Privacy & Data Protection Policy

1. Who is responsible for your data

Palm and Pixel Ltd is the data controller for personal data collected through www.palmandpixel.co.uk and our client engagements. Contact our data lead at info@palmandpixel.co.uk.

2. What we collect

a. Information you give us

• Contact details you enter in our forms (name, email, message, area of interest).
• Information you share during an engagement — business documents, strategy notes, and any personal data you deliberately provide.

b. Information collected automatically

• Basic technical logs (IP, browser, pages viewed) needed to serve and secure the site.
• Privacy-respecting analytics (aggregated, no cross-site tracking).

3. Why we use it (lawful bases)

• Contract — to deliver services you have requested.
• Legitimate interest — to reply to enquiries, secure our site, and improve our services (balanced against your rights).
• Consent — for any optional communications; you can withdraw at any time.
• Legal obligation — where we must retain records (e.g. tax, accounting).

4. How long we keep it

• Enquiry messages: up to 24 months, then deleted or anonymised.
• Active client records: for the duration of the engagement plus 6 years for legal/accounting purposes.
• Analytics logs: rotated within 90 days.

You can ask us to delete your data sooner where no legal obligation prevents it.

5. Who we share it with

Only with carefully chosen processors that help us operate — for example, secure email, cloud storage (Google Workspace), and hosting providers. Each is bound by contract to protect your data. We do not transfer your data to any organisation for their own marketing.

International transfers use approved safeguards (UK/EU Standard Contractual Clauses or equivalent).

6. AI and your data

• We use AI tools to accelerate our work. Client data is submitted only to enterprise-tier services with no-training guarantees.
• We never upload sensitive personal data (identity documents, health, financial account numbers) to public AI tools.
• Human review sits between every AI-assisted draft and the client.

7. How we protect it

• Encryption in transit (TLS) and at rest on our storage providers.
• Least-privilege access — only team members who need the data can see it.
• Strong authentication on all accounts handling client data.
• Regular deletion of files that are no longer needed.

8. Your rights

You have the right to:

• Access the personal data we hold about you.
• Correct anything that is inaccurate.
• Delete your data where we have no overriding legal reason to keep it.
• Restrict or object to certain processing.
• Receive your data in a portable format.
• Withdraw consent at any time.
• Complain to a supervisory authority (in the UK: the ICO — ico.org.uk).

Email info@palmandpixel.co.uk to exercise any right. We respond within 30 days, and we will not charge you or make it difficult.

9. Cookies

Our site uses only essential cookies needed to serve pages and remember your session. We do not use advertising, profiling, or third-party tracking cookies. If we ever add optional analytics, we will ask for your consent first through a clear banner with real choices.

10. Children

Our services are for businesses and professionals. We do not knowingly collect personal data from children under 16. If you believe we have, contact us and we will delete it.

11. Breach notification

If a data breach occurs that is likely to affect your rights, we will notify you and the relevant authority without undue delay — typically within 72 hours — with a plain description of what happened, what data was involved, and the steps we are taking.

12. Changes to this policy

When we make material changes, we update the “last updated” date and, where appropriate, notify affected clients directly. Historic versions are available on request.

13. Contact

Palm and Pixel Ltd · Data protection lead · info@palmandpixel.co.uk · www.palmandpixel.co.uk