Privacy Policy

2. Who We Are

Byron Digital provides website design, software development, web applications, hosting, digital services and technical support.

For personal information covered by this policy, the data controller is:

Byron Digital

Email: sals@byrondigital.co.uk
Telephone: 01159635770

When we determine why and how personal information is used, Byron Digital acts as the data controller.

In some circumstances, we process information on behalf of a customer, such as information stored within a website, application, booking system, customer portal or other system that we have developed or host for them. In those circumstances, the customer will usually be the data controller and Byron Digital will act as a data processor.

Questions about information entered into a client’s system should normally be directed to that client first.

3. Personal Information We Collect

Depending on how you interact with us, we may collect the following information.

Identity and contact information

This may include:

• your name;
• business or organisation name;
• job title;
• postal address;
• email address;
• telephone or mobile number; and
• preferred method of contact.

Enquiry and project information

This may include:

• information submitted through contact or quotation forms;
• project requirements;
• budgets and proposed timescales;
• meeting notes;
• correspondence;
• technical requirements;
• website content; and
• information needed to prepare or manage a proposal, contract or project.

Account information

Where you register for one of our online services, we may collect:

• your username;
• email address;
• encrypted or hashed password;
• account status;
• organisation or team details;
• permissions and user roles;
• subscription or plan information;
• login records;
• security information; and
• account preferences.

We do not normally have access to your original password because passwords should be stored using one-way cryptographic hashing.

Payment and transaction information

This may include:

• products or services purchased;
• subscription status;
• invoice information;
• payment dates;
• transaction references;
• payment status; and
• limited billing information received from a payment provider.

Payments may be processed through providers such as Stripe, GoCardless, PayPal or SumUp, depending on the service and payment method.

Payment providers process payment-card or bank-account information under their own privacy policies. Byron Digital does not normally store complete payment-card details.

Information uploaded to our services

Some services allow customers or authorised users to upload information such as:

• images;
• videos;
• audio;
• documents;
• website content;
• QR-code destinations;
• customer or booking records;
• product information;
• location information;
• technical data; and
• other files or information required by the service.

Customers are responsible for ensuring that they have a lawful basis for uploading personal information relating to other people.

You should not upload sensitive or special-category personal information unless the service specifically requires it and appropriate arrangements have been agreed with Byron Digital.

Technical and usage information

When you use our website or online services, we may automatically collect:

• IP address;
• approximate location derived from an IP address;
• browser type and version;
• device type;
• operating system;
• screen size;
• referring website;
• pages or features used;
• dates and times of access;
• session information;
• cookie identifiers;
• diagnostic information;
• security events; and
• application or server logs.

Communications and support information

We may retain information from:

• emails;
• telephone calls;
• meetings;
• support requests;
• fault reports;
• contact forms;
• demonstrations;
• feedback;
• complaints; and
• other communications with us.

Marketing information

Where applicable, we may collect:

• marketing preferences;
• newsletter subscriptions;
• records of consent;
• records of previous marketing communications; and
• information about whether communications were opened or interacted with.

4. How We Collect Information

We collect personal information:

• directly from you;
• when you complete a form;
• when you communicate with us;
• when you request a quotation;
• when you enter into a contract with us;
• when you create or use an account;
• when you purchase or subscribe to a service;
• when you upload information;
• automatically through cookies, logs and similar technologies;
• from payment providers;
• from customers who authorise you to use their system;
• from referrals, networking contacts or business partners; and
• from publicly available business sources where appropriate.

Where someone provides your information to us on your behalf, they are responsible for ensuring they are authorised to do so.

5. How We Use Personal Information

We may use personal information to:

• respond to enquiries;
• prepare quotations and proposals;
• assess project requirements;
• provide websites, applications, hosting and digital services;
• create and administer customer accounts;
• manage subscriptions;
• process and reconcile payments;
• communicate about projects or services;
• provide technical support;
• investigate faults and security incidents;
• maintain, monitor and improve our systems;
• prevent fraud, misuse and unauthorised access;
• create backups and maintain service availability;
• keep financial, contractual and business records;
• manage complaints and legal claims;
• comply with legal and regulatory obligations;
• send service-related notices;
• send marketing communications where permitted; and
• understand how our website and services are used.

We will not use personal information for a materially incompatible purpose without considering whether an additional lawful basis, notification or consent is required.

6. Our Lawful Bases

We rely on one or more of the following lawful bases.

Contract

We may process information where it is necessary to:

• provide a requested quotation;
• take steps before entering into a contract;
• deliver a contracted service;
• administer an account or subscription;
• process a payment; or
• provide customer support.

