Below is everything in order, including the legal bases we are required to state. To see, correct or delete your data, email us at contact@digiwisesystems.com.
Who is responsible for your data
The controller of your data is DIGIWISE GROUP LTD, a company registered in England and Wales under number 13384517, with its registered office at 244 Newport Road, Cardiff, CF24 1RR, United Kingdom. Digiwise Systems is the trading name of this company.
For anything relating to personal data, write to contact@digiwisesystems.com or by post to our registered office.
We have not appointed a data protection officer - at our scale, the law does not require one.
Which law applies
We are a UK company, so we are governed by UK law: UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR, the rules on cookies and electronic communications). Our services are intended for businesses in the United Kingdom - we talk to them in English and in Polish. We do not direct our services or advertising at businesses or individuals in the European Union.
What data we collect and why
When you browse the website
The server that hosts the website records basic information about each visit in a log: IP address, browser and operating system type, the address of the page visited, and the date and time. Every server on the internet does this - without it, it is impossible to detect faults or fend off attacks.
- Purpose: running the website and keeping it secure.
- Legal basis: our legitimate interest in a secure, working website (Article 6(1)(f) UK GDPR).
- How long: for as long as our hosting provider (Hostinger) keeps logs for security and fault detection - a short, technical period; we don’t use them for anything else.
We don’t set any analytics or advertising cookies. Details in our cookie policy.
When you send the contact form
We record what you enter: the content of your message and your email address, along with the date and time it was sent. We do not record your IP address with the enquiry.
To stop the form being flooded with spam, the server remembers for 15 minutes how many enquiries have come from a given IP address (no more than 10). This counter lives only in the server’s memory - it is never written to the database or to disk, and it disappears after 15 minutes.
- Purpose: answering your question and discussing possible work together.
- Legal basis: steps you ask us to take before entering into a contract (Article 6(1)(b) UK GDPR) and, where you write on behalf of a business, our legitimate interest in responding to enquiries (Article 6(1)(f)). Enquiry limit: our legitimate interest in protecting the form from abuse.
- How long: if we don’t start working together - 12 months from our last contact, after which we delete the enquiry from the database and the notification about it from our inbox. If we do - for the duration of our work together and 6 years after it ends (more in “When you become our client”).
Once you send the form, the enquiry is stored in our database (Supabase), and a notification about it is sent by email (via Resend) to our contact inbox.
When you email us
We have your address, the content of your message and anything you include in it (e.g. details in your signature).
- Purpose: replying and further correspondence.
- Legal basis: steps taken before entering into a contract, or our legitimate interest in handling correspondence (Article 6(1)(b) or (f) UK GDPR).
- How long: if we don’t start working together - 12 months from our last contact, after which we delete the messages (we review and clear our inbox regularly). If we do - for the duration of our work together and 6 years after it ends.
When you message us on WhatsApp
The “Message us on WhatsApp” button opens an ordinary WhatsApp link and pastes the text you typed in the box into the message. Our website does not load any WhatsApp or Meta code to do this - you only go to WhatsApp once you click.
In the chat, we see your phone number, your profile name and whatever you write.
- Purpose: replying and discussing work together.
- Legal basis: as for the form (Article 6(1)(b) or (f) UK GDPR).
- How long: if we don’t start working together - 12 months from our last contact, after which we delete the chat. If we do - for the duration of our work together and 6 years after it ends.
WhatsApp (part of the Meta group) is responsible for the app itself and your account, under its own rules - set out in the WhatsApp privacy policy.
When you book a call
We send you a link to choose a time in reply to your message. Bookings are handled by Cal.com: you give your name and email address, choose a time and can add a note for the call. The call itself takes place on Zoom or Google Meet.
- Purpose: arranging and holding the call.
- Legal basis: steps you ask us to take before entering into a contract, or our legitimate interest (Article 6(1)(b) or (f) UK GDPR).
- How long: as for the form - if we don’t start working together, 12 months from our last contact; if we do, for the duration of our work together and 6 years after it ends.
When you become our client
Once we start working together, your enquiry, correspondence and conversations with us become part of the records of that work (proposal, arrangements, invoicing).
- Purpose: performing the contract, invoicing, and defending ourselves in the event of a dispute.
- Legal basis: performance of a contract (Article 6(1)(b) UK GDPR), our legal obligations regarding tax and accounting records (Article 6(1)(c)) and our legitimate interest in defending against claims (Article 6(1)(f)).
