Privacy Policy

Last Updated: 27-03-2019

Introduction and Our Commitment to Your Privacy

At Delta Internet Limited, we understand that your privacy is fundamental to your trust in us. As a professional digital marketing agency, we handle personal information with the utmost care and in strict compliance with all applicable data protection legislation. This comprehensive Privacy Policy explains how we collect, use, protect, share, and manage your personal data.

We respect and value the privacy of everyone who visits our website, deltainternetltd.com (“Our Site”), enquires about our services, or engages us as a client. We will only collect and use personal data in ways that are described in this Privacy Policy and in a manner that is consistent with our obligations and your rights under UK and international data protection law.

Our Promise to You

Please read this Privacy Policy carefully to understand our views and practices regarding your personal data and how we will treat it. Your use of Our Site signifies your acceptance of this Privacy Policy. If you do not accept this Privacy Policy, please do not use Our Site or provide us with any personal information.

1. Key Information and Definitions

1.1 Who We Are (Data Controller)

For the purposes of applicable data protection legislation, Delta Internet Limited is the Data Controller of the personal data collected through Our Site and in the provision of our services. This means we determine the purposes for which and the manner in which your personal data is processed.

Our Details:

1.2 Our Data Protection Officer

Our Data Protection Officer is responsible for overseeing questions in relation to this Privacy Policy and our data protection practices. If you have any questions about this Privacy Policy, including any requests to exercise your legal rights, please contact our Data Protection Officer:

Contact Details:

1.3 Important Definitions

To ensure clarity throughout this Privacy Policy, the following terms have specific meanings:

“Personal Data” means any information relating to an identified or identifiable natural person (a “Data Subject”). An identifiable person is one who can be identified, directly or indirectly, by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that person.

“Special Categories of Personal Data” means personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data (where used for identification purposes), data concerning health, or data concerning a person's sex life or sexual orientation. We do not generally collect or process Special Categories of Personal Data except in limited circumstances where you explicitly provide such information or where necessary for legal compliance.

“Processing” means any operation or set of operations performed on personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.

“Data Processor” means a natural or legal person, public authority, agency, or other body which processes personal data on behalf of the Data Controller. When we use third-party service providers to process personal data on our behalf, they act as Data Processors under our instruction.

“UK GDPR” means the UK General Data Protection Regulation, being the GDPR as it forms part of UK law by virtue of section 3 of the European Union (Withdrawal) Act 2018, as amended by the Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019.

“Data Protection Act 2018” or “DPA 2018” means the primary piece of UK legislation governing data protection, which supplements and tailors the UK GDPR.

“PECR” means the Privacy and Electronic Communications (EC Directive) Regulations 2003 (as amended), which regulate electronic communications including cookies, marketing emails, and calls.

“Cookies” means small text files that are placed on your computer, smartphone, or other device when you visit websites. Cookies contain information that is transferred to your device's hard drive and enable websites to remember information about your visit.

“Legitimate Interests” means the lawful basis for processing where our use of your data is necessary for our legitimate business interests or those of a third party, provided those interests are not overridden by your fundamental rights and freedoms.

“Consent” means any freely given, specific, informed, and unambiguous indication of your wishes by which you, through a statement or clear affirmative action, signify agreement to the processing of personal data relating to you.

1.4 Scope of This Privacy Policy

What This Policy Covers:

This Privacy Policy applies to personal data we collect:

What This Policy Does Not Cover:

This Privacy Policy does not apply to:

We have no control over and are not responsible for the privacy practices of third-party websites or services. We strongly advise you to review the privacy policies of any third-party sites you visit.

1.5 Children's Privacy

Age Restrictions:

Our Site and services are not intended for children under the age of 16. We do not knowingly collect personal data from children under 16. If you are under 16, please do not use Our Site, register an account, submit any personal information through Our Site, or engage our services.

Parental Notice:

If you are a parent or guardian and you are aware that your child has provided us with personal data without your consent, please contact us immediately. If we become aware that we have collected personal data from a child under 16 without verification of parental consent, we will take steps to remove that information from our systems promptly.

Educational Services:

In limited circumstances where we provide services to educational institutions that involve processing data of minors, we do so under appropriate legal agreements with the institution, which acts as the Data Controller, and with appropriate safeguards in place.

2. What Personal Data We Collect

The personal data we collect depends on how you interact with us. Below is a comprehensive overview of the types of personal data we may collect, organized by source and purpose.