Legal obligation

We may process information where required to:

• maintain tax and accounting records;
• respond to a valid legal request;
• meet data-protection obligations;
• comply with court orders; or
• meet other legal or regulatory requirements.

Legitimate interests

We may process information where it is reasonably necessary for our legitimate business interests, including:

• responding to business enquiries;
• operating and improving our services;
• securing websites, applications and systems;
• detecting fraud or misuse;
• maintaining appropriate business records;
• managing customer relationships;
• recovering unpaid amounts;
• establishing or defending legal claims; and
• undertaking proportionate business-to-business marketing.

We consider the effect of this processing on your rights and interests before relying on legitimate interests.

Consent

We may rely on consent for:

• optional marketing communications;
• non-essential cookies;
• certain analytics or tracking technologies; and
• any other processing where consent is specifically requested.

You may withdraw consent at any time. Withdrawal does not affect processing that took place before consent was withdrawn.

7. Cookies and Similar Technologies

Our website and online services may use cookies, local storage, pixels and similar technologies.

These may include:

Strictly necessary technologies

These are required for functions such as:

• security;
• authentication;
• account sessions;
• load balancing;
• shopping baskets;
• subscription management;
• form completion; and
• remembering privacy choices.

These technologies may be used without consent where they are necessary to provide a service requested by the user.

Preference technologies

These remember choices such as language, layout or display preferences.

Analytics technologies

These help us understand how visitors use our website and services, including which pages or features are used and whether errors occur.

Marketing technologies

These may be used to measure campaigns or provide relevant advertising where applicable.

We will request consent before using non-essential cookies or similar technologies where consent is required.

You can accept, reject or change your cookie preferences through the cookie controls provided on our website. You can also restrict cookies using your browser settings, although doing so may prevent parts of a website or service from working correctly.

More detailed information about individual cookies, providers and expiry periods should be provided through our cookie settings or separate Cookie Policy.

8. Marketing Communications

We may send information about Byron Digital services where:

• you have specifically requested it;
• you have given consent;
• applicable electronic-marketing rules permit us to contact you; or
• we have another lawful basis for proportionate business-to-business communication.

You can unsubscribe at any time by:

• using the unsubscribe option in a marketing message; or
• contacting Byron Digital using the details in this policy.

Service messages, security notices, invoices and other communications necessary to administer an active account or contract are not marketing communications.

9. Sharing Personal Information

We do not sell personal information.

We may share information with carefully selected organisations where reasonably necessary, including:

• website and application hosting providers;
• domain, DNS and content-delivery providers;
• cloud-storage and backup providers;
• email and communication providers;
• payment providers;
• accounting and bookkeeping providers;
• analytics providers;
• security and fraud-prevention providers;
• software and infrastructure suppliers;
• contractors or developers working under appropriate obligations;
• professional advisers, including accountants, insurers and solicitors;
• public authorities, regulators or law-enforcement bodies where legally required; and
• a purchaser, investor or successor if all or part of the business is sold or reorganised.

Depending on the service used, relevant providers may include 20i, Microsoft, Google, Stripe, GoCardless, PayPal and SumUp.

We only provide service providers with the information reasonably necessary for them to perform their function. Where required, our arrangements with processors include contractual data-protection obligations.

10. Client Websites and Applications

Byron Digital designs, develops, hosts and supports websites and software for other organisations.

Where personal information is collected through a client’s website or application:

• the client will normally decide why the information is collected;
• the client will normally be the data controller;
• Byron Digital may process the information as a data processor;
• the client’s own privacy policy will normally apply; and
• the client is responsible for responding to requests from the people whose information it controls.

We may assist a client with a request, complaint or security investigation where required under our agreement with them.

11. International Transfers

Byron Digital is based in the United Kingdom. However, some service providers may store or process information outside the UK.

Where personal information is transferred outside the UK, we will take appropriate steps to ensure that the transfer is lawful. Depending on the circumstances, these measures may include:

• transferring information to a country covered by UK adequacy regulations;
• using the UK International Data Transfer Agreement;
• using the UK Addendum to approved standard contractual clauses;
• relying on another legally recognised safeguard; or
• relying on a specific legal exception where appropriate.

Further information about the safeguards used for a particular provider can be requested using the contact details in this policy.

12. Data Retention

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, including legal, accounting, security and contractual requirements.

Our normal retention criteria are:

Enquiries and unsuccessful quotations

Normally retained for up to two years after the last meaningful communication, unless a longer period is required because of a dispute, legal claim or continuing business relationship.

