DACSO DIGITAL LTD
Last updated: 4 October 2026
1. Who we are
DACSO DIGITAL LTD is the controller responsible for the personal data described in this policy where DACSO decides why and how that data is used. We are registered in England and Wales under company number 16907055. Our registered office is 71–75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ.
Privacy enquiries, rights requests and data-protection complaints can be sent to info@dacso.uk.
When DACSO processes personal data solely on a client’s documented instructions while delivering a client project, DACSO may instead act as that client’s processor. That processing is governed by the relevant Project Agreement and, where required, the DACSO Data Processing Addendum rather than this website privacy policy alone.
2. Personal data we collect
Depending on how you interact with us, we may collect:
- Enquiry data: enquiry type, name, email address, optional website URL and message.
- Business/prospecting contact data: name, role, employer/organisation, business email address, business telephone/WhatsApp details and the public/business source from which those details were obtained.
- Attribution data: submission page, original landing page, referrer and campaign parameters such as UTM source, medium, campaign, content and term.
- Communications: information supplied by email, telephone, WhatsApp, video call or Google Calendar booking.
- Project and business records: contact details, requirements, proposals, contracts, approvals, files, access information, delivery correspondence, invoices and payment records.
- Payment records: payment status, amount, date, reference and method. Wise, Stripe or PayPal may process bank, card, wallet, identity, fraud-prevention and transaction information under their own notices. DACSO does not normally receive full card credentials processed by Stripe or PayPal.
- Technical/security data: IP address, browser/device information, pages and links used, approximate location derived from network information, security events and cookie/consent choices.
- Complaint and rights records: complaint/request details, identity/contact information, relevant evidence, correspondence, progress and outcome.
We may obtain information directly from you, from your organisation, from our website/forms and communications, from booking/payment/security providers, or from public business sources such as a company’s website, Companies House, professional/business social-media pages or other public business directories where it is fair and lawful to do so.
3. Why we use personal data
| Purpose | Typical data | Typical lawful basis |
|---|---|---|
| Respond to enquiries, understand requirements and prepare a quote | Enquiry, contact and communications | Legitimate interests in responding to enquiries; steps requested before a contract where applicable |
| Deliver and administer a project | Contact, project, approval and account records | Contract; legitimate interests where the client is an organisation and we communicate with its representatives |
| Take payments, issue refunds and maintain financial records | Contact, transaction, invoice and payment-status records | Contract and legal obligation |
| Meet tax, accounting and company obligations | Identity, invoice and transaction records | Legal obligation |
| Protect forms, accounts and the website | Technical, access and security-event data | Legitimate interests in security and fraud/spam prevention |
| Understand website use and measure enquiries/campaigns using our current consent-controlled analytics setup | Usage, device, page, referral and event data | Consent for our present Statistics configuration |
| Target relevant B2B sales outreach to businesses and business contacts | Business contact data and source | Legitimate interests where appropriate; consent or another PECR-compliant basis where electronic-marketing rules require it |
| Maintain a do-not-contact/suppression record | Minimal contact identifier and objection status | Legal obligation and legitimate interests in respecting marketing objections |
| Handle rights requests and data-protection complaints | Identity, complaint/request, evidence and correspondence | Legal obligation; legitimate interests in investigating and resolving concerns |
| Establish, exercise or defend legal claims | Relevant communications, contracts, logs and complaint records | Legitimate interests and legal obligation where applicable |
4. Direct marketing and business prospecting
DACSO does not add someone to a general mailing list merely because they made an enquiry. We do not currently operate a newsletter.
DACSO may carry out limited targeted business-to-business prospecting. Where we use publicly available personal data about a business contact, we record the source and use only information reasonably relevant to the person’s business role. We provide or link to this privacy information no later than our first direct communication where required.
For electronic marketing, we distinguish between corporate subscribers and individual subscribers such as sole traders and certain partnerships. Where consent is required by PECR, we do not send unsolicited electronic marketing without consent or another lawful exception. Every outbound marketing message must identify DACSO and provide a simple way to object or opt out.
You have an absolute right to object to the use of your personal data for direct marketing. If you object, we stop that marketing and may retain only a minimal suppression record so that we do not contact you again in error.
5. Cookies, analytics and consent
We use WPConsent to provide Essential, Statistics and Marketing choices. Our present configuration requires the Statistics choice before Google Analytics cookies are set. A visitor can reject optional categories or change a choice through Cookie Preferences.
Our preserved clean-profile testing found no Google Analytics cookies before a choice or after Reject. Google Tag may still load and send cookieless consent-state or technical measurement requests while optional analytics/advertising consent signals remain denied. When Statistics is accepted, Google Analytics cookies may be set and the current GA4 property is configured for 14-month event/user retention with reset on new activity enabled. Google Signals is off and there is no BigQuery link.
Withdrawing consent stops future consent-based processing but does not affect processing that was lawful before withdrawal.