2.1 Data You Provide Directly to Us

Contact and Enquiry Information:

When you contact us, submit an enquiry form, or register for our newsletter, we may collect:

Account Registration Data:

If you create an account on Our Site (for accessing client portals, resources, or other features), we collect:

Service Engagement Information:

When you engage our services as a client, we collect:

Payment and Billing Information:

For financial transactions, we collect:

Communications and Correspondence:

We retain records of:

Event and Webinar Registrations:

If you register for events, webinars, training sessions, or workshops we organize, we collect:

Job Applications:

If you apply for employment with us, we collect:

2.2 Data We Collect Automatically

Website Usage Data:

When you visit Our Site, we automatically collect certain information through cookies and similar technologies:

Technical and Diagnostic Data:

For maintaining and improving Our Site, we collect:

Marketing and Analytics Data:

Through marketing technologies and analytics platforms, we collect:

2.3 Data We Receive from Third Parties

Business Intelligence and Lead Data:

We may receive information about you from:

This information typically includes business contact details, company information, professional roles, and publicly available business information. We only obtain such data from reputable sources that have appropriate consent or legal basis for sharing the information.

Social Media Platforms:

If you interact with us on social media or choose to connect your social media accounts with Our Site, we may receive:

Analytics and Advertising Partners:

We receive aggregated and/or anonymized data from:

Referral Partners:

If someone refers you to us or recommends our services, we may receive:

2.4 Special Categories of Personal Data

General Policy:

We do not routinely collect Special Categories of Personal Data (such as health information, racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic or biometric data, sex life, or sexual orientation).

Limited Exceptions:

In rare circumstances, we may process Special Categories of Personal Data:

Accessibility and Dietary Requirements:

If you attend our in-person events and inform us of dietary requirements (which may indicate religious beliefs) or accessibility needs (which may indicate health conditions), we process this data solely to accommodate your needs at the event.

Diversity Monitoring:

If you apply for employment, we may collect diversity monitoring information on a voluntary basis. This data is:

Legal Basis:

When we process Special Categories of Personal Data, we rely on:

You can withdraw consent for processing Special Categories of Personal Data at any time by contacting us.

2.5 Data We Do Not Collect

To provide clarity and reassurance, we want to be explicit about data we do not collect:

3. How and Why We Use Your Personal Data

We process your personal data only where we have a lawful basis to do so under UK GDPR. Below we explain the purposes for which we use your personal data and the lawful bases we rely upon.

3.1 Legal Bases for Processing

Under UK GDPR, we must have a lawful basis for processing your personal data. The lawful bases we rely upon are:

Consent:

You have given clear, informed consent for us to process your personal data for a specific purpose. You can withdraw consent at any time.

Contract:

Processing is necessary for us to perform a contract with you or to take steps before entering into a contract at your request.

Legal Obligation:

Processing is necessary for us to comply with legal obligations we are subject to under UK or EU law.

Vital Interests:

Processing is necessary to protect someone's life (rarely applicable in our context).

Public Task:

Processing is necessary to perform a task in the public interest or for official functions (not typically applicable to our business).

Legitimate Interests:

Processing is necessary for our legitimate interests or those of a third party, except where those interests are overridden by your rights and freedoms. When we rely on legitimate interests, we carefully balance our interests against your rights.

3.2 Purposes and Legal Bases

Providing Our Services to Clients

Purpose: To deliver the digital marketing services you've engaged us to provide, including:

Legal Basis: Contract (necessary to perform our services under our agreement with you)

Data Used: Service engagement information, website access, advertising account access, performance data, communications

Responding to Enquiries and Communications

Purpose: To respond to your questions, enquiries, requests for information, and other communications with us.

Legal Basis: - Legitimate Interests (our interest in responding to enquiries and building business relationships) - Contract (where your enquiry relates to entering into a contract)

Data Used: Contact information, enquiry details, correspondence records

Creating and Managing Your Account

Purpose: To create, maintain, and manage any account you create on Our Site, including:

Legal Basis: - Contract (necessary to provide account services) - Legitimate Interests (efficient account management and customer service)

Data Used: Account registration data, login credentials, preferences, usage history

Processing Payments and Managing Billing

Purpose: To process payments for our services, issue invoices, maintain financial records, and manage any payment issues or disputes.

Legal Basis:

Data Used: Payment information, billing addresses, transaction history, VAT numbers, purchase orders

Improving Our Site and Services

Purpose: To understand how Our Site is used and how our services are received, enabling us to:

Legal Basis: Legitimate Interests (our interest in providing a high-quality website and continuously improving our services)

Data Used: Website usage data, technical data, analytics data, feedback and survey responses

Marketing and Business Development

Purpose: To market our services to you, including:

Legal Basis:

Data Used: Contact information, engagement history, communication preferences, company information

Important: You can opt out of marketing communications at any time using the unsubscribe link in emails or by contacting us.

