This policy explains what personal information Notus Digital Ltd collects, why we collect it, how long we keep it and what your rights are. It covers people who visit notusdigital.co.uk, people who get in touch with us, our clients, and business contacts we may reach out to.
We have tried to write it in plain English. If anything is unclear, email [email protected] and we will explain.
Who we are
Notus Digital Ltd is the data controller for the information described in this policy. That means we decide how and why it is used, and we are responsible for looking after it.
- Company: Notus Digital Ltd, registered in England and Wales, company number 15465042
- Registered office: C/O Accrue Accounting, Unit E4 Arena Business Centre, Holyrood Close, Poole, BH17 7FP
- Trading address: Bognor Regis, West Sussex
- ICO registration number: ZB772773
- Email: [email protected]
- Phone: 01243 217 878
We are a small business and are not required to appoint a Data Protection Officer. Luke Hopkins, our director, is responsible for data protection. You can reach him using the details above.
What we collect and why
When you contact us
If you fill in one of our forms, email us or call us, we collect what you give us. Usually that is your name, email address, phone number, company name and details about your project.
We use it to reply to you, talk through your project and, if you ask, send you a quote. Our lawful basis is legitimate interests: you have asked us to get in touch and it is reasonable for us to do so. Where your enquiry leads to a contract, the basis becomes contract.
Newsletter and marketing emails
If you sign up to our newsletter, or tick the marketing box on a form, we use your name and email address to send you occasional emails about web design, SEO and our services. Our lawful basis is consent. Every email has an unsubscribe link, and you can withdraw your consent at any time.
Clients
When you work with us, we keep contact details for the people we deal with, along with contracts, invoices, project notes and correspondence. We need this to deliver the work and get paid (contract), and to keep the financial records the law requires (legal obligation).
We also need access to your website, hosting and marketing accounts, and these may contain personal information about your own customers. When we handle that information, we do it on your behalf and only on your instructions. You are the controller and we are the processor. Our contracts cover this, and we can provide a separate data processing agreement on request.
Business contacts and prospects
We sometimes contact businesses we think could benefit from our services. To do this we may collect a work name, job title, work email address, business phone number and company details from public sources such as company websites, LinkedIn, Companies House and business directories, or from B2B data providers.
Our lawful basis is legitimate interests: we are a business contacting other businesses about services relevant to their work. We only use work contact details, we keep messages relevant and infrequent, and every message tells you how to opt out. If you ask us to stop, we will. We keep a short record of your request so that we do not contact you again by mistake.
If we first got your details this way, this policy is the notice the law requires us to give you. We will point you to it in our first message.
Website visitors
When you visit our website, our servers and security tools record technical information such as your IP address, browser type, the pages you visit and the time of your visit. We use this to keep the site secure, stop spam and fix problems. Our lawful basis is legitimate interests.
With your permission, we also use analytics and advertising cookies to understand how people use the site and to measure our advertising. You choose which of these to allow through our cookie banner. Our cookie policy lists them in full.
Who we share it with
We do not sell your personal information. We share it only with the services we use to run the business, and only as much as they need. The main ones are:
- Website hosting and security: our hosting provider, Cloudflare (network security and speed), Wordfence (firewall) and CleanTalk (spam protection on our forms)
- Email: Google Workspace (our email and documents) and SendGrid (sends our website’s form notifications)
- Newsletter: Mailchimp
- Analytics and advertising: Google Analytics, Google Ads and LinkedIn, but only if you accept those cookies
- Running the business: Paymo (projects and invoicing), DocuSeal (contract signing), our accountants and our bank
We may also share information if the law requires it, for example with HMRC, or to protect our legal rights.
International transfers
Some of these providers, including Google, Mailchimp, SendGrid, Cloudflare and LinkedIn, may store or access data outside the UK, mostly in the United States. When that happens, we make sure the transfer is protected. This is done through the UK-US Data Bridge where the provider is certified under it, or through the UK International Data Transfer Agreement or Addendum built into the provider’s terms.
How long we keep it
- Enquiries that do not turn into work: up to 2 years after we last heard from you
- Client records, contracts and invoices: 6 years after the end of the financial year our work finished, as required for tax purposes
- Newsletter subscribers: until you unsubscribe
- Prospect contact details: up to 2 years after we last contacted you, or until you ask us to stop
- Opt-out requests: kept indefinitely, so that we do not contact you again
- Analytics data: kept in Google Analytics as long as it is useful to us. Our reports show totals and trends, and do not identify you.
- Website form entries: deleted from the website itself after 12 months. Any copy we need is kept in our email as above.
How we keep it safe
Our website runs over HTTPS and is protected by a firewall. Our accounts use strong, unique passwords and two-factor authentication wherever it is available. Access to client systems is limited to the people who need it for the work. We keep regular backups and keep software up to date.
No system is perfectly secure. If we have a breach that puts your information at risk, we will tell you and the ICO where the law requires it, and within the required time.
Your rights
Under UK data protection law you have the right to:
- Access the personal information we hold about you and get a copy
- Correct information that is wrong or incomplete
- Delete your information, where we no longer have a good reason to keep it
- Restrict how we use it while a concern is looked into
- Object to us using it on the basis of legitimate interests, including for direct marketing. If you object to marketing, we will always stop.
- Move information you gave us to another organisation, where it is processed by consent or contract
- Withdraw consent at any time, where we rely on it
To use any of these rights, email [email protected]. It is free, and we will reply within one month. We may ask you to confirm who you are before we act.
We do not make decisions about you using fully automated processes.
Complaints
If you are unhappy with how we have handled your information, please tell us first so we can try to put it right. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113.
Links to other websites
Our website links to other sites, including our clients’ websites and social media. We are not responsible for how those sites handle your information, so check their privacy policies.
Changes to this policy
We review this policy regularly and will update it when the way we handle data changes. The date at the top shows when it was last changed. If we make a significant change that affects you, we will let you know.