Privacy notice

1. Who we are

Duddon Digital is the trading name of the company registered in England and Wales under company number 17173485. Our registered office is 66 Paul Street, London EC2A 4NA. In this notice, “we”, “us” and “our” mean that company.

We are the controller of the personal data described here. That means we decide how and why it is used, and we are responsible for it under UK data protection law (the UK GDPR and the Data Protection Act 2018).

We are a small, director-led business and do not have a separate data protection officer. Questions about your data go straight to the director: kieron@duddondigital.co.uk or 07337 819479.

2. What we collect

We only collect what we need. Depending on how you deal with us, that may include:

• Enquiries. If you email, phone or message us (including through our Discord server), we receive your name, contact details (email address, phone number or Discord username) and whatever you choose to tell us in your message.
• Clients. If you become a client, we also hold the details needed to deliver and invoice the work: your business or organisation name, billing address, the contact people we work with, project notes, correspondence, quotes, agreements and invoices.
• Work materials. Content you give us for a job, such as website text and images, research briefs and datasets, or game server and Discord configuration details. Please do not send us personal data about other people unless the job needs it; if it does, we will agree how it is handled.
• Payments. If you pay an invoice by card, the payment is handled by Stripe. We see that a payment was made, the amount and limited details such as the card type and last four digits. We never see or store your full card number.
• Game server support. If you use our support Discord, we see your Discord username, profile and the messages and tickets you post there.
• Website visits. This website has no contact database, accounts or analytics. Like any website, our hosting provider automatically processes basic technical information (such as IP address, browser type and the page requested) to deliver pages and keep the service secure. We do not use this to identify or profile visitors.

The contact form on this site does not send or store anything itself. It simply opens your own email app with your message filled in, and nothing reaches us until you press send.

3. How we use it, and our lawful bases

UK data protection law says we must have a lawful basis for using personal data. Ours are:

Where we rely on legitimate interests, we have weighed them against your rights and only use data in ways you would reasonably expect. We do not use your data for automated decision-making or profiling, and we do not add you to marketing lists. If we ever want to send you marketing, we will ask first and you can say no at any time.

4. How long we keep it

• Enquiries that do not lead to work: up to 12 months after our last contact, then deleted.
• Client records (agreements, project correspondence and work materials): for the length of the work and up to 6 years after it ends, so we can deal with any questions or claims.
• Invoices and accounting records: 6 years from the end of the financial year they relate to, as required by UK company and tax law.
• Discord messages: support tickets are kept while the ticket is open and for up to 12 months afterwards. Messages in public channels stay on Discord until they are deleted by you or a moderator.
• Hosting logs: kept by our hosting provider for a short period under its own retention policy.

If you ask us to delete your data sooner, we will, unless we need to keep it for a legal reason (for example, invoices).

5. Who we share it with

We do not sell your personal data, and we do not share it with anyone for their own marketing. We use a small number of trusted service providers who process data on our behalf and only on our instructions:

• Stripe – card payment processing for invoices. Stripe also has its own legal duties (for example, fraud prevention and anti-money-laundering checks) for which it acts as a separate controller under its own privacy notice.
• Our email provider – Titan email, supplied through our domain registrar 123-reg (part of the GoDaddy group), which hosts our business mailbox.
• Discord – for game server support and community chat. If you use Discord, Discord’s own terms and privacy policy also apply to you.
• Vercel – hosts this website and processes the basic technical information described above.
• Professional advisers – such as an accountant or legal adviser, where needed, under a duty of confidentiality.

When we build a website or set up a game server, the domain, hosting and paid add-ons are normally in your name, with your own providers. Those providers will have their own relationship with you.

We may also share data if the law requires it, for example with HMRC or in response to a valid legal request.

6. Transfers outside the UK

Some of our providers, including Stripe, Vercel and Discord, are international companies and may process data outside the UK, for example in the United States or the European Economic Area. When that happens, the transfer must be protected in a way UK law accepts, such as the country having UK “adequacy” status, or the provider using the UK-approved standard contract terms for international transfers. In plain English: the provider is contractually bound to protect your data to a UK standard. You can ask us for more detail.

7. Cookies, analytics and tracking

This website does not use cookies, analytics, advertising pixels, tracking scripts or third-party embeds. Our fonts are served from our own website rather than a third-party font service. Because we do not set any cookies, there is no cookie banner.

If that ever changes, we will update this notice first and ask for your consent where the law requires it.

8. Keeping it secure

We protect your data with sensible measures for a business of our size, including strong unique passwords and two-factor authentication on our accounts where available, up-to-date devices, limiting access to the director, and using reputable providers. No system is completely secure, but if something goes wrong that puts your data at risk, we will act quickly and tell you and the ICO where the law requires it.

9. Your rights

Under UK data protection law you have the right to:

• Access – ask for a copy of the personal data we hold about you.
• Rectification – ask us to correct data that is wrong or incomplete.
• Erasure – ask us to delete your data, where we no longer have a good reason to keep it.
• Restriction – ask us to pause using your data, for example while we check a correction.
• Portability – ask for data you gave us in a common, machine-readable format, where we use it on the basis of a contract.
• Objection – object to our use of your data where we rely on legitimate interests, and to any direct marketing at any time.

To use any of these rights, email kieron@duddondigital.co.uk. It is free, and we will reply within one month. We may need to check your identity first. Some rights have limits; if we cannot do what you ask, we will explain why.

Complaints. If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK data protection regulator: ico.org.uk/make-a-complaint, or call 0303 123 1113.

10. Changes to this notice

We may update this notice when our services or the law change. The date at the top shows when it was last updated. If we make a significant change that affects you as a client, we will tell you directly.

11. Contact us

Duddon Digital, 66 Paul Street, London EC2A 4NA (registered office; please email rather than post where possible)
Email: kieron@duddondigital.co.uk
Phone: 07337 819479

Last updated: 25 October 2026.