1. Who we are
Digital Marvels Limited (“Digital Marvels”, “we”, “us”) is the controller of the personal data described in this policy. We are registered in England and Wales under company number 17443003. Full company details are in our Terms of Service.
This policy covers visitors to www.digitalmarvels.tech, people who contact us, newsletter subscribers, and our prospective and current clients. The person responsible for data protection can be reached at privacy@digitalmarvels.tech.
When we build or host a website that collects your own customers’ data, we handle that data on your behalf as your processor. In that case your own privacy notice applies, and our Terms of Service set out how we protect it.
2. What we collect
We only collect what we need. Depending on how you use our website and services, this may include:
- Contact and consultation forms: your name, email address, phone number, preferred date and time for a call, project type and your message.
- Start Your Project form: your contact details, company name, industry and project details (goals, audience, features, budget range, timeline, technology, hosting and security needs), plus any files you upload. You can upload up to 5 files of up to 10 MB each. Your answers are also saved as a draft in your own browser until you submit them, and we cannot see that draft.
- Newsletter: your email address and the page where you signed up.
- Privacy requests and complaints: your name, email address, the details of your request, and anything we need to confirm your identity.
- Clients: the contact details of the people we work with, our correspondence, project materials you provide, and billing records. We do not store payment card details.
- Security data: when you submit a form, your IP address is used for a few minutes to limit repeated submissions and block abuse. It is not saved with your submission. Our hosting provider also keeps standard server logs, which include IP address, browser and pages requested.
- Analytics, only if you accept analytics cookies:pages viewed, clicks and other interactions, page performance measurements, your device and browser type, and your approximate location. Google estimates the location from your IP address and does not store the IP address in Google Analytics.
We do not ask for special category data, such as health information. Please do not include it in messages or uploads, or other people’s personal data unless you need to.
3. How we use it, and our lawful bases
UK data protection law requires a lawful basis for each way we use personal data. Ours are:
| Purpose | Data used | Lawful basis |
|---|---|---|
| Responding to enquiries, arranging calls and preparing quotes | Form details and uploaded files | Taking steps at your request before a contract. If you contact us for an organisation: our legitimate interest in responding to business enquiries |
| Delivering services, managing projects and invoicing | Client contact, project and billing data | Performing our contract with you. Keeping accounting records is a legal obligation |
| Sending our newsletter | Email address | Your consent, which you can withdraw at any time |
| Keeping our website and forms secure, and preventing spam and abuse | IP address, server logs | Our legitimate interest in protecting our website and the people who use it |
| Understanding how our website is used, so we can improve it | Analytics data | Your consent, given through your cookie choice |
| Handling privacy requests and complaints | Request details | Legal obligation |
| Complying with the law, handling legal claims, or selling or reorganising our business | Relevant records | Legal obligation, or our legitimate interests |
Where we rely on legitimate interests, we have balanced them against your rights, and you can object at any time. If you do not give us the details a form asks for, we may not be able to respond. We do not sell personal data, use it for advertising, or make decisions about you using only automated processing.
6. International transfers
Some of our providers are based in, or process data in, the United States or other countries outside the UK. When personal data leaves the UK, we make sure it stays protected through one of these:
- UK adequacy regulations, including the UK Extension to the EU-US Data Privacy Framework for certified US companies; or
- the ICO’s International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses.
Email privacy@digitalmarvels.tech for details of the safeguard for a particular transfer.
7. How long we keep it
We keep personal data only as long as we need it. When the period ends, we delete it or make it anonymous.
| Data | How long we keep it |
|---|---|
| Enquiries and quote requests that do not lead to a project | 24 months after our last contact with you |
| Files uploaded with an enquiry that does not lead to a project | 12 months |
| Client project records, contracts and invoices | 6 years after the contract ends, for tax and legal purposes |
| Newsletter subscription | Until you unsubscribe. We then keep only a one-way fingerprint (hash) of your email address on a do-not-contact list, so we do not email you again |
| Privacy requests and complaints | 3 years after the request or complaint is closed |
| IP addresses used for rate limiting | Deleted automatically within minutes |
| Server logs | The short period set by our hosting provider |
| Google Analytics data | 14 months |
| Drafts, theme and cookie choices in your browser | On your device until you clear them |
8. Your rights
Under UK data protection law, you have the right to:
- access a copy of your personal data;
- correct data that is inaccurate or incomplete;
- have your data deleted in certain circumstances;
- restrict how we use your data in certain circumstances;
- object to our use of your data based on legitimate interests. You can always object to direct marketing;
- data portability, meaning a copy of data you gave us, in a reusable format, where we rely on consent or a contract; and
- withdraw consent at any time, without affecting what we did before you withdrew it.
To exercise a right, email privacy@digitalmarvels.tech or use the privacy request form on this page. It is usually free. We will make reasonable and proportionate searches, and respond within one month. If a request is complex, we may extend this by up to two further months and will tell you why within the first month. We may ask you to confirm your identity first.
9. Complaints
If you are unhappy with how we have handled your personal data, please complain to us first at privacy@digitalmarvels.tech. We will acknowledge your complaint within 30 days, look into it, and tell you the outcome without undue delay.
You also have the right to complain to the Information Commissioner’s Office (ICO), the UK data protection regulator. Visit ico.org.uk/make-a-complaint or call 0303 123 1113.
10. Security
We protect personal data with measures that fit the risk, including:
- encrypted HTTPS (TLS) connections across the whole website;
- forms that only accept submissions from our own website, with protection against automated abuse;
- private storage for uploaded files, which are never publicly accessible;
- database credentials that stay on our servers, never in your browser; and
- access to personal data limited to the people who need it.
No system is completely secure. If a personal data breach is likely to put your rights at risk, we will report it to the ICO within 72 hours and tell you where the law requires.
11. Children
Our website and services are not intended for anyone under 18, and we do not knowingly collect children’s personal data. If you think a child has sent us personal data, contact us and we will delete it.
12. Newsletter and marketing
We only send our newsletter to people who sign up for it. Contacting us about a project does not add you to our mailing list. You can unsubscribe at any time by using the link in any newsletter or by emailing privacy@digitalmarvels.tech.
13. Changes to this policy
We will update this policy when our practices or the law change, and revise the date at the top of the page. If a change significantly affects how we use data we already hold about you, we will tell you directly where we can.
14. Contact us
Email privacy@digitalmarvels.tech with any question about this policy or your personal data. We aim to reply within 5 working days, and always within the time limits the law sets.