Privacy
policy.
Proton Digital respects your privacy and is committed to protecting your personal data. This privacy policy explains how we collect, use and look after your personal data when you visit our website or use our services, and tells you about your privacy rights and how the law protects you.
This policy is written to comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
01Who we are
Proton Digital is the controller of your personal data. That means we are responsible for deciding how and why your personal data is used, and for keeping it safe.
- Business name: Proton Digital
- Email for privacy matters: support@protondigital.co.uk
02The data we collect about you
Personal data means any information about an individual from which that person can be identified. We may collect, use and store the following kinds of personal data:
| Category | What it includes |
|---|---|
| Identity data | First name, last name, title, and business or job title where relevant. |
| Contact data | Email address, telephone number, postal address. |
| Enquiry data | The content of messages you send us through contact forms, email or phone, including any project details you choose to share. |
| Account data | If you have a client portal account: your login email, profile details, an optional profile photo, and the content you add during onboarding. |
| Transaction data | Details of payments to and from you and details of services you have purchased from us, where applicable. |
| Technical data | IP address, browser type and version, device type, operating system, time zone setting and location, and other technology on the devices you use to access this website. |
| Usage data | Information about how you use our website, such as pages visited, time on page and referral source. |
| Marketing data | Your preferences in receiving marketing from us and your communication preferences. |
We do not collect any special categories of personal data about you (such as details of your race, religion, health or sexual orientation), and we do not collect any information about criminal convictions or offences.
If you fail to provide personal data that we need in order to enter into or perform a contract with you, we may not be able to provide the service you have asked for. We will tell you if this is the case at the time.
03How we collect your data
- Directly from you. When you fill in a form on our website (including our discovery flow and contact form), create a client portal account, email us, phone us, ask for a quote, buy a service, or give us feedback.
- Automatically. As you use our website, we may collect technical and usage data through cookies and similar technologies. See section 05 for details.
- From our service providers. Our hosting, database and email delivery providers (see section 07) process data on our behalf as you use the website. Payments are made by bank transfer directly to us — we do not use a card payment processor.
04How and why we use your data
We will only use your personal data when the law allows us to. Under UK GDPR, we rely on the following lawful bases:
| Purpose | Data used | Lawful basis |
|---|---|---|
| Responding to enquiries and providing quotes | Identity, Contact, Enquiry | Legitimate interests (responding to people who contact us), or steps taken at your request before entering a contract |
| Delivering services you have purchased, including the client portal | Identity, Contact, Account, Transaction | Performance of a contract with you |
| Managing payments, invoicing and debt recovery | Identity, Contact, Transaction | Performance of a contract; legitimate interests (recovering money owed) |
| Keeping accounting and tax records | Identity, Contact, Transaction | Legal obligation |
| Running, securing and improving our website | Technical, Usage | Legitimate interests (keeping our website secure and working well); consent, where cookies require it |
| Sending marketing communications | Identity, Contact, Marketing | Consent, or the soft opt-in for existing customers (see section 06) |
| Notifying you about changes to our terms or this policy | Identity, Contact | Legal obligation; legitimate interests |
Where we rely on legitimate interests, we have balanced our interests against your rights and freedoms and concluded that our use of your data is fair and proportionate. You can ask us for more information about this balancing exercise at any time.
We do not use your personal data for automated decision-making that produces legal or similarly significant effects on you.
05Cookies
Cookies are small text files placed on your device when you visit a website. We currently use only strictly necessary cookies — for example to keep you signed in to the client portal securely. These are essential for the website to function and do not require consent.
We do not currently use analytics or advertising cookies. If that changes, we will update this policy and ask for your consent through a cookie banner before any such cookies are set. You can also set your browser to refuse all or some cookies, though parts of the website (such as the client portal) may then not work properly.
06Marketing
We will only send you marketing emails if you have opted in, or if you are an existing customer and we are telling you about our own similar services (known as the soft opt-in under the Privacy and Electronic Communications Regulations).
