Privacy policy.

This Privacy Policy ("Policy") explains how DigiSurf Agency ("DigiSurf", "we", "us", "our") collects, uses, stores, shares and protects personal data. DigiSurf is a digital marketing agency operating from Manchester, United Kingdom, serving UK local businesses and selected international clients. This Policy is written to comply with the United Kingdom General Data Protection Regulation ("UK GDPR"), the Data Protection Act 2018 ("DPA 2018"), the Privacy and Electronic Communications Regulations 2003 (as amended) ("PECR") and, where relevant, the EU General Data Protection Regulation ("EU GDPR") for European Economic Area visitors. Full corporate registration details are set out in Section 2.

This Policy applies to:

• Website visitors — anyone who browses any page on digisurfagency.com or any subdomain, location page or industry page operated by DigiSurf.
• Leads and prospects — individuals who contact us via the website form, email, WhatsApp, phone, social media, GoHighLevel CRM, Calendly, in-person meetings or third-party referrals.
• Clients — UK and international businesses that engage DigiSurf to deliver web design, hosting, paid advertising, SEO, social media marketing, CRM implementation, review automation, AI-powered lead follow-up or any related service.
• End-users of client sites — limited to the personal data we incidentally process as a data processor on behalf of our clients (this is covered in more detail in the Data Processing Agreement we sign with each client).
• Suppliers, contractors and applicants — individuals whose data we process in the course of running our business.

This Policy does not cover the privacy practices of any third-party website, app or service that we link to. We encourage you to read the privacy policy of every site you visit.

By using our website or engaging our services, you confirm that you have read and understood this Policy. If you do not agree with any part of it, please do not use the website or engage our services.

DigiSurf Agency is a UK-operating digital agency based in Manchester. Day-to-day work, client delivery and the founder are all in the United Kingdom. For full transparency, the corporate vehicle behind the trading name is disclosed below.

For the purposes of UK GDPR and the DPA 2018, the data controller responsible for your personal data is:

Although the corporate entity is formed in Wyoming, the trading operation, the team, the founder and the substantive majority of clients are all in the United Kingdom. We voluntarily apply UK GDPR and DPA 2018 standards to all personal data we process, regardless of where the data subject is located, because this represents the highest practical standard of protection available and reflects how the business is actually run.

As a non-UK-incorporated controller offering services to UK-based data subjects, we recognise that UK GDPR Article 27 may, in certain circumstances, require us to appoint a UK representative. As our day-to-day operations are run from Manchester by our Founder, that contact point is reachable directly via the email address above. If a formal Article 27 representative is appointed in future, this Policy will be updated to disclose it.

The following definitions, drawn from UK GDPR Article 4 and PECR, apply throughout this Policy:

• Personal Data — any information relating to an identified or identifiable natural person ("data subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
• Special Category Data — personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, data concerning health, or data concerning a natural person's sex life or sexual orientation. DigiSurf does not knowingly process special category data.
• Processing — any operation or set of operations performed on personal data, whether or not by automated means, including collection, recording, organisation, structuring, storage, adaptation, retrieval, consultation, use, disclosure, dissemination, restriction, erasure or destruction.
• Data Subject — the identified or identifiable natural person to whom the personal data relates.
• Controller — the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data. DigiSurf Agency is the controller of the personal data described in Section 4 (full registration details in Section 2).
• Processor — a natural or legal person who processes personal data on behalf of the controller. The sub-processors listed in Section 9 are processors acting on our instructions.
• Third Party — a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons authorised to process the data under the direct authority of the controller or processor.
• Consent — any freely given, specific, informed and unambiguous indication of the data subject's wishes by which they, by a statement or by a clear affirmative action, signify agreement to the processing of personal data relating to them.
• Cookies — small text files placed on your device by a website to store information about your visit, preferences or activity. Defined under PECR Regulation 6.
• Sub-Processor — a third party engaged by DigiSurf to assist in the delivery of services and which processes personal data on our behalf, under our written instructions and subject to a written contract or Data Processing Agreement.
• Standard Contractual Clauses (SCCs) — the standard data protection clauses adopted by the European Commission (and the UK International Data Transfer Addendum) used to provide an appropriate safeguard for transfers of personal data outside the UK / EEA.
• UK International Data Transfer Agreement (UK IDTA) — the UK's version of the SCCs, approved by the ICO and laid before Parliament, used to safeguard transfers of personal data from the UK to third countries.
• Personal Data Breach — a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed.

