Ctrl-X Digital Ltd is committed to protecting personal data and maintaining appropriate security and privacy standards in accordance with UK GDPR, the Data Protection Act 2018 and the Data (Use and Access) Act 2025.
Last Updated: 7 September 2026
1. Our Commitment to Data Protection
This policy outlines how Ctrl-X Digital Ltd collects, processes, stores and protects personal data in the course of operating its business and delivering services to clients.
2. Definitions
Client – Any individual or organisation commissioning or receiving services from Ctrl-X Digital Ltd.
Client Data – Any information provided by the client, including but not limited to customer data.
Customer Data – Personal data relating to identifiable individuals, including names, email addresses, telephone numbers, postal addresses, and similar information.
3. Roles and Responsibilities
In most cases, the client acts as the Data Controller and Ctrl-X Digital Ltd acts as the Data Processor when providing hosting, development, maintenance, or support services.
Ctrl-X Digital Ltd also acts as a Data Controller in relation to its own business operations, including invoicing, client communications, support records, and supplier management.
Clients are responsible for ensuring they have an appropriate lawful basis for collecting personal data and for instructing us to process that data on their behalf. When acting as a Data Processor, Ctrl-X Digital Ltd processes personal data in accordance with the client’s documented instructions and its own obligations under applicable data protection law.
4. ICO Registration
Ctrl-X Digital Ltd is registered with the Information Commissioner’s Office (ICO) as required under UK data protection law.
Registration reference: ZC018214
5. Data Collection and Use
We only collect and process personal data that is reasonably necessary for our business operations or to deliver, maintain and support services for clients.
Where Ctrl-X Digital Ltd acts as Data Controller, this may include names, business contact details, correspondence, support records, billing and transaction information, and other information provided to us in connection with an enquiry or client relationship.
Where we act as a Data Processor on behalf of a client, we process personal data only as necessary to provide the agreed services and in accordance with the client’s instructions.
Clients should avoid sharing unnecessary or sensitive personal data unless specifically required for the agreed work.
6. Data Sharing
We do not sell or disclose personal data to third parties except:
- where explicitly authorised by the client
- where required by law
- where necessary for the delivery of agreed services using approved third-party providers or sub-processors
7. Data Retention
We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, including providing services, maintaining appropriate business and support records, and meeting legal, accounting and regulatory obligations. Retention periods vary according to the type of information and the purpose for which it is held.
Where data is hosted on third-party platforms such as Mailchimp, Campaign Monitor, or similar, it is the client’s responsibility as Data Controller to manage retention and compliance in line with applicable laws.
Backup systems may retain historic copies for a limited period as part of normal disaster recovery procedures.
8. Purposes and Lawful Bases for Processing
Where Ctrl-X Digital Ltd acts as Data Controller, we process personal data only where we have a lawful basis to do so. Depending on the circumstances, we may process personal data:
- To perform a contract or take steps at your request before entering into a contract, including providing quotations, services and technical support.
- To comply with legal obligations, including maintaining appropriate financial, accounting and regulatory records.
- For our legitimate interests, including managing client relationships, responding to enquiries, maintaining business records, administering and securing our systems and services, and operating our business effectively, provided those interests are not overridden by the rights and interests of the individual.
- With consent, where consent is the appropriate lawful basis. Consent may be withdrawn at any time.
9. Data Subject Rights
Data subjects have the following rights under UK GDPR, subject to lawful limitations:
- Right to access personal data
- Right to rectification
- Right to erasure (“right to be forgotten”)
- Right to restrict processing
- Right to data portability
- Right to object to processing
- Right to withdraw consent where applicable
We assist clients in responding to such requests in a timely and compliant manner.
Where Ctrl-X Digital Ltd acts as Data Controller, individuals may also contact us directly to exercise their data protection rights or raise concerns about how we have handled their personal data.
10. Data Protection Complaints
If you have concerns about how Ctrl-X Digital Ltd has handled your personal data, you can make a complaint to us using the contact details below.
We will acknowledge a data protection complaint within 30 days of receiving it, investigate the complaint appropriately and respond to you without undue delay.
You also have the right to complain to the Information Commissioner’s Office (ICO) if you are unhappy with how we have handled your personal data or your complaint.
11. Security Measures
We take appropriate technical and organisational measures to protect personal data, including secure storage, encrypted connections where appropriate, access controls, backups, and security monitoring.
We maintain procedures for identifying, assessing and responding to personal data breaches. Where required by data protection law, we will notify the Information Commissioner’s Office and/or affected individuals within the applicable timescales.
Contact
If you have any questions about this Privacy Policy, wish to exercise your data protection rights, or wish to make a complaint about how we have handled your personal data, please contact Ctrl-X Digital Ltd via the contact page on this website.
You can also contact the Information Commissioner’s Office for independent advice or to make a complaint.
