# Privacy policy > How we collect, use and protect personal information, including what happens when you send an enquiry or book a call. Source: [Privacy policy · South Digital](https://south.digital/privacy-policy) How we collect, use and protect personal information, including what happens when you send an enquiry or book a call. Last updated 15 October 2026 ## 01\. Who we are South Digital Ltd is a web design and development studio. **Legal entity** South Digital Ltd **Company number** 11859310 **VAT number** GB396566634 **ICO registration** ZA531336 **Registered in** England and Wales **Registered office** Unit 8 The Courtyard, Gaulby Lane, Stoughton, Leicester, LE2 2FL **Email** [hello@south.digital](mailto:hello@south.digital) **Phone** [0800 170 0171](tel:+448001700171) ## 02\. Controller and processor For this website we are usually the data controller. Where we manage data inside a client project, we act as a data processor on that client’s instructions. ## 03\. What this policy covers This policy applies when you visit our website, submit a form, book a call, communicate with us or work with us as a client, supplier or partner. It does not cover third-party websites we link to; each has its own policy. ## 04\. The information we collect - Information you give us directly: contact details, project information, billing details, content files and our communication history. - What you send through an enquiry form: your name, email address and message; your website and the services you tick, where the form asks for them; and, on the quote form, your optional budget and how you heard about us. - How you found us, sent with an enquiry or booking: the website that linked you here, reduced to its domain (for example https://www.google.com, never the page address or your search terms), and any campaign tags in the link you followed (utm\_source, utm\_medium, utm\_campaign, utm\_term and utm\_content), with anything that looks like an email address removed. We also note which page you sent the enquiry from. If you accept ad measurement, the identifier of the Google ad you clicked (gclid, gbraid or wbraid) is sent with your enquiry or booking too. Nothing is stored on your device to do this. - Technical data when you visit: like any website host, Vercel receives your IP address (the number that identifies your internet connection), browser details and the address of each page you request, so it can deliver this website and protect it from attacks. It keeps these requests in its logs for a limited period, and we use them to keep the website running and secure. Vercel’s country-level location also selects GBP prices for the UK, CAD for Canada and USD elsewhere; no precise location is requested. - Spam protection: Vercel applies a rate limit to enquiry requests by IP address. The enquiry server also counts how many times the form is sent from each IP address in 10 minutes. It counts a scrambled code made from the address, not the address itself, keeps it only in temporary memory, and the count expires after 10 minutes. Neither your IP address nor the code is added to your enquiry or to the enquiry form’s own log messages. - Usage data: if you accept analytics cookies, Google Analytics 4 measures page visits and each step through our forms and campaign pages through Google Tag Manager, with any campaign tags in the link you followed. If you accept ad measurement, Google Ads records which of our ads you clicked and whether that visit led to a website read, a brief or a booked call; when you book or send a brief, Google’s tag also sends a scrambled (hashed) copy of your email address so Google can match it to your ad click. Both receive technical information such as browser and device details and approximate location. We do not send form contents or names to either. You can reject or withdraw each choice through Preferences. Separately, our first-party counter adds page views and selected form steps directly to daily totals by page and event, without visitor IDs, sessions, fingerprinting, individual journeys, advertising identifiers, campaign tags, referrers or form contents. The totals are used only to improve this website, never sent to Google or joined to advertising or enquiry records. Page views are not unique people. With ad measurement accepted, separate first-party diagnostics record a campaign country, approved page category, UTC day, measurement stage, analytics permission and a random page key or scrambled conversion reference. This helps reconcile measurement delivery without collecting names, emails, IP addresses, click IDs, full queries or browser details in that table. It is separate from anonymous website counts and is not sent to Google. - Information from others: booking details from Cal.com when you book a call, company and professional information from Apollo, and data a client shares with us for a project. ## 05\. Enquiries, website reads and booked calls When you send an enquiry, it is processed by our website host, Vercel, whose functions for this site run in London, and stored in our Supabase operations database and sent to our team in Slack. To prepare for our first conversation, we may add publicly available information about your company from Apollo. We rely on our legitimate interests in replying to you, understanding your project and seeing how people find us. We keep enquiries for up to two years after our last interaction, and we won’t add you to marketing emails without your consent. When you enter a website address on our campaign pages, we fetch up to three of its public pages, its robots.txt, its icon, the stylesheets its homepage links and the site’s own sitemaps, following the rules in robots.txt. We send the address and the text of those pages to Anthropic, our AI provider, which processes them on our behalf, possibly outside the UK, to describe the business in plain words. We don’t send your name or contact details; if the website is your own as a sole trader, its address may identify you. The description is kept in our server’s memory for up to six hours so a second visit is quick. Our team also gets a note of each visit: the website you entered, what we found, the answers you give, how far you got and the campaign tags of the link you followed, even if you don’t book a call or send a brief, so we can see what people come to us for. Your name and email address reach us only if you book a call or send a brief. To limit misuse, we keep a short-lived, in-memory count