Security and Fraud Prevention

Purpose: To protect Our Site, our systems, our business, and our clients from:

Legal Basis:

Data Used: Technical data, IP addresses, access logs, usage patterns, communications

Compliance and Legal Requirements

Purpose: To comply with our legal and regulatory obligations, including:

Legal Basis: Legal Obligation, Legitimate Interests (in protecting our legal rights)

Data Used: All relevant personal data necessary for compliance purposes

Event Management

Purpose: To organize and manage events, webinars, and training sessions, including:

Legal Basis:

Data Used: Registration information, attendance records, preferences, feedback

Recruitment and Employment

Purpose: To manage job applications and, if you become an employee:

Legal Basis:

Data Used: Application materials, employment records, performance data

Business Operations and Administration

Purpose: To run our business efficiently, including:

Legal Basis: Legitimate Interests (efficient business operations)

Data Used: Business contact information, contracts, communications, transaction records

3.3 Automated Decision-Making and Profiling

Our Approach:

We do not use automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you.

Limited Automated Processing:

We may use automated systems for:

Human Oversight:

Any significant decisions affecting you (such as whether to take you on as a client, pricing, or service recommendations) involve human review and judgment.

Your Rights:

If our approach to automated processing changes, we will:

3.4 Marketing Communications

Types of Marketing:

Direct Marketing to Existing Clients:

If you're a client, we may send you information about similar services to those you've purchased, based on our legitimate interests, unless you opt out.

Direct Marketing to Prospects:

If you've enquired about our services or provided consent, we may send marketing communications about our services.

Email Marketing:

We send newsletters, updates, case studies, and promotional emails to those who have:

Telephone Marketing:

We may contact business prospects by telephone based on legitimate interests. We respect the Telephone Preference Service (TPS) and Corporate Telephone Preference Service (CTPS).

Social Media and Online Advertising:

We may show you targeted advertisements on social media and other platforms based on:

Your Control:

You can opt out of marketing at any time by:

Opting out of marketing does not affect:

4. How Long We Keep Your Personal Data

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected and to comply with legal, regulatory, accounting, and reporting requirements.

4.1 General Retention Principles

Purpose Limitation:

Once personal data is no longer needed for its original purpose, we delete or anonymize it, unless we're required to retain it for legal reasons.

Legal Requirements:

Certain types of data must be retained for specific periods under UK law (e.g., financial records for tax purposes).

Your Rights:

You can request deletion of your data at any time, though we may need to retain certain information for legal compliance.

4.2 Specific Retention Periods

Website Visitors and Enquiries:

Newsletter Subscribers and Marketing Contacts:

Client Service Data:

Rationale for 7-year retention: This period aligns with UK tax law requirements and statute of limitations for contract claims (6 years, plus 1 year buffer).

Account Information:

Event and Webinar Participants:

Job Applications:

Special Categories of Personal Data:

Legal Claims and Disputes:

Where data is relevant to actual or potential legal claims:

4.3 Data Deletion and Anonymization

Secure Deletion:

When retention periods expire, we:

Anonymization:

Instead of deletion, we may anonymize data by:

Anonymized data is no longer personal data and can be retained indefinitely for research, analytics, and business intelligence purposes.

4.4 Your Right to Request Earlier Deletion

You have the right to request deletion of your personal data before the standard retention period expires (the “right to erasure” or “right to be forgotten”).

When we must delete your data:

When we may refuse deletion:

How to request deletion:

Contact us at [email protected] with subject “Right to Erasure Request”. We'll respond within 30 days.

5. How We Protect Your Personal Data

Data security is of paramount importance to us. We implement comprehensive technical and organizational measures to protect your personal data against unauthorized access, accidental loss, destruction, or damage.

5.1 Technical Security Measures

Encryption:

Network Security:

Access Controls:

System Security:

Data Backup and Recovery:

Secure Data Disposal:

5.2 Organizational Security Measures

Staff Training and Awareness:

Access Management:

Confidentiality Agreements:

Policies and Procedures:

Physical Security:

Vendor Management:

5.3 Payment Security

PCI DSS Compliance:

We comply with Payment Card Industry Data Security Standards (PCI DSS) for handling payment card information.

Third-Party Payment Processors:

We use PCI DSS Level 1 compliant payment processors (such as Stripe, PayPal, or GoCardless) for handling payment transactions. We do not store complete credit card details on our own systems.