We collect different categories of personal data depending on how you interact with us. The full inventory is set out below.

4.1 When you visit the Site

• Internet Protocol (IP) address — used to deliver the page, detect abuse, fight bots and approximate your country for analytics. Often partially anonymised at collection time.
• User-agent string — the browser, browser version, operating system and device family. Used to render the correct layout and diagnose bugs.
• Referring URL — the page that linked you to ours, if any.
• Pages visited, time on page, scroll depth, click events, form interactions — collected by Google Analytics 4 (GA4) via Google Tag Manager (GTM) when analytics cookies are accepted, to understand how our content performs.
• Server access logs — IP, timestamp, HTTP method, URL, response code, bytes served, user-agent, referrer. Retained for thirty (30) days for security and diagnostic purposes.
• Cookie identifiers — see Section 8 for the full cookie inventory.

4.2 When you fill in a contact, quote or booking form

• Full name
• Email address
• Phone number (landline or mobile)
• Business name and trading address (where supplied)
• Industry / niche
• Service of interest (web design, ads, SEO, CRM, etc.)
• Project description, budget range, target launch date and any free-text notes you choose to give us
• Timestamp and IP of the submission (for spam / abuse detection)
• Marketing consent flag (where you have ticked an opt-in box)

4.3 When you become a Client

• All the data in 4.2, plus:
• Billing name, billing address and VAT number (where applicable)
• Payment method tokens issued by Stripe — we never see or store full card numbers; Stripe handles PCI-DSS compliant storage of the card itself, and we receive only a tokenised reference
• Invoices, receipts and accounting records
• Content you upload through the standardised DigiSurf admin editor — copy, images, logos, opening hours, prices, service descriptions, team bios, customer photographs (where you have the right to use them)
• Access credentials you delegate to us for delivery — for example Google Business Profile manager access, Meta Business Manager admin, domain registrar logins, hosting cPanel, existing CRM exports. Where possible we prefer delegated access (no password sharing); where a credential must be shared it is stored encrypted in a password manager and rotated when the engagement ends
• Brand assets, brand guidelines and prior creative output you supply
• Performance data from your advertising and analytics platforms (Google Ads, Meta Ads, Google Search Console, GA4, Bing) that you authorise us to access for reporting

4.4 When you contact support

• Email content and attachments sent to [email protected] or any DigiSurf inbox
• WhatsApp message content, attachments and metadata (delivery times, read receipts)
• Phone call notes; where calls are recorded for training or quality purposes you will be told at the start of the call and your consent obtained — recordings are deleted within ninety (90) days unless required for a specific dispute
• Ticket history inside the DigiSupport client portal — subject, description, screenshots, attachments and the timeline of internal updates
• Calendar booking data (Calendly) — name, email, selected slot, time zone, answers to pre-meeting questions

4.5 Marketing list

• Email address and (optionally) first name supplied via an opt-in field on a form, landing page or lead magnet
• The lawful basis (consent), the wording of the consent, the date and time, the IP of the submission and the source page — captured as evidence as required by PECR and UK GDPR Article 7
• Open, click and unsubscribe events recorded by our email platform

4.6 Data we do not collect

We do not knowingly collect special category data (health, religion, sexuality, ethnicity, politics, trade union membership, biometric or genetic data). We do not collect data from children under thirteen (13) — see Section 15. We do not buy lists of contact data from third parties for cold outreach.

