Privacy Policy

We only process personal data where we have a valid legal basis to do so under UK GDPR and the Data Protection Act 2018. Depending on the situation, this will be one of the following:

• Contract: to perform a contract with you (or to take steps at your request before entering one), e.g. delivering the Services you've engaged us for.
• Legitimate interests: where processing is necessary for our legitimate business interests (e.g. responding to enquiries, improving our Site), provided this doesn't override your rights and interests.
• Consent: where you've given clear consent, e.g. opting in to marketing emails.
• Legal obligation: where we need to comply with a legal or regulatory requirement, e.g. tax and accounting records.
  

• Information you give us directly
• Contact/enquiry form data: name, email address, phone number, and any message content you submit via our contact forms.
• Project/service data: if you engage us for Services, information you provide to enable that work, e.g. project briefs, source content, scope documents, and (where relevant to the Service) temporary access credentials to your content management system (CMS) or other project systems.
• Correspondence: anything you send us by email or otherwise in the course of an enquiry or engagement.

• Information collected automatically
• Usage data: pages visited, time on page, referring/exit pages, browser type, device type, and approximate location, collected via Google Analytics.
• Technical data: IP address, browser and operating system details.
• We do not currently use third-party advertising or retargeting cookies on this Site. If that changes, we will update this policy and, where required, ask for your consent via a cookie banner.

• Cookies
• We use cookies to allow the Site to function properly and to understand how it's used:
• Essential/session cookies: required for the Site to work correctly; deleted when you close your browser.
• Analytics cookies (Google Analytics): helps us understand aggregate visitor behaviour so we can improve the Site. Google's use of this data is governed by the Google Privacy Policy.

You can control or delete cookies through your browser settings at any time. Please note though that disabling cookies may affect how parts of the Site function.

We use the information we collect to:



• respond to your enquiries and provide quotes or proposals;
• deliver the Services you've engaged us for (testing, content population/migration, project management, consulting);
• carry out content population, migration, or testing work on the systems you grant us access to, strictly for the purpose and duration you authorise;
• manage our contractual relationship with you, including invoicing;
• send you service-related communications (e.g. project updates, confirmations);
• with your consent, send you occasional marketing updates about our Services; you can unsubscribe at any time;
• monitor and improve the performance and security of our Site;
• comply with our legal, tax, and regulatory obligations.

We do not sell your personal information, and we do not use it to serve you third-party advertising.

Because content population and testing work often requires direct access to a client's CMS, staging environment, or other project systems, we take specific care with this category of information:

• Access credentials are used only for the agreed scope of work and only by the team members assigned to your project.
• Wherever possible, we ask clients to provide scoped or temporary access (e.g. a dedicated staff account) rather than master admin credentials, and we're happy to work however your internal security policy requires.
• Credentials are not stored longer than necessary to complete the engagement and are deleted or revoked once the project is signed off, unless you ask us to retain them for ongoing work.
• We do not share system access with any third party without your prior written consent.
• If you'd like a signed NDA or a specific data-handling agreement in place before sharing access, just ask, we're happy to accommodate this as standard practice for client and agency engagements.

We do not rent or sell your personal information. We may share it with:

• Sub-processors/service providers who support our business operations (e.g. hosting providers, email/CRM tools, Google Analytics), bound by confidentiality and data protection obligations.
• Professional advisers (e.g. accountants, legal advisers) where necessary.
• Regulators or authorities, where required by law, or to establish, exercise, or defend legal claims.
• A buyer or successor, in the event of a merger, acquisition, or sale of all or part of our business; your information would remain subject to the commitments in this policy (or an equivalent one).

We keep personal information only as long as necessary for the purpose it was collected:

• Enquiry/contact form data not converted into a client relationship: typically deleted or anonymised after 12 months.
• Client/project data, including any temporary access credentials: retained only for the duration of the engagement, then deleted or revoked, except for records we're legally required to retain (e.g. invoices, for tax purposes; typically 6 years under UK law).
• Analytics data: retained per Google Analytics' default retention settings, which you can adjust in your own analytics account.

Under UK GDPR, you have the right to:

• be informed about how we use your data (this policy);
• access the personal data we hold about you;
• request correction of inaccurate data;
• request erasure of your data ("right to be forgotten"), subject to legal exceptions;
• restrict or object to certain processing;
• receive your data in a portable format where applicable;
• withdraw consent at any time, where processing is based on consent;
• lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint if you believe we've mishandled your data.

To exercise any of these rights, contact us at info@debca.co.uk. We'll respond within one month, as required by law.

We use reasonable technical and organisational measures to protect the personal information and system access entrusted to us, including access restricted to relevant team members and secure handling of credentials. No method of transmission or storage is 100% secure, but we take this seriously given the nature of our work. Please contact us immediately at info@debca.co.uk if you have any security concerns.

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The "Last updated" date at the bottom will always reflect the most recent revision. Material changes will be highlighted on this page.

If you have questions about this Privacy Policy or how we handle your data, please contact us via email at info@debca.co.uk.

Last Updated: 26 March 2026