Privacy Policy

Who we are

Digital Unlocked is a UK software studio, based in the United Kingdom. We design and build websites, mobile apps and SaaS products for other businesses, and we run our own products, including Fieldify.

For the purposes of UK data protection law we are the data controller for the personal data described in this policy. You can reach us at [email protected] or by post at 66 Paul Street, London, EC2A 4NA.

What we collect, and why

When you contact us

Our contact form asks for your name, email address and your message, and optionally a phone number, company name and website. It also carries a hidden field that people never see and automated bots often fill in, which we use to discard spam.

Submissions are delivered straight to our email inbox. They are not written to a database or stored on this website. We use them to answer you and to discuss possible work, on the basis of our legitimate interests in responding to enquiries about our services.

When you become a client

We hold the details needed to run a project and get paid: contact details, billing details, correspondence, project materials you send us and, where a project requires it, credentials or access to systems you ask us to work on. We process this to perform our contract with you and to meet our legal obligations, including keeping accounting records.

Where a project involves us handling personal data belonging to your customers or staff, we act as a processor on your instructions rather than as a controller, and we will put a separate data processing agreement in place if you need one.

When you receive our marketing email

We send occasional email about our services and products to people who have asked to hear from us, and to businesses we have an existing relationship with. We hold a name, an email address and a record of whether a message was opened or a link was clicked, which tells us whether what we send is useful.

We rely on consent, or on the soft opt-in permitted for existing business contacts, and we treat an unsubscribe as final. Every message carries an unsubscribe link, and you can also ask us directly.

When you simply visit

This site is served through Cloudflare, which processes the IP address of every request in order to route traffic and protect the site from attack. We do not receive a report on who visited, and this site runs no analytics.

What we do not do

Some things are easier to state plainly than to imply:

• We do not run analytics on this website. No Google Analytics, no visitor tracking.
• We do not load fonts, scripts or images from third party networks. Everything this page needs is served from our own domain, so browsing here does not announce you to anyone else.
• We do not advertise, profile or build audiences from your data.
• We do not sell, rent or trade personal data.

Who else handles your data

We keep the list of suppliers short on purpose. The ones that can come into contact with personal data are:

Cloudflare

Hosting, DNS, security, and delivery of contact form submissions to our inbox.

Unlimited Web Hosting

Our email hosting, and the server that runs our marketing system.

Amazon Web Services

Delivery of marketing email through Amazon SES, sent from the London region.

Our marketing system is self hosted, which means subscriber lists sit on our own server rather than inside a third party marketing platform. We may also share information with our accountant or other professional advisers, and we will disclose data where the law requires it.

Where your data is held

Our email, our marketing system and our marketing email delivery are all in the United Kingdom. Cloudflare and Amazon Web Services are United States companies, so some data may be processed outside the UK. Where that happens we rely on the safeguards UK law provides for international transfers, such as the International Data Transfer Agreement or the UK extension to the EU-US Data Privacy Framework.

How long we keep it

• Enquiries that do not become projects. Up to two years, then deleted.
• Client records. Six years after the end of the engagement, which is the period we need for tax records and for any claim under the contract.
• Marketing subscribers. Until you unsubscribe. We then keep the minimum record needed to make sure we do not email you again by mistake.
• Security logs. Held briefly by Cloudflare under their own retention periods, and not kept by us.

Your rights

Under UK data protection law you can ask us to:

• give you a copy of the personal data we hold about you
• correct anything inaccurate or incomplete
• delete it, where we have no continuing reason to hold it
• restrict how we use it, or object to us using it
• provide it in a portable format, or send it to someone else
• stop sending you marketing, which we will do without question

Where we rely on your consent you can withdraw it at any time, and that does not affect anything we did before you withdrew it. Email [email protected] and we will respond within one month.

If you think we have handled your data badly, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

Security

This site is served only over HTTPS. Access to our systems is limited to the people who need it, and protected by multi factor authentication where the service supports it. We keep the number of places your data can sit as small as we reasonably can, which is one of the most effective security measures there is.

No system is perfect. If you believe you have found a security problem with anything we run, please email us and we will take it seriously.

Changes to this policy

We will update this page when what we do changes, and the date at the top will tell you when that last happened. If a change materially affects people already on our marketing list, we will say so in an email rather than quietly editing the page.