Ctrl-X Digital Ltd is committed to protecting personal data and maintaining appropriate security and privacy standards in accordance with UK GDPR, the Data Protection Act 2018 and the Data (Use and Access) Act 2025.
Last Updated: 12 October 2026
1. Our Commitment to Data Protection
This policy outlines how Ctrl-X Digital Ltd collects, processes, stores and protects personal data in the course of operating its business and delivering services to clients.
2. Definitions
Client – Any individual or organisation commissioning or receiving services from Ctrl-X Digital Ltd.
Client Data – Any information provided by the client, including but not limited to customer data.
Customer Data – Personal data relating to identifiable individuals, including names, email addresses, telephone numbers, postal addresses, and similar information.
3. Roles and Responsibilities
Depending on the services provided, Ctrl-X Digital Ltd may act as either a Data Controller or Data Processor. When providing website hosting, development, maintenance and technical support, we generally act as a Data Processor in relation to personal data held on behalf of our clients.
We act as a Data Controller for our own business operations, including client relationships, invoicing, correspondence, support records and supplier management.
Clients are responsible for ensuring they have an appropriate lawful basis for collecting personal data and for instructing us to process that data on their behalf. When acting as a Data Processor, Ctrl-X Digital Ltd processes personal data in accordance with the client’s documented instructions and its own obligations under applicable data protection law.
4. ICO Registration
Ctrl-X Digital Ltd is registered with the Information Commissioner’s Office (ICO) as required under UK data protection law.
Registration reference: ZC018214
5. Data Collection and Use
We only collect and process personal data that is reasonably necessary for our business operations or to deliver, maintain and support services for clients.
Where Ctrl-X Digital Ltd acts as Data Controller, this may include names, business contact details, correspondence, support records, billing and transaction information, and other information provided to us in connection with an enquiry or client relationship.
Where we act as a Data Processor on behalf of a client, we process personal data only as necessary to provide the agreed services and in accordance with the client’s instructions.
Clients should avoid sharing unnecessary or sensitive personal data unless specifically required for the agreed work.
6. Data Sharing
We do not sell or disclose personal data to third parties except:
- where explicitly authorised by the client
- where required by law
- where necessary for the delivery of agreed services using approved third-party providers or sub-processors
- to AI service providers, in the limited way described under “Use of AI tools” below
Use of AI tools
Ctrl-X Digital Ltd uses AI assistants, including Anthropic’s Claude and OpenAI’s ChatGPT, to assist with internal business administration, financial analysis and project management.
These tools may be used to analyse business records, including client and organisation names, services provided, invoice information, supplier costs and project records. This processing is limited to information held by Ctrl-X Digital Ltd in its capacity as Data Controller.
Access is controlled through dedicated integrations that restrict the information available to AI services. These integrations do not provide access to structured client contact records, and automatically filter email addresses and telephone numbers from other information before it is shared. Some identifying information, such as individual names, may still appear in business records.
The integrations do not have access to client websites or the customer information stored on them. We do not use these integrations to analyse personal data held on behalf of clients, such as website enquiries, customer accounts or transaction records.
We have disabled the use of our conversations for AI model training in both services. Information shared with AI providers is handled in accordance with their applicable privacy and data protection arrangements, which may involve processing outside the UK.
We use AI to assist with administration and analysis; it does not make decisions about individuals. We remain responsible for reviewing the information and making decisions.
We rely on legitimate interests as the lawful basis for this processing, helping us manage our business efficiently while limiting the personal information shared. Individuals have the right to object to processing based on legitimate interests, and we will consider such objections in accordance with applicable data protection law.
7. Data Retention
We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, including providing services, maintaining appropriate business and support records, and meeting legal, accounting and regulatory obligations. Retention periods vary according to the type of information and the purpose for which it is held.
Where data is hosted on third-party platforms such as Mailchimp, Brevo, Campaign Monitor, or similar, it is the client’s responsibility as Data Controller to manage retention and compliance in line with applicable laws.
Backup systems may retain historic copies for a limited period as part of normal disaster recovery procedures.
8. Purposes and Lawful Bases for Processing
Where Ctrl-X Digital Ltd acts as Data Controller, we process personal data only where we have a lawful basis to do so. Depending on the circumstances, we may process personal data:
- To perform a contract or take steps at your request before entering into a contract, including providing quotations, services and technical support.
- To comply with legal obligations, including maintaining appropriate financial, accounting and regulatory records.
- For our legitimate interests, including managing client relationships, responding to enquiries, maintaining business records, administering and securing our systems and services, and operating our business effectively, provided those interests are not overridden by the rights and interests of the individual.
- With consent, where consent is the appropriate lawful basis. Consent may be withdrawn at any time.
9. Data Subject Rights
Data subjects have the following rights under UK GDPR, subject to lawful limitations:
- Right to access personal data
- Right to rectification
- Right to erasure (“right to be forgotten”)
- Right to restrict processing
- Right to data portability
- Right to object to processing
- Right to withdraw consent where applicable
We assist clients in responding to such requests in a timely and compliant manner.
Where Ctrl-X Digital Ltd acts as Data Controller, individuals may also contact us directly to exercise their data protection rights or raise concerns about how we have handled their personal data.
10. Data Protection Complaints
If you have concerns about how Ctrl-X Digital Ltd has handled your personal data, you can make a complaint to us using the contact details below.
We will acknowledge data protection complaints within 30 days, investigate them appropriately and respond without undue delay, in accordance with applicable data protection law.
You also have the right to complain to the Information Commissioner’s Office (ICO) if you are unhappy with how we have handled your personal data or your complaint.
11. Security Measures
We take appropriate technical and organisational measures to protect personal data, including secure storage, encrypted connections where appropriate, access controls, backups, and security monitoring.
We maintain procedures for identifying, assessing and responding to personal data breaches. Where required by data protection law, we will notify the Information Commissioner’s Office and/or affected individuals within the applicable timescales.
Contact
If you have any questions about this Privacy Policy, wish to exercise your data protection rights, or wish to make a complaint about how we have handled your personal data, please contact Ctrl-X Digital Ltd via the contact page on this website.
You can also contact the Information Commissioner’s Office for independent advice or to make a complaint.