Information We Store:

We may retain:

Direct Debit and Bank Transfers:

When processing Direct Debits or bank transfers:

5.4 Limitations and Your Responsibilities

No Absolute Security:

Despite our comprehensive security measures, you should be aware that:

Your Responsibilities:

To help us protect your data, you should:

Email Security:

Email is not a completely secure medium. For highly sensitive information, consider:

6. Who We Share Your Personal Data With

We respect your privacy and do not sell, rent, or trade your personal data to third parties for their marketing purposes. However, we do share your personal data with certain trusted third parties in limited circumstances, as described below.

6.1 Service Providers and Data Processors

We engage carefully selected third-party service providers to help us operate our business and provide services to you. These providers process personal data on our behalf, under our instruction, and subject to strict contractual obligations.

Categories of Service Providers:

Website and Technology Infrastructure:

Communication and Customer Relationship Management:

Analytics and Performance Monitoring:

Advertising and Marketing Technologies:

Payment Processing:

Security and Fraud Prevention:

Professional Services:

Data Processing Agreements:

We have Data Processing Agreements (DPAs) in place with all service providers that process personal data on our behalf. These agreements:

Sub-Processors:

Some of our processors may use sub-processors (e.g., cloud hosting providers using data center operators). We maintain oversight of these arrangements and ensure appropriate safeguards are in place throughout the processing chain.

6.2 Client-Authorized Third Parties

When providing services to clients, we may need to interact with third-party platforms and services on your behalf, with your authorization:

Advertising Platforms:

Social Media Accounts:

Analytics and SEO Tools:

Website and E-Commerce Platforms:

Email Marketing Systems:

In these cases:

6.3 Legal and Regulatory Authorities

We may disclose your personal data to legal, regulatory, or governmental authorities when required or permitted by law:

Mandatory Disclosures:

Discretionary Disclosures:

Transparency Commitment:

Where legally permitted, we will:

6.4 Business Transfers

Mergers, Acquisitions, and Sales:

If we sell, merge, or reorganize our business, or sell any part of our business, personal data may be transferred to potential or actual purchasers or merger partners.

Protection of Your Data:

In such circumstances:

Due Diligence:

During due diligence processes, we may share limited data with potential purchasers or investors under strict confidentiality agreements.

6.5 Anonymized and Aggregated Data

Non-Personal Data:

We may share anonymized, aggregated, or statistical data that cannot identify you individually with:

Example: We might share statistics like “Our SEO clients see an average 45% increase in organic traffic over 12 months” without revealing any individual client's data.

True Anonymization:

We ensure that anonymized data:

6.6 With Your Consent

We may share your personal data with other third parties where you have given specific consent for us to do so. This might include:

You can withdraw such consent at any time by contacting us.

6.7 What We Don't Do

No Selling of Data:

We do not sell, rent, or trade your personal data to third parties for monetary or other valuable consideration.

No Third-Party Marketing (Without Consent):

We do not share your personal data with third parties for their own marketing purposes unless you've explicitly consented.

No Indiscriminate Sharing:

We do not share your data widely or unnecessarily. Sharing is limited to specific purposes outlined in this Privacy Policy.

7. International Data Transfers

7.1 Our Approach to International Transfers

UK-Based Operations:

We are a UK-based company and our primary operations and data processing take place within the United Kingdom.

Some International Processing:

However, some of the third-party service providers we use may process data outside the UK and European Economic Area (EEA), particularly:

7.2 Safeguards for International Transfers

When we transfer personal data outside the UK/EEA, we ensure appropriate safeguards are in place:

Adequacy Decisions:

We may transfer data to countries that the UK Government has determined provide adequate data protection, including:

Standard Contractual Clauses (SCCs):

For transfers to countries without adequacy decisions, we use Standard Contractual Clauses approved by the UK Information Commissioner's Office. These are legal contracts that:

Alternative Transfer Mechanisms:

Where appropriate, we may also rely on:

Supplementary Measures:

Following guidance from European data protection authorities, we implement supplementary measures where necessary, such as:

7.3 US Transfers and Privacy Framework

Current Situation:

Following the invalidation of the EU-US Privacy Shield, transfers to the United States require careful attention.

Our Approach:

For US-based service providers:

Future Developments:

We monitor developments regarding:

7.4 Your Rights Regarding International Transfers

You have the right to:

For More Information:

If you have questions or concerns about international data transfers, please contact our Data Protection Officer at [email protected].

8. Your Data Protection Rights

Under the UK GDPR and Data Protection Act 2018, you have extensive rights regarding your personal data. We are committed to facilitating the exercise of these rights.