We collect personal data through the following channels:

• Directly from you — via website forms (contact, quote, booking, newsletter sign-up), email replies, WhatsApp chats, phone calls, video calls (Google Meet, Zoom), in-person meetings, signed proposals, and content you upload through the DigiSurf admin editor.
• Automatically through the website — via server logs, cookies and similar technologies (see Section 8), and via the Cloudflare edge network which sits in front of every page we serve.
• From third parties, with a valid lawful basis — including:
  • Google Business Profile reviews and review-author display names, where you have publicly posted them
  • Companies House public records (for business credit checks and verification)
  • Public social media profiles where you have engaged with our content or DM'd us
  • GoHighLevel CRM contact records imported on behalf of a client (where the client is the controller and we are the processor)
  • Referrals from existing clients or partners — only where the referrer confirms they have the right to share your contact details
  • Lead generation forms run on Meta (Facebook / Instagram) or Google when you submit your details via a DigiSurf-managed ad campaign
• From sub-processors — limited to the data they generate or hold while processing on our behalf (for example bounce reports from our email provider, fraud-screening signals from Stripe).

UK GDPR Article 6(1) requires at least one lawful basis for every processing activity. The bases we rely on, and the activities they cover, are set out below.

Article 6(1)(b) — Performance of a Contract

• Delivering the services agreed in our written proposal, scope of work or recurring service agreement
• Building, deploying, hosting and maintaining your website
• Setting up, running and reporting on paid advertising campaigns
• Provisioning email accounts, SSL certificates, security headers and backups
• Issuing invoices, taking payment via Stripe, sending receipts
• Providing client support through email, WhatsApp, phone and the DigiSupport ticket portal

Article 6(1)(f) — Legitimate Interest

• Responding to enquiries from leads and prospects (our legitimate interest in growing the business and your legitimate interest in receiving the information you asked for)
• Operating GA4 analytics and aggregated heatmap data to improve the website (we balance this against your privacy by anonymising IPs where the tool supports it, by honouring Do-Not-Track signals where possible, and by gating cookies behind a consent banner)
• Fraud prevention, abuse detection, bot mitigation and security monitoring through Cloudflare
• Direct postal marketing to UK businesses (B2B) — used sparingly and always with an opt-out
• Recording anonymised case studies of work we have delivered, with the client's prior approval where the client is identifiable
• Defending or pursuing legal claims and exercising legal rights
• Internal record-keeping, business administration and reporting

Where we rely on legitimate interest we have carried out a Legitimate Interests Assessment (LIA) and we balance our interest against your rights and freedoms. You have the right to object at any time (see Section 12).

Article 6(1)(a) — Consent

• Setting non-essential cookies (analytics, marketing, retargeting) — captured via our cookie consent banner
• Sending email marketing, newsletters and promotional WhatsApp / SMS messages to individuals (the "soft opt-in" exemption under PECR Regulation 22 may apply where you have previously bought from us and the marketing is for similar products)
• Using your name, photograph, logo, testimonial or video in our case studies, website portfolio or social media content
• Sharing your contact details with a named third-party partner for a specific introduction

You can withdraw consent at any time, without affecting the lawfulness of processing before the withdrawal. Withdrawing consent is as easy as giving it — see Section 13.

Article 6(1)(c) — Legal Obligation

• Retaining accounting and tax records for the periods required by HM Revenue & Customs (typically six years plus the current financial year)
• Responding to lawful requests from regulators, law enforcement and courts
• Notifying the ICO of personal data breaches within seventy-two (72) hours where the threshold is met
• Complying with anti-money-laundering, sanctions screening and "know your customer" requirements where applicable

Article 6(1)(d) — Vital Interests

Used only in exceptional circumstances where processing is necessary to protect someone's life. We do not anticipate relying on this basis in normal operation.

Article 6(1)(e) — Public Task

Not applicable — DigiSurf is a private company and does not perform a task carried out in the public interest.