6. Who receives personal data
We disclose personal data only where needed for the purposes above. Depending on the interaction, recipients or service-provider categories may include:
- Hostinger and hosting infrastructure, for the DACSO website, database and hosting services;
- Zoho, for DACSO business email;
- Google, for consent-controlled analytics/tag services, WordPress outbound email delivery, Calendar appointment scheduling and Google Drive backup storage where configured;
- Wise, for business-account bank transfers;
- Stripe and PayPal, where those payment methods are used;
- WhatsApp/Meta, when a person chooses WhatsApp contact;
- Wordfence and hosting/security providers, for security monitoring and protection;
- font/icon or external demonstration hosts where a page requests their resources;
- professional advisers, insurers if later appointed, regulators, authorities and carefully selected service providers where necessary and subject to appropriate duties; and
- a buyer or successor if DACSO or relevant assets are reorganised or transferred with appropriate protection.
Some website software such as WordPress, Fluent Forms and WPConsent operates within DACSO’s hosted environment. Its presence does not necessarily mean the software vendor receives personal data independently; any external data flow depends on the particular configuration.
We do not sell personal data.
7. International transfers
Some providers may process personal data outside the United Kingdom or make it accessible from another country. Where UK law treats a transfer as restricted, DACSO uses the transfer mechanism available under the applicable provider contract and UK law, which may include a UK adequacy regulation or approved contractual safeguards such as the UK International Data Transfer Agreement or UK Addendum.
The exact recipient entity and safeguard can vary by provider, account and service. You may contact us for more information about a safeguard relevant to your personal data.
8. How long we keep information
We keep personal data only for as long as reasonably needed for the purpose for which it was collected and for applicable legal, accounting, security and dispute requirements. Our working retention schedule is:
| Record | Working retention rule |
|---|---|
| Enquiries that do not become projects | Normally delete or anonymise within 12 months after the last meaningful contact unless there is a continuing reason to retain them |
| Outbound prospect records that do not become a relationship | Normally review/delete within 12 months after the last meaningful contact; retain a minimal suppression record where needed to honour an objection |
| Fluent Forms submissions | Normally delete from WordPress within 12 months, subject to earlier export to an appropriate project/enquiry record and any active dispute/security issue |
| Project, contract and material client correspondence | Normally up to 6 years after the relationship ends where reasonably needed for contractual/legal claims |
| Invoices/accounting records | Normally 6 years from the end of the relevant financial period or longer if law requires |
| Routine security logs | For the period made available/configured by the relevant provider or for so long as reasonably needed to investigate security events; provider settings may rotate logs automatically |
| Cookie preference record | 30 days under the currently verified WPConsent setting |
| Google Analytics event/user data | 14 months under the current GA4 configuration; reset on new activity is enabled |
| Routine website backup copies | Rolling operational retention, normally no longer than 30 days once the automatic backup schedule is implemented, unless a copy is isolated for incident recovery, legal claims or another documented reason |
| Data-protection complaints and rights-request records | Normally 3 years after closure, unless a longer period is reasonably needed for an active dispute, regulatory matter or legal claim |
We periodically review records and may keep relevant information longer where required for an active dispute, legal duty, fraud/security investigation or other documented reason.
9. Your rights
Depending on the circumstances, UK data-protection law may give you rights to request access, correction, deletion or restriction; object to legitimate-interest processing; object at any time to direct marketing; receive certain data in a portable format; and withdraw consent where consent is the basis.
Rights are not absolute. We may need to confirm identity and will explain if an exemption or limitation applies. Send a request to info@dacso.uk.
Where you must provide particular information for a contract or legal requirement, we will explain that in the relevant form, proposal or project communication and tell you the consequences if the information is not provided.
10. Data-protection complaints
You can make a data-protection complaint directly to DACSO by emailing info@dacso.uk with enough information for us to understand the concern. You may also raise a complaint through another channel; you do not have to use a special form.
We will acknowledge a data-protection complaint within 30 days. Without undue delay, we will take appropriate steps to investigate and respond, keep you informed where appropriate and tell you the outcome.
This does not affect your right to complain to the Information Commissioner’s Office (ICO).
11. Automated decisions
We do not use the personal data described here to make solely automated decisions that produce legal or similarly significant effects about you.
12. Security
We use reasonable technical and organisational measures intended to protect personal data, including access controls, maintained software, monitoring, least-privilege access and protected communications where appropriate. No internet or storage system can be guaranteed completely secure.
13. Other websites and services
Our website links to services we do not control, including Google Calendar, WhatsApp, payment providers and external concept demonstrations. Their own privacy information applies when you choose to use them.
14. Children
Our services are not designed for children and we do not knowingly seek children’s personal data through the website.
15. Changes
We may update this policy when our services, providers, legal obligations or processing activities change. We will publish the revised version and date and may communicate material changes directly where appropriate.
16. Contact
Email: info@dacso.uk
Post: DACSO DIGITAL LTD, 71–75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