8.1 Right to Be Informed

What It Means:

You have the right to clear, transparent information about how we use your personal data.

How We Fulfill This Right:

This Privacy Policy and our communications provide comprehensive information about our data processing practices.

8.2 Right of Access (Subject Access Request)

What It Means:

You have the right to obtain:

How to Exercise:

Submit a Subject Access Request by emailing [email protected] with subject “Subject Access Request”

What We Need From You:

Our Response:

What We Provide:

8.3 Right to Rectification

What It Means:

You have the right to have inaccurate personal data corrected and incomplete data completed.

How to Exercise:

Contact us at [email protected] explaining what information is inaccurate or incomplete and providing the correct information.

Our Response:

Examples:

8.4 Right to Erasure (“Right to Be Forgotten”)

What It Means:

In certain circumstances, you have the right to have your personal data deleted.

When This Right Applies:

When We Can Refuse:

How to Exercise:

Email [email protected] with subject “Right to Erasure Request”

Our Response:

8.5 Right to Restrict Processing

What It Means:

In certain circumstances, you can ask us to restrict (but not delete) your personal data, meaning we store it but don't use it.

When This Right Applies:

Effect of Restriction:

How to Exercise:

Email [email protected] with subject “Right to Restriction Request” and explain the grounds

Our Response:

8.6 Right to Data Portability

What It Means:

You have the right to receive your personal data in a structured, commonly used, machine-readable format, and to transmit it to another controller.

When This Right Applies:

This right does NOT apply to:

How to Exercise:

Email [email protected] with subject “Data Portability Request”

What We Provide:

Our Response:

Example: If you want to move your email marketing list from our CRM to a new provider, we can provide the data in a format the new provider can import.

8.7 Right to Object

What It Means:

You have the right to object to processing of your personal data in certain circumstances.

Direct Marketing:

Legitimate Interests Processing:

Research and Statistics:

How to Exercise:

Email [email protected] with subject “Right to Object” and explain your grounds

Our Response:

8.8 Rights Related to Automated Decision-Making and Profiling

What It Means:

You have the right not to be subject to decisions based solely on automated processing (including profiling) that produce legal effects or similarly significantly affect you.

Our Practice:

If This Changes:

8.9 How to Exercise Your Rights

Contact Methods:

Email (Preferred):

[email protected]
Subject line: “[Type of Request] - [Your Name]”

Post:

Data Protection Officer
Delta Internet Limited
9 Fairburn Close, Borehamwood, Hertfordshire, WD6 5EZ, United Kingdom

What to Include in Your Request:

Identity Verification:

To protect your privacy and prevent unauthorized disclosure, we may request identification before responding to your request:

Our Response Timeline:

If We Need More Information:

If We Refuse Your Request:

8.10 Right to Complain

To the Information Commissioner's Office (ICO):

If you believe we've not handled your data properly or violated your rights, you can lodge a complaint with the UK's supervisory authority:

Information Commissioner's Office (ICO)
Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Telephone: 0303 123 1113
Website: www.ico.org.uk
Report online: www.ico.org.uk/make-a-complaint

Before Complaining to the ICO:

We encourage you to contact us first at [email protected]. We take complaints seriously and will work to resolve any issues. However, you have the right to complain directly to the ICO at any time.

Judicial Remedy:

You also have the right to seek a judicial remedy through the courts if you believe your data protection rights have been infringed.

9. Cookies and Similar Technologies

9.1 What Are Cookies?

Cookies are small text files stored on your device (computer, smartphone, tablet) when you visit websites. They contain information that is transferred to your device's hard drive and enable the website to remember information about your visit.

Types of Cookies:

Session Cookies: Temporary cookies that expire when you close your browser

Persistent Cookies: Remain on your device for a set period or until you delete them

First-Party Cookies: Set by the website you're visiting

Third-Party Cookies: Set by a different domain than the website you're visiting (e.g., advertising networks)

9.2 How We Use Cookies

Cookie Consent:

Essential Cookies (Strictly Necessary):

These cookies are necessary for Our Site to function. They cannot be switched off.

Purpose:

Example cookies:

Legal basis: Strictly necessary for site operation (no consent required under PECR)

Performance and Analytics Cookies:

These cookies collect information about how you use Our Site to help us improve it.

Purpose:

Services we use:

Legal basis: Consent (required under PECR)

Functionality Cookies:

These cookies allow Our Site to remember choices you make and provide enhanced features.

Purpose:

Legal basis: Consent (required under PECR)

Advertising and Targeting Cookies:

These cookies track your browsing habits to show you relevant advertisements and measure campaign effectiveness.

Purpose:

Services we use:

>