Customer and project records

Normally retained throughout the customer relationship and for up to six years afterwards, where needed for contracts, warranties, accounting, taxation or legal claims.

Financial records

Invoices, payment records and related accounting information are normally retained for at least the period required by applicable tax and accounting law, which will commonly be six years.

Account information

Retained while an account is active. Following closure, information may be retained for a limited period to complete deletion, maintain security records, resolve disputes and meet legal obligations.

Uploaded information

Retained while needed to provide the relevant service. When an account or service is closed, uploaded information will be deleted or anonymised in accordance with the applicable service terms and backup cycle.

Copies may remain temporarily in encrypted or protected backups until those backups are overwritten.

Technical and security logs

Retained for a proportionate period based on security, diagnostic and service-management requirements.

Support communications

Normally retained for up to three years after the matter is resolved, or longer where they form part of a contractual, financial or legal record.

Cookie and analytics information

Retained for the period shown in the applicable cookie settings or analytics configuration.

Data-protection requests and complaints

Retained for a period reasonably necessary to demonstrate that we handled the request or complaint appropriately and complied with our legal obligations.

Information may be retained for longer where required by law, a regulator, an active dispute or a legal claim.

13. Security

We use appropriate technical and organisational measures designed to protect personal information against:

• unauthorised access;
• accidental loss;
• alteration;
• disclosure;
• misuse; and
• destruction.

Measures may include:

• access controls;
• password hashing;
• encryption where appropriate;
• secure hosting;
• software updates;
• backups;
• malware and vulnerability controls;
• logging and monitoring;
• account permissions; and
• limiting access to people who reasonably require it.

No internet-based system can be guaranteed to be completely secure. You are responsible for keeping account credentials confidential and for notifying us promptly if you believe an account has been compromised.

14. Your Data-Protection Rights

Depending on the circumstances, you may have the right to:

• be informed about how your information is used;
• request access to your personal information;
• request correction of inaccurate or incomplete information;
• request deletion of your information;
• request restriction of processing;
• object to processing based on legitimate interests;
• object to direct marketing;
• request transfer of information you provided to us in a portable format;
• withdraw consent;
• challenge certain significant decisions made solely by automated means; and
• make a complaint about our use of your information.

These rights are not absolute. An exemption may apply, or we may need to retain information to meet a legal obligation or establish, exercise or defend a legal claim.

To exercise a right, contact Byron Digital using the details in this policy. We may request information to confirm your identity and ensure personal information is not disclosed to an unauthorised person.

We will respond without undue delay and within the applicable statutory period.

15. Automated Decision-Making

Byron Digital does not ordinarily use personal information to make decisions based solely on automated processing that produce legal or similarly significant effects.

Where a specific service uses automated decision-making of this kind, additional information about the processing, its consequences and available safeguards will be provided.

16. Children’s Information

Our business services and customer accounts are not generally directed at children.

We do not knowingly use children’s personal information for marketing. Where we develop or operate a service that is likely to be accessed by children, appropriate privacy protections and age-related considerations will be applied.

17. Data-Protection Complaints

You may make a complaint if you believe Byron Digital has not handled your personal information appropriately.

Please contact us using the email address or contact details shown in this policy and clearly state that your message is a data-protection complaint.

We will:

• provide an accessible way for you to make a complaint;
• acknowledge receipt within 30 days;
• investigate the circumstances appropriately;
• keep you informed where necessary; and
• communicate the outcome without undue delay.

We would appreciate the opportunity to address your concern directly.

You also have the right to complain to the UK Information Commissioner’s Office.

Information Commissioner’s Office helpline: 0303 123 1113

You can find further complaint information by visiting the Information Commissioner’s Office website.

18. Third-Party Websites

Our website or services may contain links to websites operated by other organisations.

Byron Digital is not responsible for the privacy, content or security practices of third-party websites. You should review the privacy policy of the relevant organisation before submitting personal information.

19. Changes to This Privacy Policy

We may update this Privacy Policy to reflect:

• changes to our services;
• changes to the providers we use;
• changes to our data-processing activities;
• legal or regulatory developments; or
• improvements to how we explain our practices.

The updated version will be published with a revised “last updated” date. Material changes may also be communicated through our website, an account notification or email where appropriate.

20. Contact Us

For privacy questions, requests or complaints, contact:

Byron Digital

Email: sales@byrondigital.co.uk
Telephone: 01159635770

Please include enough information for us to identify the relevant account, communication or service, but do not send unnecessary identification documents or sensitive information by ordinary email.