- How long: for the duration of our work together and 6 years after it ends. In the UK, that is the standard time limit for bringing a contract claim, and HM Revenue & Customs (HMRC) requires a company to keep its tax records for 6 years.
When we publish content on social media
We publish content for our company and our clients on their profiles on Meta (Facebook, Instagram), Google (YouTube) and LinkedIn. To do this, the account on the given service is connected to our system: the service gives us an access key to the profile, the name and ID of the profile or page, and after publication - post statistics (e.g. number of views), where the service provides them. The content of posts (text, photos, videos) may include data of people who appear in them - we publish it only with the consent of the client who gave it to us.
- Purpose: preparing, publishing and measuring the results of content on the profiles of our company and our clients.
- Legal basis: performance of a contract with the client (Article 6(1)(b) UK GDPR) and, for our own company’s content, our legitimate interest in promoting our business (Article 6(1)(f)).
- How long: access keys - until the account is disconnected; after disconnection we delete them from our system (you revoke access on the service’s side in your account settings there). Content and statistics - like the records of our work together: for its duration and 6 years after it ends. Media files (photos, videos) are deleted from our system 30 days after publication - they stay on the profile on the service.
- How to delete your data: email contact@digiwisesystems.com - we will disconnect the account and delete the data we received from the service within one month.
We store access keys encrypted, and only the administrator has access to them.
Marketing
We don’t send a newsletter or promotional emails. If we ever start, we will ask for your separate consent - we won’t use the address you gave in the form for this without your explicit consent.
Do you have to give us your data
No. But without an email address we can’t reply to the form, and without a phone number there’s no chat on WhatsApp - it’s simply our only way of getting back to you.
Who we entrust data to
We don’t sell data and don’t share it with anyone for their own purposes. We use providers who process data on our behalf and according to our instructions (processors):
| Provider | What for | Where the data is |
|---|---|---|
| Hostinger | website server and email | United Kingdom |
| Supabase | database of form enquiries | Ireland (EU) |
| Resend | sending enquiry notifications | sent from Ireland (EU), US company |
| Cal.com | booking a call | USA |
| Zoom or Google (Meet) | video call | USA and other countries |
The content we publish goes to Meta Platforms Ireland Ltd (Facebook, Instagram), Google Ireland Ltd (YouTube) and LinkedIn Ireland Unlimited Company. These services do not act on our instructions: they process data as separate controllers, under their own terms (data may go to the USA and other countries).
Data may also be passed to our advisers (e.g. accountant, lawyer) to the extent they need for their work, and to public authorities where the law requires it.
Transfers outside the UK and the European Economic Area
Some of our providers are US companies or use servers outside the UK and the EEA. We only transfer data where it is adequately protected:
- to US companies certified under the UK Extension to the EU-US Data Privacy Framework (the UK-US data bridge) - on the basis of UK regulations recognising this framework as adequate;
- in other cases - on the basis of contracts with data protection clauses approved under UK law (the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses).
We will send you a copy of the safeguards used for a particular provider on request.
How we keep data secure
- The whole website runs over an encrypted connection (HTTPS).
- The enquiry database is closed to browsers - only our server can write to it, and only we can read it.
- We don’t record the content of enquiries in server logs.
Your rights
You have the right to:
- know what data we hold about you, and get a copy of it;
- correct data that is inaccurate or incomplete;
- delete data when it is no longer needed or when we process it without a legal basis;
- restrict its processing, e.g. while we check whether it is accurate;
- transfer data you have given us to another company - in a common file format;
- object to processing based on our legitimate interest;
- withdraw consent at any time, where anything is based on it - without affecting what happened before.
To use any of these rights, write to contact@digiwisesystems.com. We will reply without undue delay, and within one month at the latest. We may sometimes ask you to confirm that it really is you - so that we don’t hand your data to a stranger.
Complaints
If you think we are doing something wrong, please write to us first at the same address - we will look into your complaint and tell you what we have done about it. You also have the right to complain to the UK supervisory authority: the Information Commissioner’s Office (ico.org.uk, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF).
Links to other websites
On our website we link to our clients’ websites (in our work) and to other services. Once you go to them, their own privacy rules apply - we have no control over them.
Children
Our services are for businesses. The website is not aimed at children and we do not knowingly collect their data.
Changes to this policy
When we change the way we use data (e.g. a new provider), we will update this page and the date at the top. If we have your contact details, we will tell you directly about significant changes that affect you.