Privacy Policy

Digital Done Group Limited is the data controller for the personal data described in this policy. We are registered in England and Wales, company number 13081100, at The Mill, Lodge Lane, Derby, DE1 3HB. We are registered with the Information Commissioner’s Office under reference ZB852701. For anything to do with your data, including any of the requests described below, contact [email protected] or call 01332 805527.

We collect only what you give us and what the site needs to function. Nothing is bought here. There is no account to create on this website, though clients we work with are given an account on our separate client portal, which is covered in its own section below.

• Enquiry form: your name, email address, the organisation you are contacting us about, and the message you write. These are the only fields, and the message field is yours to fill as you choose. Please do not include health information, financial details or anything else sensitive in it. When you send it, we also record your approximate location (town, region and country), which our network provider works out from your connection. We do not store your IP address with your enquiry.
• Direct contact: if you email or call us, we hold that correspondence and any contact details in it.
• Server logs: our hosting keeps standard technical records of requests to the site, which include your IP address, the pages requested, the time, and your browser and device type. These are generated by the act of serving a web page and are used for security and diagnosing faults.

Under the UK GDPR we must have a lawful basis for each purpose. Ours are as follows.

• To answer your enquiry and discuss work you have asked us about. Basis: legitimate interests, being our interest and yours in responding to a message you deliberately sent us. If a contract follows, the basis becomes performance of that contract.
• To keep the website secure, available and working, including investigating errors and misuse. Basis: legitimate interests in protecting our own systems and the people using them.
• To send marketing about our services. Basis: your consent, which we ask for separately and which you can withdraw at any time. We do not add enquiry contacts to a marketing list simply because they contacted us.
• To meet legal and accounting obligations where an enquiry becomes a client relationship. Basis: legal obligation.

Clients we work with are given an account on our client portal at clients.digitaldone.co.uk. It is a separate system from this website, reached only by signing in, and it is never indexed by search engines. What we hold there, and why, is as follows.

• Account details: the named person’s name, work email address, telephone number and job title. Basis: performance of our contract with your business. One business has one account, and we add or remove a person only on a request we have confirmed with a named contact.
• Sign-in records: the times an account signs in, and the technical records our hosting generates. Basis: legitimate interests in keeping your commercial documents secure. A session ends automatically after five minutes without activity.
• Signature records: where you sign a statement of work, change note or agreement, we record the name and role you type, the exact time, and the version of the document signed. Basis: performance of a contract, and our legal obligation to keep business records. A signature record is never edited or deleted while the underlying agreement is live, because its whole value is that it cannot be.
• Document history: when a document was issued, opened, downloaded and signed, and by whom. Basis: legitimate interests in both parties being able to establish what happened and when. You can see this history yourself on each document.
• Onboarding answers and invoice records: the business details you give us at the start of an engagement, and the invoices raised under it. Basis: performance of a contract, and legal obligation for the accounting records.

We think a privacy policy is more useful for what it rules out than for what it permits. On this website:

• We do not sell, rent or trade your personal data. There are no circumstances in which we would.
• We load no analytics and no advertising or tracking scripts. There is nothing to opt out of because nothing is running.
• We do not build profiles of you, and we do not use your data for automated decision-making that has any legal or significant effect on you.
• We do not use your enquiry to enrol you in marketing without asking you separately.
• We do not ask for special category data, and we would rather you did not send it.

We do not share your data with anyone who wants it for their own purposes. We do use service providers who process it on our instructions and cannot use it for anything else, bound by a written contract as the UK GDPR requires. These fall into three categories: our website hosting and infrastructure provider, our business email provider, and, where an enquiry becomes an active conversation, the system we use to keep track of client work. We will also disclose data where we are legally required to, for example in response to a valid request from a court or a regulator.

We aim to keep personal data within the United Kingdom or the European Economic Area. Where a provider we rely on processes data outside those areas, we ensure the transfer is covered by one of the safeguards UK law permits, such as the International Data Transfer Agreement or the UK Addendum to the European Commission’s standard contractual clauses. You can ask us which providers are involved and where they are located, and we will tell you.

We do not keep personal data indefinitely, and we do not keep it just in case.

• Enquiries that do not lead to work: up to 12 months from your last message, then deleted.
• Enquiries and correspondence that become client work: for the duration of the engagement, and then for six years afterwards, which is the period we must keep business records for tax and legal purposes.
• Marketing consent records: for as long as you remain subscribed, plus two years afterwards so we can show when and how you consented, and when you withdrew.
• Server logs: retained by our hosting provider on a short rolling basis for security and diagnostics, not archived.
• Client portal accounts: for the duration of the engagement. When an engagement ends we close the account within 30 days, and the named person’s contact details are deleted at that point.
• Signed agreements and their signature records: for six years after the engagement ends, in line with the record-keeping period above. Sign-in and document history records are kept for 12 months.

Data sent to and from this site is encrypted in transit. Access to enquiry data is limited to the people at Digital Done who need it to respond, protected by individual accounts and multi-factor authentication. We keep the systems we run patched and monitored, and we apply the same security assurance to our own infrastructure that we apply to the client systems we host. No system is perfectly secure, and we will not claim otherwise. If a breach occurs that is likely to result in a risk to your rights and freedoms, we will report it to the Information Commissioner’s Office within 72 hours and tell you directly where the risk is high.

These rights are yours by law, they are free to exercise, and asking us to honour one of them will never affect how we treat you. Email [email protected] and we will respond within one month.

• Access: ask for a copy of the personal data we hold about you.
• Rectification: have inaccurate data corrected, or incomplete data completed.
• Erasure: ask us to delete your data, where there is no overriding reason for us to keep it.
• Restriction: ask us to stop using your data while a dispute about it is resolved.
• Objection: object to our use of your data where we rely on legitimate interests. We will stop unless we can show a compelling reason not to.
• Portability: receive the data you gave us in a machine-readable form, or have it sent to someone else.
• Withdraw consent: withdraw marketing consent at any time, using the unsubscribe link in any message or by emailing us. Withdrawing does not affect anything we sent before you withdrew.

This website is aimed at businesses and is not directed at children. We do not knowingly collect personal data from anyone under 13. If you believe a child has sent us their information, contact us and we will delete it.

If you are unhappy with how we have handled your personal data, please tell us first so we have the chance to put it right. You also have the right to complain directly to the Information Commissioner’s Office, the UK data protection regulator, at ico.org.uk or on 0303 123 1113. Complaining to us first is not a condition of going to the ICO.

If we change how we use personal data, we will update this policy and change the date shown above it. Where a change materially affects you, for example if we begin using analytics or add a new purpose, we will make that clear rather than quietly amending the wording. This policy was last updated on 2 September 2026.