Privacy Policy

1. Introduction

Staxxd ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website staxxd.co.uk and use our services.

We are a UK-based business consultancy and are committed to complying with the General Data Protection Regulation (GDPR) and the UK Data Protection Act 2018.

The data controller is STAXXD LTD, registered in England and Wales under company number 17309142, registered office 128 City Road, London, EC1V 2NX. We are registered with the Information Commissioner's Office as a data controller under registration reference ZC242922 (registered as Staxxd Ltd), which you can verify on the ICO register of fee payers.

1.1 Data We Handle For Clients

Where we build, host or maintain something for a client, we handle personal data on their behalf rather than our own. In that relationship the client is the controller and we are the processor. Our processor terms set out what we may do with it, and our sub-processor page names every third party involved.

2. Information We Collect

2.1 Information You Provide

We may collect information that you voluntarily provide to us when you:

• Contact us through our contact form (name, email, phone, company, message)
• Subscribe to our newsletter or marketing communications
• Request information about our services

2.2 Automatically Collected Information

When you visit our website, we may automatically collect certain information, including:

• IP address and browser type
• Pages visited and time spent on pages
• Referring website addresses
• Device information

3. How We Use Your Information

We use the information we collect to:

• Respond to your enquiries and provide customer support
• Send you information about our services (with your consent)
• Improve our website and services
• Comply with legal obligations
• Prevent fraud and ensure website security

4. Legal Basis for Processing (GDPR)

Under GDPR, we process your personal data based on the following legal grounds:

• Consent: When you provide explicit consent (e.g., contact form submissions)
• Legitimate Interests: To respond to enquiries and improve our services
• Legal Obligation: To comply with applicable laws and regulations

5. Data Sharing and Disclosure

We do not sell your personal data and we do not share it for advertising. It is shared only with the services we use to run this website:

We may also disclose information where we are required to by law.

6. Cookies and Tracking Technologies

This website sets no cookies. We use no analytics, advertising or social media tracking. Our Cookie Policy covers this in full.

7. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes outlined in this Privacy Policy, unless a longer retention period is required by law.

• Contact form submissions: Retained for 2 years or until you request deletion
• Marketing communications: Until you unsubscribe
• Website analytics: Anonymised data may be retained longer

8. Your Rights (GDPR)

Under GDPR, you have the following rights regarding your personal data:

• Right to Access: Request a copy of your personal data
• Right to Rectification: Correct inaccurate or incomplete data
• Right to Erasure: Request deletion of your personal data
• Right to Restrict Processing: Limit how we use your data
• Right to Data Portability: Receive your data in a structured format
• Right to Object: Object to processing of your data
• Right to Withdraw Consent: Withdraw consent at any time
• Right to Complain: Lodge a complaint with the supervisory authority

To exercise any of these rights, please contact us at hello@staxxd.co.uk.

If you are unhappy with how we have handled your personal data, you have the right to complain to the Information Commissioner's Office, the UK supervisory authority for data protection. You can do so at ico.org.uk/make-a-complaint or by calling 0303 123 1113. We would ask that you raise it with us first so we have the chance to put it right.

9. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. However, no method of transmission over the internet is 100% secure.

We are committed to maintaining high standards of cybersecurity and follow best practices aligned with Cyber Essentials, a UK government-backed cybersecurity certification scheme. Our security measures include:

• Secure data transmission using encryption (HTTPS/SSL)
• Regular security updates and patches
• Access controls and authentication measures
• Secure hosting and infrastructure
• Regular security assessments

10. International Data Transfers

This website is hosted by Vercel and served from their London region, so page requests and the resulting server logs are processed in the United Kingdom.

Some of our providers are US-headquartered and may process or store limited data outside the UK. Where that happens, the transfer relies on the UK Extension to the EU–US Data Privacy Framework, or on the International Data Transfer Addendum to the European Commission's Standard Contractual Clauses.

If you would like the current detail for any specific provider, email us and we will tell you.

11. Children's Privacy

Our services are not directed to individuals under 18 years of age. We do not knowingly collect personal information from children.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date.

13. Contact Us

If you have any questions about this Privacy Policy or wish to exercise your rights, please contact us:

Automated Decisions

We do not make decisions about you by automated means, and we do not profile you. Every decision affecting you is taken by a person. Article 13(2)(f) only requires this to be described where it happens, and it is here so nobody checking has to wonder.