Privacy policy

Who we are

This website is run by MX DIGITAL LTD (“MX Digital”, “we”, “us”), a private limited company registered in England and Wales under company number 17487288. Our registered office is 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom.

We are the controller of the personal information described in this policy, which means we decide how and why it is used. We are a small company and have not appointed a data protection officer; any question about your information comes straight to us at maarij.m19@gmail.com.

What this policy covers

• People who visit this website.
• People who send us an enquiry or write to us.
• Our clients, and the people at client organisations we deal with.
• People at businesses we approach about our services.
• Our suppliers and their staff.

When we build or run a system for a client that handles the client's own customers (a member portal or a booking tool, for example), we process that information on the client's behalf, as their processor, under a written agreement. The client's own privacy notice covers that information, not this one.

The information we collect

• Enquiries. Your name and email address, your company if you give it, the services you are interested in, your budget range and timeline, your message, and when it was sent.
• Correspondence. What you send us by email or other channels, and our replies.
• Client work. Contact and billing details, and any material you share with us for a project, such as briefs, content and access to accounts.
• Business contacts. Names, job titles, business email addresses or phone numbers and company details, taken from public business sources such as company websites, business directories, map listings and Companies House.
• Website use. Our hosting provider records technical information to keep the site secure and working, such as IP address, browser type and the pages requested. If you allow analytics, we also receive anonymous, aggregated measurements of page views and page speed. See our cookie policy.
• Your cookie choice. One cookie that remembers whether you allowed analytics.

We don't ask for special category information (such as health, religious beliefs or political opinions), and we ask that you don't send it to us.

How we use it, and our lawful basis

Where we rely on legitimate interests, we have weighed them against your rights and interests. You can ask us for the details of that assessment.

Who we share it with

We don't sell personal information. We share it only with providers who help us run the business, under contracts that require them to protect it and use it only on our instructions:

• Vercel, which hosts this website and, if you allow it, provides our analytics.
• Resend, which delivers the emails sent by our enquiry form.
• Google, whose Workspace services we use for email and documents.
• Payment and banking providers, when you pay an invoice.
• Our accountants and professional advisers.
• Software and AI providers we use to deliver projects (for example Anthropic, for AI-assisted design and engineering), and only where your project needs it.

We may also disclose information where the law requires it, to protect our rights, or to a buyer or successor if our business is sold or restructured.

International transfers

Some of these providers are based in, or process information in, the United States and other countries outside the UK. Where they do, the transfer is covered by UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework, where the provider is certified) or by the International Data Transfer Agreement or Addendum approved under UK law.

How long we keep it

• Enquiries that don't lead to work: up to 24 months after our last contact.
• Client, contract and financial records: six years after the end of the financial year they relate to, as UK tax law requires.
• Business contacts: until you ask us to stop, or until the information is no longer useful. We keep a record of opt-outs so we don't contact you again.
• Hosting logs: a short period, set by our hosting provider, for security.
• Analytics: aggregated and anonymous; no profile of you is kept.

Your rights

Under UK data protection law you have the right to:

• ask for a copy of the information we hold about you;
• ask us to correct information that is wrong or incomplete;
• ask us to delete it;
• ask us to restrict how we use it;
• object to our use of it, including an absolute right to object to direct marketing;
• receive information you gave us in a portable format; and
• withdraw your consent to analytics at any time, using the cookie settings link at the foot of every page.

To use any of these rights, email maarij.m19@gmail.com. We'll respond within one month, and there is normally no charge. We may need to confirm your identity first.

Complaints

If you're unhappy with how we have handled your information, please tell us first at maarij.m19@gmail.com and we'll try to put it right. We acknowledge complaints within 30 days.

You can also complain to the Information Commissioner's Office, the UK data protection regulator: ico.org.uk/make-a-complaint, telephone 0303 123 1113, or by post to Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

Security

The site is served only over encrypted connections. Our accounts are protected with two-factor authentication and a password manager, and access to systems holding your information is limited to what the work requires. No system is perfectly secure, but we take care in proportion to the information we hold.

Other points

Children

This website and our services are for businesses and are not directed at children.

Automated decisions

We don't make decisions about you based solely on automated processing that have legal or similarly significant effects.

Changes to this policy

We'll update this policy when our practices change, and the date at the top will show when it last changed.