of requests from each connection. Site owners can keep their site from the reader in robots.txt (product token SouthDigitalReader), or keep its pages from AI with a Content-Signal: ai-input=no line. If you book a call, on Cal.com or on our campaign pages, your name, email address, time zone, the time you choose, anything you tell us about your project and the email addresses of any colleagues you invite go to Cal.com, our scheduling provider. It sends the invitations and reminders and shares the booking with us so we can hold the call. Cal.com’s own privacy policy also applies. ## 06\. How we use it and why Under UK and EU data protection law, each use of personal information needs a legal basis. We do not sell your personal information. - Replying to enquiries and preparing for a first conversation: our legitimate interests. - Noting how people find us, from the details sent with an enquiry or booking, and keeping a note of each visit to our campaign pages: our legitimate interests. - Delivering this website, and protecting it and our forms from abuse: our legitimate interests. For the separate aggregate website counter, we use legitimate interests for its limited delivery and protection. In the UK we rely on the statistical purposes exception with clear information and a free objection. Counting defaults on in the UK and US; other or unknown locations require your express choice. Preferences or Reject all switches it off. Global Privacy Control and Do Not Track also stop this counter. Existing analytics refusals are respected unless you expressly choose otherwise. - Measuring visits and enquiry events with Google Analytics, and which of our ads lead to enquiries with Google Ads: your consent, asked for separately for each and withdrawable through Preferences. The separate first-party paid-measurement diagnostics also rely on your ad measurement consent. - Preparing proposals and delivering the work you ask for: our contract with you, or steps you ask us to take before one. - Invoicing, accounting and tax records: our legal obligations. - Sending updates you have opted into: your consent, which you can withdraw at any time. ## 07\. Who we share it with We share personal information only where it is needed: with the service providers below, with clients where a project requires it, with professional advisers, and with authorities where the law requires it. We do not sell personal information to anyone. - Vercel, which hosts this website and runs its enquiry form. - Supabase, our operations database. Our first-party counter sends Supabase only an approved page path and event name, immediately added to a daily total. No individual event, IP address or browser details are retained in that statistics table. Vercel still receives ordinary requests under its hosting and security arrangements; the country supplied by Vercel selects the counter’s default, but is not forwarded to the statistics table. A separate private table holds the ad-consented diagnostic records described above. - Slack, where our team receives website enquiries and notes of visits to our campaign pages. - Cal.com, which handles call bookings, and Anthropic, which describes the websites entered on our campaign pages. - Google Workspace, which handles our email. - Apollo, for company and professional information used to prepare for an enquiry. - Google, which provides Google Tag Manager and Google Analytics 4 after you accept analytics, and Google Ads measurement after you accept ad measurement. ## 08\. International transfers Some of the providers named above may store or process data outside the UK and EEA, including enquiries, emails and booking details. Where data leaves those regions we rely on adequacy decisions, standard contractual clauses or equivalent protections. ## 09\. How long we keep it - Enquiry data, and notes of visits to our campaign pages: up to two years after our last interaction. - Project records: up to six years after a project completes. - Financial records: for the periods tax law requires. - Website request logs: a limited period set by Vercel’s log retention. First-party paid-measurement diagnostic records are removed by daily cleanup after seven days, and their daily totals after 90 days. - The enquiry server’s spam-protection counts: 10 minutes, in temporary memory only. Vercel also keeps security request logs under its log-retention settings. The website counter uses the same ten-minute temporary address protection. Anonymous daily totals are kept for 400 days, with daily cleanup. A separate on/off preference, south-statistics-choice, is saved on your device only when you choose, until you change it or clear site storage. Enquiries and bookings remain separate business records even when all measurement is declined. ## 10\. Security We use secure devices, access controls, reputable providers and regular updates. No method of storage or transmission is perfectly secure, and we cannot guarantee absolute security. Our Security page describes how this website itself is built and served. [How we protect this website](https://south.digital/security) ## 11\. Your rights You may ask to access, correct or delete your personal information, restrict how we use it, object to uses based on our legitimate interests, or receive your data in a portable form. Where we rely on your consent, you can withdraw it at any time; this does not affect anything we did before you withdrew it. To exercise any of these rights, email hello@south.digital. If you are unhappy with how we have handled your data, you can complain to the UK Information Commissioner’s Office at ico.org.uk. ## 12\. Cookies This site remembers your theme, currency and cookie choices. Google Analytics cookies are set only after you accept analytics, and Google Ads cookies only after you accept ad measurement. The Cookie policy explains how to change your choices and remove cookies. [Read the cookie policy](https://south.digital/privacy-cookies) ## 13\. Children We do not intentionally collect personal information from anyone under 16. If you believe we have, contact us and we will delete it. ## 14\. Changes to this policy We may update this policy from time to time. Material changes are communicated by a notice on this website, and the date at the top of this page always reflects the current version. ## 15\. Contact Questions about this policy or your data reach us at hello@south.digital or on 0800 170 0171. [Email hello@south.digital](mailto:hello@south.digital)