deliver website development, build software, support apps, manage CMS websites, configure Shopify stores, complete SEO tasks, provide support and manage project obligations.

We may process information for legitimate business interests such as responding to enquiries, improving services, securing our website, preventing abuse, maintaining records, managing client communication and understanding website performance.

Where required, we may rely on consent for certain optional activities such as marketing communication, non-essential cookies or specific data handling choices. Consent may be withdrawn where applicable.

We may retain or process information where needed for accounting, tax, legal, regulatory, dispute resolution, security or compliance reasons.

These legal bases are not usually relevant to our standard digital services, but may apply in exceptional situations where law permits or requires them.

For some projects, the client may decide what data their website, app, portal, dashboard or store collects from end users. In that case, the client may be responsible for its own lawful basis, notices, consent mechanisms and compliance decisions.

Essential cookies may be used to operate the website, support forms, maintain sessions, protect security, reduce spam and enable client portal or login functionality where available.

Analytics tools may help us understand traffic sources, page performance, user behavior, device types, popular service pages, enquiry paths and website improvement opportunities.

Where campaigns are active, tracking tools may help measure quote requests, contact form submissions, call clicks, WhatsApp clicks, consultation bookings and campaign performance.

Users can usually manage cookies through browser settings. If a cookie banner or consent tool is active, users may be able to manage optional cookie categories through that tool.

Server logs may automatically record technical information such as IP address, requested page, browser type, timestamp, errors and security events. Logs help troubleshoot issues and protect systems.

For more details about cookies, analytics and similar technologies, please review our Cookie Policy and Privacy Policy.

We use reasonable technical and organizational measures designed to protect personal data and project information from unauthorized access, loss, misuse, alteration, disclosure or destruction.

Information should be accessed only by team members, partners or providers who need it for project delivery, support, billing, communication, security or business administration.

Clients should not submit sensitive passwords, private keys, banking credentials or confidential access details through public forms. Secure access sharing should be agreed where needed.

We retain personal data only for as long as reasonably necessary for enquiries, projects, support, billing, legal obligations, accounting, security, dispute resolution and legitimate business records.

Where appropriate, information may be deleted, archived, anonymized or restricted when it is no longer needed. Some records may be retained for legal, billing, contractual or security reasons.

No online system can be guaranteed completely secure. Clients should use strong passwords, maintain backups, keep platforms updated and follow secure access practices.

Hosting, analytics, email, cloud, payment, support, project management, file storage and software providers may operate infrastructure or teams in different countries.

Where applicable, data transfers should use appropriate safeguards such as provider contractual terms, data processing agreements, approved mechanisms or other lawful methods depending on the jurisdiction and service.

Clients may choose platforms such as Shopify, WordPress hosting, payment gateways, CRM tools, email marketing tools or cloud providers. Clients should review provider privacy and transfer terms for their own compliance needs.

If a client needs regional hosting, data residency, special contractual clauses, private infrastructure, restricted provider use or compliance-specific architecture, this should be raised before project approval.

Third-party providers control their own infrastructure, processing locations, compliance documents, security practices and update schedules.

Where data protection agreements, processor terms or custom contractual obligations are needed, they should be reviewed and agreed in writing before work begins.