Privacy Policy

How Boston Digital handles the information you share with us, including our use of cookies.

Effective date: 8th September 2026

1.Introduction

Boston Digital Limited (“we”, “us”, “our”) is committed to protecting your privacy and handling your personal data lawfully, fairly, and transparently in accordance with:

the UK General Data Protection Regulation (UK GDPR),
the Data Protection Act 2018 (DPA 2018),
the Data Use and Access Act 2025 (DUAA), and
the Privacy and Electronic Communications Regulations 2003 (PECR).

This Policy explains how we collect, use, share, store, and protect your personal data, and outlines your rights under these frameworks.

2.Who we are

Data Controller & Data Processor

Boston Digital Limited may act as both a:

Data Controller, when we determine the purposes and means of processing personal data; and
Data Processor, when we process data on behalf of a client and under their written instructions.

Registered office: Hoddesdon Enterprise Centre, Pindar Road, Hoddesdon, EN11 0FJ
Company registration: 10226469
ICO registration number: ZA221596
VAT registration number: GB262 306 232
Contact email: compliance@bostondigital.co.uk

3.Definitions

Personal Data: Any information that relates to an identified or identifiable living individual (UK GDPR Art. 4(1))
Processing: Any operation performed on personal data (e.g. collection, storage, use, deletion) (UK GDPR Art. 4(2))
Special Category Data: Sensitive personal data requiring extra protection (UK GDPR Art. 9)
Access Data (DUAA): Information on when, where, and by whom a data record was accessed.
SRI (Senior Responsible Individual): DUAA-specific role for accountability and audit.

4.What personal data we collect

We may collect the following categories of personal data:

Contact Data: Name, email address, telephone number, job title, business address
Payment Data: Billing contact details, invoice records, payment confirmations
Website Usage Data: IP address, device type, browser, referral source, pages viewed, time spent
Marketing Data: Email preferences, communication history

We do not knowingly collect or process special category data unless explicitly required and lawfully justified.

5.How we collect personal data

Directly from you: via contact forms, emails, phone calls, events, or service requests.
Indirectly: from referrals, publicly available sources, client instructions.
Via our website: using cookies and analytics tools (see section 11).

6.Legal bases for processing

We process personal data under the following lawful bases (UK GDPR Art. 6):

Contractual Obligation: Where processing is necessary for the performance of a contract.
Legitimate Interests: For example, business development, internal administration, fraud prevention.
Consent: For optional marketing communications or where legally required.
Legal Obligation: To comply with UK law or regulatory requirements.

7.How we use personal data

We may use your data to:

Respond to enquiries or requests
Fulfil contractual obligations to clients
Administer accounts and billing
Maintain website functionality and user experience
Send business-to-business (B2B) communications
Comply with legal obligations
Maintain audit trails for access (DUAA Section 15)

You may opt out of marketing communications at any time by contacting compliance@bostondigital.co.uk.

We may share data with the following parties, where lawful:

IT and cloud service providers (e.g. hosting, email, CRM)
Payment providers (e.g. Stripe – acting as a Data Processor)
Our professional advisers (e.g. accountants, legal counsel)
Regulatory authorities, including the Information Commissioner’s Office (ICO) and law enforcement
DUAA access log requests, when permitted under Section 16 of the Act

We ensure that all third-party service providers agree to meet our data protection standards.

We do not transfer data outside the UK or EU unless adequate safeguards are in place (e.g. adequacy decisions or Standard Contractual Clauses).

9.Data security measures

We implement appropriate technical and organisational measures (TOMs) to secure your data, including:

Role-based access controls
Encrypted cloud storage
Device encryption
Multi-factor authentication
Staff training in data protection

For more, you may request our Technical & Organisational Measures (TOMs) Summary via compliance@bostondigital.co.uk.

10.Data retention

We retain personal data only for as long as necessary:

Client records: 7 years after final service
Website contact form data: 1 year
Suppression list (opt-outs): Indefinitely (unless erased on request)

We securely delete data when no longer required, or where legally obligated to do so.

11.Cookie policy

a. What are cookies?

Cookies are small data files placed on your device when you visit our site. They help us:

Recognise returning users
Analyse usage patterns
Customise content
Improve functionality

b. Types of cookies we use

Strictly Necessary: Required for core website functionality
Performance / Analytics: Used to collect anonymous site usage data
Functionality: Remembers user preferences and enhances site behaviour
Marketing: May track user behaviour for tailored advertising (only with consent)

c. Legal basis & consent

Under PECR and UK GDPR, we require consent to store non-essential cookies (Analytics, Marketing). You can manage your preferences via our cookie banner or update them anytime in your browser settings.

d. Third-party cookies

We may allow trusted partners (e.g. Google Analytics) to place cookies. You can view and control these in our Cookie Notice.

e. Disabling cookies

You can disable cookies via your browser settings. However, doing so may limit certain functionalities.

12.Your rights

You have the following rights in relation to your personal data under UK GDPR and the DUAA:

Access: Request a copy of your personal data (Art. 15 UK GDPR)
Rectification: Correct inaccurate or incomplete data
Erasure (“Right to be Forgotten”): Ask for your data to be deleted in certain circumstances
Restriction: Request a pause in processing under certain grounds
Objection: Object to processing based on legitimate interests or direct marketing
Portability: Receive your data in a machine-readable format
Access Log Requests (DUAA Sec. 16): Request information about when and by whom your data was accessed
Withdraw Consent: At any time where consent was the legal basis

To exercise these rights, email compliance@bostondigital.co.uk. You may be asked to verify your identity before we respond.

13.Children’s data

Our services are not intended for children under 16. We do not knowingly collect or process data relating to minors. If we learn that we have inadvertently done so, we will delete it promptly.

14.Senior Responsible Individual (SRI)

In accordance with Section 12 of the Data Use and Access Act 2025, Boston Digital Limited has appointed an SRI to oversee data accountability and ensure access transparency.

To contact the SRI directly, email compliance@bostondigital.co.uk.

15.Complaints & contacting the regulator

We always aim to resolve data concerns promptly. However, if you are dissatisfied, you may raise a concern with the Information Commissioner’s Office (ICO):

Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Telephone: 0303 123 1113
Online: ico.org.uk/make-a-complaint
Email: casework@ico.org.uk

16.Updates

We may update this Privacy & Cookie Policy to reflect changes in law or business operations. Please check this page regularly for updates.