The personal data described in Section 4 is processed for the following purposes:

• Service delivery — designing, building, deploying, hosting and maintaining your website; running and reporting on advertising campaigns; setting up and operating your CRM, automations and review-generation workflows.
• Client communication — keeping you updated on project progress, sending drafts for approval, scheduling calls, sending status reports.
• Support and troubleshooting — answering questions, fixing bugs, investigating incidents, restoring backups, recovering email or hosting access.
• Billing and accounting — issuing invoices, taking recurring payments via Stripe, sending receipts, maintaining VAT records, producing year-end accounts and reconciling bank transactions.
• Marketing — sending you our newsletter and occasional service announcements where you have opted in; producing case studies and portfolio entries with consent; serving retargeting ads to past website visitors who have consented to marketing cookies.
• Analytics and product improvement — understanding which pages perform, which forms convert, where users drop off, and using that insight to improve the website and our offer.
• Security and abuse prevention — detecting and blocking automated bots, brute-force login attempts, spam form submissions and malicious payloads at the Cloudflare edge.
• Legal and regulatory compliance — meeting our obligations under UK GDPR, DPA 2018, PECR, HMRC tax legislation, and any other law that binds us (including corporate-formation requirements in the jurisdiction noted in Section 2).
• Defending legal claims — preserving evidence and correspondence to defend or pursue a claim where necessary.
• Internal record-keeping — keeping a clear audit trail of who we worked with, what was agreed and what was delivered.

A cookie is a small text file stored on your device by your browser when you visit a website. PECR Regulation 6 requires us to tell you about non-essential cookies and obtain your consent before setting them. The full inventory below covers cookies, pixels, local storage and similar technologies used on digisurfagency.com.

8.1 Strictly Necessary (no consent required)

8.2 Analytics (consent required)

8.3 Marketing & Retargeting (consent required)

8.4 Your control

A cookie consent banner is presented on first visit. You can accept all, reject non-essential, or open the granular preference panel to allow / block each category. Your choice is stored in the cookie_consent cookie and respected on subsequent visits. You can change your choice at any time by clearing site data in your browser, or by emailing us at [email protected].

You can also manage cookies directly in your browser — Chrome, Safari, Firefox, Edge. Blocking strictly necessary cookies will break parts of the site (notably the admin editor login).

Where our cookie banner is not yet live on a specific subdomain or legacy page, we limit non-essential tag loading by default and obtain consent on first interaction. This Policy will be updated once full banner coverage is in place across every page.

We engage carefully selected sub-processors to help us deliver our services. Each sub-processor is bound by a written contract or Data Processing Agreement that obliges them to process personal data only on our documented instructions, to maintain appropriate technical and organisational security measures, and to assist us in meeting our UK GDPR obligations. The current sub-processor register is set out below.

This list is reviewed quarterly. We will update this Policy when we engage a new sub-processor that materially changes the geography or category of processing. Material clients are entitled to receive notice of new sub-processors in advance of onboarding and to raise a reasoned objection.

Some of the sub-processors listed in Section 9 are located outside the United Kingdom, primarily in the European Economic Area (EEA) and the United States of America. Where personal data is transferred outside the UK we ensure that one or more of the following safeguards apply:

• UK adequacy regulations — for transfers to the EEA, Switzerland, and other jurisdictions that the UK Government has determined provide an adequate level of data protection.
• UK International Data Transfer Agreement (UK IDTA) — the ICO-approved transfer agreement used for transfers from the UK to third countries that have not received an adequacy decision.
• UK Addendum to the EU Standard Contractual Clauses — used in combination with the EU SCCs (Commission Decision 2021/914) for transfers from the UK to non-adequate countries via providers that already have EU SCCs in place.
• Data Privacy Framework (DPF) — for transfers to certified US recipients, we rely on the UK Extension to the EU–US DPF where the recipient is certified.
• Transfer Risk Assessments (TRAs) — for each non-adequate destination we have completed (or rely on the recipient's published) Transfer Risk Assessment under the ICO guidance to evaluate any supplementary measures required.

