1. Who we are
Arctane Digital (UK) Limited (registered in England and Wales, company number 12584170) is the data controller for personal data collected through our website and in the course of providing our services.
Registered office: Unit A, 82 James Carter Road, Mildenhall, Bury St Edmunds, Suffolk, IP28 7DE. ICO registration number: ZA784264. You can reach us at ethan@arctanedigital.co.uk.
2. What data we collect
We collect personal data in the following situations:
- When you contact us (by email, phone, or via the contact form): your name, business name, email address, phone number, and the content of your message.
- When you engage us as a client: contact details for you and your team, billing information, and any business information needed to deliver the services.
- When you visit the site: our web server records each request in a log file, including the page requested, the time, the response status, the referring page, your browser's user-agent string, and your IP address. Separately, our own analytics records certain actions you take on the site. Section 12 covers that in full.
3. How we use it
We use personal data to:
- Respond to enquiries and provide quotes.
- Deliver the services you have engaged us for.
- Manage billing and accounts.
- Operate, maintain and secure the website.
- Comply with our legal and regulatory obligations.
4. Lawful basis
We rely on the following lawful bases under UK GDPR:
- Contract: to deliver services you have engaged us for.
- Legitimate interests: to respond to business enquiries, secure our website, and administer our business.
- Legal obligation: to keep records required by tax and accounting law.
- Consent: where we use non-essential cookies or send marketing communications, we ask first and you can withdraw consent at any time.
5. Sharing
We do not sell personal data. We share it only with carefully selected service providers who help us run the business: for example our hosting providers, accounting software, email infrastructure, and Microsoft for M365/Exchange services. Each is contractually bound to handle data in line with UK GDPR.
We may disclose data where required by law, regulation, or a valid legal request.
6. International transfers
Some of our service providers (such as Microsoft) may process data outside the UK. Where this happens we rely on appropriate safeguards such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or adequacy regulations made by the UK government.
7. How long we keep it
Enquiry data is kept for up to 12 months from your last contact. Client and billing records are kept for at least 6 years to meet our legal obligations under UK tax law. Server logs are kept for up to 90 days. Website analytics records (section 12) are kept for up to 400 days.
8. Your rights
Under UK GDPR you have the right to:
- Access the personal data we hold about you.
- Have inaccurate data corrected.
- Have your data erased (in certain circumstances).
- Restrict or object to processing (in certain circumstances).
- Receive your data in a portable format (in certain circumstances).
- Withdraw consent where processing is based on consent.
To exercise any of these, email ethan@arctanedigital.co.uk. We will respond within one month.
9. Complaints
If you are unhappy with how we handle your data, please contact us first so we can put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk.
10. Security
We use reasonable technical and organisational measures to protect personal data from loss, misuse, unauthorised access, and disclosure. No system is perfectly secure, however, and we cannot guarantee absolute security.
11. Prize draws and competitions
When you enter one of our competitions (such as the "Win a Free Website" prize draw), we collect your contact name, business name, email address, phone number, business town or village, and whether you ticked the optional marketing box.
We use this data to administer the prize draw: verifying eligibility, running the draw, contacting the winner, and sending every entrant the runner-up offer that is part of the promotion. The lawful basis is our legitimate interest in running the promotion fairly and, for the winner, taking steps to enter into a contract.
The marketing tickbox is separate, optional, and never required to enter. If you tick it, we may contact you about our services; the lawful basis is consent, and you can withdraw it at any time by emailing us or using the unsubscribe link in any marketing email.
Entry data is deleted within 3 months of the draw, except the winner's records (kept as client records) and the details of anyone who opted into marketing (kept until consent is withdrawn).
Your usual rights apply: you can ask for access to your data, ask for it to be deleted, or complain to the ICO. See sections 8 and 9 above.
12. Website analytics
We measure how this site is used with our own software, running on our own UK servers. No third party receives this data, and nothing is stored on your device: no cookies, no local storage, no fingerprinting. Because of that, this measurement does not require your consent under the cookie rules, and it runs whether or not you accept analytics cookies on the banner.
We record when someone submits an enquiry form or clicks a phone number, email address or outbound link, along with the page it happened on and the referring page or campaign tag that brought you to the site. If you fill in the optional "Where did you hear about us?" box on the contact form, we keep that answer too.
We do not keep your IP address. It is converted into a one-way coded value using a secret that changes every day, which lets us count how many separate people visited on a given day without identifying anyone and without linking a visit today to a visit tomorrow. The original address cannot be recovered from that value, and once the day rolls over the value cannot be reproduced again even by us.
Our lawful basis is legitimate interests: understanding how our own website performs so we can improve it. This is separate from Google Analytics, which is optional, cookie-based, and only loads if you accept it on the banner. Our cookie policy covers that.
13. Changes
We update this policy from time to time. The current version is always available at this URL with the date it was last updated.