Every marketing email we send includes an unsubscribe link. You can also opt out at any time by contacting us using the details in section 16. Opting out of marketing does not affect data we process for other purposes, such as delivering a service you have purchased.
We do not sell your personal data to anyone.
07Who we share your data with
We may share your personal data with the following categories of recipients, and only where necessary:
- Service providers who support our business: website hosting (Vercel), our secure database and login provider (Supabase), transactional email delivery (Resend), and our domain and mailbox provider (Fasthosts).
- Professional advisers including accountants, lawyers, bankers and insurers, where they need it to provide their services to us.
- HM Revenue and Customs, regulators and other authorities where we are required to report or disclose by law.
- A buyer or merger partner if we sell, transfer or merge parts of our business, in which case the new owners must use your data in line with this policy.
We require all third parties to respect the security of your personal data and to treat it in accordance with the law. Our service providers may only process your personal data on our instructions.
08International transfers
Some of our service providers may store or process data outside the UK. Whenever your data leaves the UK, we make sure it receives an equivalent level of protection by using at least one of the following safeguards:
- Transferring to countries covered by UK adequacy regulations, which the UK Government has confirmed provide an adequate level of protection.
- Using the UK International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses, with the receiving organisation.
You can contact us for more information about the specific safeguards used for any transfer.
09How long we keep your data
We only keep your personal data for as long as necessary for the purposes we collected it for, including legal, accounting and reporting requirements. As a guide:
| Data | Typical retention period |
|---|---|
| Enquiries that do not become customers | 12 months from last contact |
| Customer records and contracts | 6 years after the relationship ends, in line with limitation periods |
| Accounting and tax records | 6 years from the end of the relevant financial year, as required by law |
| Marketing preferences | Until you opt out, then a record of the opt-out itself |
When your data is no longer needed, we securely delete or anonymise it.
10How we protect your data
We have put in place appropriate technical and organisational measures to prevent your personal data being accidentally lost, used, altered, disclosed or accessed in an unauthorised way. These include encrypted connections (HTTPS), access controls limiting data to those who need it, and reputable UK or adequacy-covered providers.
We have procedures in place to deal with any suspected personal data breach, and will notify you and the Information Commissioner's Office of a breach where we are legally required to do so.
11Your legal rights
Under UK data protection law, you have the following rights over your personal data:
| Right | What it means |
|---|---|
| Access | Ask for a copy of the personal data we hold about you (a subject access request). |
| Rectification | Ask us to correct data that is inaccurate or incomplete. |
| Erasure | Ask us to delete your data where there is no good reason for us to keep it. |
| Restriction | Ask us to pause our use of your data in certain circumstances. |
| Objection | Object to our use of your data where we rely on legitimate interests, and object at any time to direct marketing. |
| Portability | Ask us to transfer your data to you or another provider in a structured, machine-readable format. |
| Withdraw consent | Withdraw consent at any time where consent is the basis we rely on. This does not affect processing carried out before you withdrew it. |
To exercise any of these rights, contact us using the details in section 16. You will not have to pay a fee, unless your request is clearly unfounded, repetitive or excessive. We may need to ask you for specific information to confirm your identity before we respond.
We aim to respond to all legitimate requests within one month. If your request is particularly complex, it may take longer, and we will keep you updated.
12Children
Our website and services are not directed at children, and we do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, please contact us and we will delete it.
13Links to other websites
Our website may include links to third-party websites. Clicking those links may allow third parties to collect data about you. We do not control these websites and are not responsible for their privacy practices. We encourage you to read the privacy policy of every website you visit.
14Complaints
If you have a concern about how we handle your personal data, please contact us first so we can try to resolve it. You also have the right to complain at any time to the UK supervisory authority:
- Information Commissioner's Office (ICO)
- Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
- Telephone: 0303 123 1113
- Website: ico.org.uk
15Changes to this policy
We keep this policy under regular review. When we make changes, we will update the version number and effective date at the top of this page. Where changes are significant, we may also notify you by email or by a notice on our website.
16How to contact us
Questions about this policy, or about how we handle your personal data, should be sent to:
- Email: support@protondigital.co.uk