Delivery staff working overseas. DigiSurf is operated by a small UK-based team and works with a small number of trusted contractors who may, from time to time, work from outside the United Kingdom. Where these contractors process personal data on our behalf they do so under written contracts that include UK GDPR-compliant data protection clauses, equivalent to the UK IDTA where the country is not deemed adequate. Access to client data is limited to the minimum needed to deliver the work, is granted on a least-privilege basis, is logged, and is revoked at the end of each engagement.

You may request a copy of the relevant safeguard for any specific transfer by emailing [email protected]. We will provide it (with commercial terms redacted) free of charge.

We keep personal data only for as long as necessary for the purposes set out in Section 7, subject to the legal obligations that bind us. The table below sets out our standard retention periods. Where a specific contract or DPA provides for a shorter period, the contract prevails.

At the end of the applicable retention period, personal data is securely deleted from primary systems and overwritten in backups on the next backup cycle, or irreversibly anonymised so that it can no longer be linked to you.

UK GDPR gives you a comprehensive set of rights in respect of your personal data. These rights are summarised below. Some of them are conditional — for example we may decline to delete data we are legally obliged to keep — and we will always explain our reasoning when responding.

• Right of access (Article 15) — you can ask us to confirm whether we hold personal data about you and, if so, to provide a copy of that data along with information about how we process it. This is commonly called a "Subject Access Request" or SAR.
• Right to rectification (Article 16) — you can ask us to correct inaccurate or incomplete personal data we hold about you, and we will do so without undue delay.
• Right to erasure / "right to be forgotten" (Article 17) — you can ask us to delete your personal data in certain circumstances, including where the data is no longer needed for the original purpose, where you withdraw consent and there is no other legal basis, or where you object to processing based on legitimate interest and we have no overriding ground.
• Right to restriction of processing (Article 18) — you can ask us to "freeze" processing of your data in certain circumstances, for example while we investigate a rectification or objection request.
• Right to data portability (Article 20) — where we process your data by automated means on the basis of consent or contract, you can ask us to provide that data to you in a structured, commonly used, machine-readable format (typically CSV or JSON), or to transmit it directly to another controller where technically feasible.
• Right to object (Article 21) — you can object at any time to processing of your data based on legitimate interest (including profiling), to direct marketing (in which case we will stop immediately and unconditionally), and to processing for scientific / historical research or statistical purposes.
• Rights related to automated decision-making and profiling (Article 22) — you have the right not to be subject to a decision based solely on automated processing that produces legal effects or similarly significantly affects you. DigiSurf does not make such decisions — see Section 17.
• Right to withdraw consent (Article 7(3)) — where processing is based on consent, you can withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing before the withdrawal.
• Right to lodge a complaint with a supervisory authority (Article 77) — you can complain to the UK Information Commissioner's Office (ICO) or, if you live in the EEA, to your local Data Protection Authority. See Section 19.

You will not be charged a fee for exercising any of these rights, except in the rare case of a manifestly unfounded, excessive or repetitive request, in which case we may charge a reasonable administration fee or refuse to act (and we will tell you why).

To exercise any of the rights in Section 12, please email our DPO contact at [email protected]. To help us locate your data quickly, please include:

• Your full name and (if applicable) the name of your business
• The email address(es), phone number(s) or other identifiers you have used with us
• A clear statement of which right(s) you wish to exercise
• Any specific data, time period or context that helps us narrow the search

Identity verification. Before acting on a request we may need to verify your identity. This is to protect you against impersonation. Verification is usually a simple email confirmation from an address already linked to your record. For higher-risk requests we may ask for a redacted copy of a photo ID — in which case we will tell you exactly what we need and why.

Response window. We will respond to your request within one (1) month of receipt. Where a request is complex or where we have received a number of requests from you, we may extend this period by up to a further two (2) months — we will tell you within the first month if this is the case and explain why.

Withdrawing marketing consent. The fastest way to opt out of marketing is to click the "unsubscribe" link at the bottom of any marketing email, or to reply "STOP" to a marketing SMS. We will process the request immediately.

