This policy explains how we handle personal data collected through kick.digital. It does not cover data processed inside software we build or run for clients — that is governed by the agreement with the relevant client.
Who we are
Kick Digital is operated by Kick Digital Ltd, a company registered in England and Wales (company number 08967728). Our registered office is Projects, Nile House, FAO Numbers Studio, Nile Street, Brighton, East Sussex, BN1 1HW. Our working studio is in Plymouth — see the contact page for that address.
For the purposes of UK GDPR, Kick Digital Ltd is the data controller for personal data collected through this website. You can reach us at [email protected] or on 01752 710404.
What we collect
We collect personal data in two situations.
1. When you contact us
If you submit the contact form, you give us your name, email address, and message. Organisation, project type, and budget are optional. The submission is verified using a Cloudflare Turnstile challenge before it reaches us, and then delivered by email to our inbox.
2. Automatically, when you visit the site
We use Umami, a privacy-focused analytics tool we
host ourselves at analytics.kickdigital.dev. Umami
records anonymous, aggregated visit data: the page you viewed, the
referring page, your approximate country (derived from your IP
address), and basic browser and device information.
Umami does not set cookies, does not use local storage, and does not build a profile that tracks you across sessions or sites. A server-side session identifier is derived from a daily-rotating hash of your IP address and browser; it cannot be reversed, and it resets every day. Your IP address itself is not stored.
Our hosting provider also logs standard request data (IP address, user-agent, pages requested, timestamps) for security and diagnostic purposes. This data is retained briefly and is not used to build visitor profiles.
We do not run advertising pixels, third-party analytics, session recorders, or similar tools on this site.
How we use your data and our legal basis
- To reply to your enquiry — legal basis: legitimate interests (responding to someone who has contacted us), or where appropriate, steps taken at your request prior to entering a contract.
- To understand how the site is used (via Umami) — legal basis: legitimate interests in measuring and improving our website. Because no cookies or device storage are involved, this processing does not require consent under PECR.
- To keep the site secure and working (server logs, anti-bot checks) — legal basis: legitimate interests in operating and protecting our infrastructure.
How long we keep it
- Enquiry emails: retained in our mailbox for as long as needed to serve you, and then for up to 24 months afterwards for business record-keeping, unless you ask us to delete them sooner.
- Umami analytics: aggregated visit data is kept for up to 24 months. There is no identifier in this data that links back to you.
- Server and security logs: up to 30 days in the ordinary course of business.
Who we share it with
We do not sell your data. We share it only with service providers that help us run the site and respond to you:
- Netlify — hosts the website and processes request logs. Netlify is based in the United States.
- Cloudflare — provides the Turnstile anti-bot challenge on our contact form. Turnstile is designed to work without setting tracking cookies. See Cloudflare's privacy policy.
- Our email provider — delivers enquiry emails to
our
[email protected]inbox over SMTP.
Umami is self-hosted on our own infrastructure, so analytics data is not shared with a third-party processor.
Where any of these providers process personal data outside the UK, they do so under appropriate safeguards (such as the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or an adequacy decision).
Cookies
This site does not set analytics, advertising, or tracking cookies. Because of that, we do not display a cookie consent banner — there is nothing non-essential to consent to.
If we add cookies or tracking in the future that require consent under the Privacy and Electronic Communications Regulations (PECR), we will ask for your consent before setting them and update this policy.
Your rights
Under UK GDPR, you have the right to:
- Request a copy of the personal data we hold about you.
- Ask us to correct information that is inaccurate or incomplete.
- Ask us to delete your data, where we no longer need it.
- Object to, or ask us to restrict, certain processing.
- Receive your data in a portable format.
To exercise any of these rights, email [email protected]. We will respond within one month.
Making a complaint
We would rather hear from you first so we can put things right, but you have the right to complain to the UK Information Commissioner's Office (ICO). You can contact the ICO at ico.org.uk or on 0303 123 1113.
Changes to this policy
If we make material changes, we will update the "Last updated" date at the top of this page.