Ctrl-X Digital Ltd is committed to protecting personal data and maintaining appropriate security and privacy standards in accordance with UK GDPR and the Data Protection Act 2018.
Last Updated: 14 May 2026
1. Our Commitment to Data Protection
This policy outlines how Ctrl-X Digital Ltd collects, processes, stores, and protects personal data in the course of delivering services to clients.
2. Definitions
Client – Any individual or organisation commissioning or receiving services from Ctrl-X Digital Ltd.
Client Data – Any information provided by the client, including but not limited to customer data.
Customer Data – Personal data relating to identifiable individuals, including names, email addresses, telephone numbers, postal addresses, and similar information.
3. Roles and Responsibilities
In most cases, the client acts as the Data Controller and Ctrl-X Digital Ltd acts as the Data Processor when providing hosting, development, maintenance, or support services.
Ctrl-X Digital Ltd also acts as a Data Controller in relation to its own business operations, including invoicing, client communications, support records, and supplier management.
Clients are responsible for ensuring they have a lawful basis for collecting and sharing personal data with us.
4. ICO Registration
Ctrl-X Digital Ltd is registered with the Information Commissioner’s Office (ICO) as required under UK data protection law.
Registration reference: ZC018214
5. Data Collection and Use
We only process data necessary to deliver, maintain, or support the services requested by the client.
Clients should avoid sharing unnecessary or sensitive personal data unless specifically required for the agreed work.
6. Data Sharing
We do not sell or disclose personal data to third parties except:
- where explicitly authorised by the client
- where required by law
- where necessary for the delivery of agreed services using approved third-party providers or sub-processors
7. Data Retention
We retain personal data only for as long as necessary to fulfil the agreed services or meet our legal obligations.
Where data is hosted on third-party platforms such as Mailchimp, Campaign Monitor, or similar, it is the client’s responsibility as Data Controller to manage retention and compliance in line with applicable laws.
Backup systems may retain historic copies for a limited period as part of normal disaster recovery procedures.
8. Lawful Basis for Processing
We process data where necessary to:
- Deliver contracted services
- Communicate with clients
- Provide technical support
- Maintain records required for legal, accounting, or operational purposes
9. Data Subject Rights
Data subjects have the following rights under UK GDPR, subject to lawful limitations:
- Right to access personal data
- Right to rectification
- Right to erasure (“right to be forgotten”)
- Right to restrict processing
- Right to data portability
- Right to object to processing
- Right to withdraw consent where applicable
- Right to lodge a complaint with the Information Commissioner’s Office (ICO)
We assist clients in responding to such requests in a timely and compliant manner.
10. Security Measures
We take appropriate technical and organisational measures to protect personal data, including secure storage, encrypted connections where appropriate, access controls, backups, and security monitoring.
Any data breach will be reported to affected parties in accordance with UK GDPR breach notification requirements.
11. Agreement and Undertaking
Ctrl-X Digital Ltd is committed to handling personal data responsibly, lawfully, and transparently.
Clients remain responsible for ensuring any personal data shared with us has been collected and processed lawfully.
Contact
If you have any questions about this Privacy Policy or wish to exercise your data protection rights, please contact Ctrl-X Digital Ltd via the contact page on this website.