We implement appropriate technical and organisational measures under UK GDPR Article 32 to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Our measures include:

• Encryption in transit — TLS 1.3 on every page served from digisurfagency.com and on every client site we host. HTTP Strict Transport Security (HSTS) is set with a long max-age and is preload-eligible.
• Encryption at rest — applied by our hosting and database providers (Hostinger, Stripe, Google Workspace, GoHighLevel) using industry-standard ciphers (typically AES-256).
• Hardened HTTP response headers on every page — Content-Security-Policy (CSP), X-Content-Type-Options, X-Frame-Options, Referrer-Policy and Permissions-Policy — as set out in our build standard.
• Password security — admin passwords are stored as bcrypt hashes (work factor 12+); we never store passwords in plain text.
• Two-factor authentication (2FA) on every admin-level account that supports it — Hostinger, Cloudflare, Stripe, GoHighLevel, Google Workspace, GitHub.
• Cloudflare Web Application Firewall (WAF) — managed rules plus custom rules to block SQL injection, cross-site scripting, common bot patterns and credential-stuffing attempts at the edge.
• Daily encrypted backups — websites, databases and configuration backed up on a rolling 30-day cycle with monthly snapshots held for six months. Backups are restored to a test environment periodically to verify integrity.
• Principle of least privilege — staff and contractors are granted only the access strictly required for their role, on a per-engagement basis.
• Vendor due-diligence — we review the security posture of every sub-processor before engagement and at least annually thereafter (SOC 2, ISO 27001, PCI-DSS, where available).
• Patch management — operating systems, runtimes and CMS components are kept up to date on a regular cadence; critical security patches are applied within seventy-two (72) hours of release.
• Secure development practices — code review before deploy, automated linting, no secrets in source control, environment variables for all credentials.
• Incident response plan — documented process for detection, containment, notification, remediation and post-incident review (see Section 18).

Despite these measures, no system connected to the internet can be guaranteed to be 100% secure. We continuously review and improve our security posture.

Our website and services are aimed at business owners and decision-makers. They are not directed at, marketed to, or designed for children. We do not knowingly collect personal data from anyone under the age of eighteen (18). In particular, in line with UK GDPR Article 8 and the ICO's Age Appropriate Design Code, we do not knowingly process the personal data of any child under the age of thirteen (13).

If you believe we have inadvertently collected personal data from a child, please contact us at [email protected] and we will delete it without undue delay.

We send marketing communications only where one of the following applies:

• You have given us explicit, opt-in consent on a form, landing page or lead magnet (PECR Regulation 22).
• You are an existing or recent customer and the marketing relates to similar products or services to those we have previously delivered, you were given a clear opportunity to opt out at the point your details were collected, and every subsequent message includes a one-click unsubscribe (the so-called "soft opt-in" under PECR Regulation 22(3)).
• You are a corporate subscriber (a limited company or LLP) being contacted in a B2B capacity, and we have a legitimate interest in offering relevant services. Even here, we honour every opt-out request immediately and unconditionally.

Every marketing email includes a clear, one-click unsubscribe link. Every marketing SMS / WhatsApp includes the option to reply "STOP". We do not use deceptive subject lines, false sender details or hidden opt-out mechanics. For major lists or post-event sign-ups we use a double opt-in confirmation to reduce the risk of accidental or fraudulent enrolment.

You can also email us directly at [email protected] with "Unsubscribe" in the subject line — we will action it within five (5) working days at most and confirm in writing.

