Privacy policy - How personal information is handled

DGxC Limited is the data controller for this website. It decides what personal information the site collects and what happens to it.

DGxC Limited is registered in England and Wales, company number 09912793, at 3rd Floor, Old Stock Exchange, St Nicholas Street, Bristol BS1 1TG, United Kingdom. Anything in this policy can be raised at hello@dgxc.digital.

DGxC works in the United States and Canada as well as the United Kingdom. This policy covers the website wherever you read it from, and DGxC Limited is the entity answerable for it.

This policy covers this website and the preview versions of it. It explains what happens to information about you as a visitor or as someone making an enquiry.

It does not cover client project work. Where DGxC handles personal information as part of a project, it generally does so on the client's instructions and under the contract for that work, which sets its own terms. If you are trying to find out how an organisation DGxC works with handles your information, that organisation's own privacy notice is the place to look.

When you use the contact form

The form on the contact page asks for six things:

• your name
• your email address
• your company
• your phone number
• which service you are interested in, chosen from a list
• if none of the listed services fit, one sentence describing what you need

That last box appears only if you pick “Something else”, and it holds a single short sentence. It is the only free text on the form, and nothing is collected beyond those six fields.

When you visit the site

The analytics described under cookies and tracking below records the usual browsing signals: which pages you looked at and for how long, the site or search that sent you here, your approximate location worked out from your IP address, and the device and browser you are using.

Contact form details are used to answer your enquiry and to follow it up. The lawful basis is legitimate interests: somebody who fills in a business enquiry form is expecting a reply. If an enquiry turns into a piece of work, the basis becomes performance of a contract.

Analytics exists to show which pages people actually read and where they arrive from. The lawful basis is consent, given through the cookie banner, and nothing analytics-related runs until you have answered it.

The contact form is checked by Google reCAPTCHA before a submission is accepted. The lawful basis is legitimate interests: an enquiry form with nothing in front of it fills up with automated submissions, and real enquiries get lost among them.

Where the law requires a record to be kept, the basis is legal obligation.

The site itself sets no cookies of its own. Everything below comes from third-party tools loaded into the page.

Google Tag Manager, container GTM-MK53BBT3, loads the rest of the tag setup. Inside it, CookieHub presents the cookie banner and passes your answer to Google Consent Mode, which gates whether Google Analytics, property G-HX0SMHR7GL, can set cookies and record your visit. Changing your mind later is done through the same CookieHub banner.

Sending the contact form successfully also pushes a conversion event into that tag setup. The event says an enquiry happened, which service you picked from the list, and which page you were on. Whether it reaches Google depends on the same answer you gave the cookie banner. Your name, email address, phone number and company are not part of it, and they go nowhere near the analytics tags.

If you arrived from a Google advert, the advert puts a click identifier in the web address. That identifier is held in your browser for the rest of the session and attached to the conversion event, so an enquiry can be traced back to the advert that prompted it. Closing the tab clears it.

The contact page also loads Google reCAPTCHA. It sets a cookie and reads signals about your device and how you move through the page, and from those it scores how likely it is that a person rather than a script is filling the form in. It runs on the contact page only, and it runs whether or not you accepted analytics cookies, because it protects the form rather than measuring your visit.

Beyond the analytics above and that check, nothing on the site tries to identify you or work out which organisation you are browsing from. The reCAPTCHA cookie belongs to Google, and Google can recognise it on other sites running the same check, which is part of how the scoring works.

Contact form submissions go to an endpoint DGxC runs on its own infrastructure. No third-party form service or customer relationship tool sits in between.

The spam check is the one exception. Before a submission is accepted, reCAPTCHA sends Google a token and Google returns a score. Your name, email address, phone number, company and enquiry are not part of that exchange.

Analytics information goes to Google, which handles it under its own terms. The site is hosted and delivered through hosting and content delivery providers, which means they handle page traffic in the course of serving the site.

Beyond that, personal information is disclosed only where the law requires it.

Google is a United States company, and both the analytics information it collects and the reCAPTCHA check reach it there. Some personal information therefore leaves the United Kingdom. The contact form submissions themselves stay on infrastructure DGxC controls.

Enquiries are kept while the conversation is live and for a reasonable period afterwards, in case it picks up again or in case there is a record worth keeping for tax or legal reasons. After that they are deleted.

No fixed number of months is published here, because the right period depends on the enquiry and publishing one that does not match practice would be worse than publishing none. If you want your details removed sooner, ask and they will be.

Analytics data is kept for as long as Google retains it under the settings on that property.

The site runs over HTTPS, and form submissions travel to a DGxC-controlled endpoint over an encrypted connection. Access to enquiry records is limited to the people who need it. No website can promise perfect security, and this one does not.

Under UK data protection law you can ask DGxC Limited to do any of the following:

• tell you what personal information it holds about you
• correct anything that is wrong
• delete what it holds
• stop using it, or restrict how it is used
• hand it over in a portable form
• stop relying on legitimate interests, where you object to that
• withdraw consent for analytics, which you can also do through the cookie banner

Ask at hello@dgxc.digital. Some proof of identity may be needed first, so that information is not handed to the wrong person.

If you are unhappy with how a request is handled, you can complain to the Information Commissioner's Office, the UK regulator, at ico.org.uk. Readers outside the UK can raise the same points with their own national data protection authority.

The site is written for people working in business. It is not aimed at children, and it does not knowingly collect information about anyone under 13.

This policy changes when the site does. The date at the top shows when it last changed, and the version published here is the current one.

Questions about this policy, or about personal information held by DGxC Limited, can go to hello@dgxc.digital, or by post to 3rd Floor, Old Stock Exchange, St Nicholas Street, Bristol BS1 1TG, United Kingdom.