UK GDPR Article 22 gives you the right not to be subject to a decision based solely on automated processing — including profiling — that produces legal effects concerning you or similarly significantly affects you. To be clear:

• We do not make solely-automated decisions with legal or similarly significant effects on individuals. Decisions about whether to take on a client, what to quote, how to deliver a project, whether to terminate an engagement, whether to refund and so on are all made by a human at DigiSurf.
• We carry out limited profiling for advertising purposes — for example, building retargeting audiences in Google Ads and Meta Ads based on pages you have visited or actions you have taken on our website, where you have consented to marketing cookies. This is "soft" profiling: it influences which ads you see, not whether you can buy from us or receive a service.
• AI assistance in support and content — we use large language models (notably Anthropic's Claude) to help our team draft responses, summarise client briefs and produce first-draft content. Every output is reviewed and approved by a human before being acted on, sent or published. AI does not make a final decision that affects you.

You may object at any time to retargeting and profiling — see Section 12.

We take personal data breaches seriously. If we become aware of a personal data breach we will:

• Contain and investigate the breach immediately, with the goal of stopping any ongoing exposure within hours.
• Assess the risk to data subjects using the criteria in UK GDPR Article 33–34 and the ICO's published guidance.
• Notify the ICO within seventy-two (72) hours of becoming aware of the breach where it is likely to result in a risk to the rights and freedoms of natural persons. Where notification is delayed beyond 72 hours we will explain the reasons.
• Notify affected data subjects without undue delay where the breach is likely to result in a high risk to their rights and freedoms. The notification will use clear and plain language and will tell you what happened, what data was affected, what we are doing about it, what you should do, and how to contact us.
• Record the facts, effects and remedial actions of every breach in our internal breach register, even where the threshold for ICO notification is not met (Article 33(5)).
• Carry out a post-incident review within thirty (30) days, document lessons learned and update our security posture accordingly.

If you believe your data may have been compromised, please contact us immediately at [email protected].

If you are unhappy with how we handle your personal data, please tell us first so we have a chance to put it right. Email [email protected] with "Privacy complaint" in the subject line. We will acknowledge within five (5) working days and provide a substantive response within thirty (30) days.

If our response does not resolve your concern, you have the right to lodge a complaint with the supervisory authority. In the United Kingdom this is the Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Helpline: 0303 123 1113 (local rate, Monday–Friday 09:00–17:00)
• Postal address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, United Kingdom
• Online complaint form: ico.org.uk/make-a-complaint/

If you live in the European Economic Area, you may instead complain to your local Data Protection Authority. A full list is maintained by the European Data Protection Board.

We review this Policy at least annually and update it whenever there is a material change in how we process personal data — for example when we engage a new sub-processor, change a retention period, add a new service or respond to a change in law.

When we make a material change we will:

• Update the "Last updated" and "Effective" dates at the top of the page.
• Notify active clients by email (sent to the billing or primary contact address on file).
• Display an on-site banner for a reasonable period highlighting that the Policy has changed and linking to the new version.
• Preserve previous versions and make them available on request.

Minor, non-material changes (typos, formatting, broken links) will be made without separate notification.

This Privacy Policy and any non-contractual obligations arising out of or in connection with it are governed by and construed in accordance with the laws of England and Wales, including but not limited to the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 (as amended), and any successor legislation.

The courts of England and Wales have exclusive jurisdiction to settle any dispute or claim arising out of or in connection with this Policy, save that we may bring proceedings in any court of competent jurisdiction to protect our intellectual property rights or seek injunctive relief.

As disclosed in Section 2, DigiSurf operates from Manchester, United Kingdom, and we have voluntarily submitted to UK data protection law for the purposes of this Policy because our operational base and the substantive majority of our data subjects are located in the United Kingdom. Nothing in this Policy is intended to deprive you of any mandatory consumer protection right available under the law of your habitual residence.

For any question, request or complaint relating to this Privacy Policy or to your personal data, please contact us:

DigiSurf Agency
Manchester, United Kingdom
Data Protection contact: [email protected]
WhatsApp: +44 7576 411678
Phone: +44 7576 411678
ICO registration: [ICO_REG_NUMBER_TBC]
Full corporate registration details (entity type, jurisdiction of formation, registered agent, EIN) are set out in Section 2 above.

We aim to respond to every privacy query within five (5) working days, and to formal rights requests within the one-month statutory window.