Privacy policy

Website access and security data

When you visit the website, our hosting and server systems may automatically process:

• IP address
• date and time of the request
• requested page or path
• browser and device user-agent information
• response status and technical diagnostic information

We use this information to deliver the website, maintain its availability and security, detect abuse, investigate technical incidents and diagnose errors. The legal basis is our legitimate interest under Article 6(1)(f) GDPR in operating a secure and reliable website. We do not use server logs to profile visitors or for advertising.

Email enquiries

If you contact us at sales@dddigitalstudio.com, we process the information you choose to provide. This may include your name, email address, telephone number, organisation, project information and message content.

We use this information to respond, communicate about your enquiry, assess a potential engagement and take steps you request before entering into a contract. Where your enquiry concerns a possible contract, the legal basis is Article 6(1)(b) GDPR. For general business communications that do not lead to a contract, the legal basis is our legitimate interest under Article 6(1)(f) GDPR in responding to enquiries and managing business communications.

The website does not currently use an on-site contact form.

Scheduling a call with Calendly

The booking pages contain an embedded Calendly scheduling service. When the scheduler loads, your browser connects to Calendly and may provide technical information such as your IP address, browser and device information, referring page, language and time zone. If you book a call, Calendly processes the information you enter, including your name, email address, selected time and any answers you provide.

We use booking information to arrange and manage the call you request and to take steps at your request before a possible contract. The legal basis is Article 6(1)(b) GDPR. Calendly displays its own regional cookie controls within the embedded scheduler for its optional technologies.

Privacy-choice record

We store a necessary privacy-choice record in your browser so the website can remember whether you allowed or rejected analytics. It contains your category choice, the time of that choice and the applicable policy version.

We use this record to remember and respect your decision. The legal basis is our legitimate interest under Article 6(1)(f) GDPR in managing privacy preferences and demonstrating that optional analytics is controlled by the visitor's choice. This storage is necessary for that purpose and is not used to analyse your behaviour.

Website analytics

If you consent through our cookie controls, we use Google Analytics 4 (GA4) to understand how visitors use the website and whether its content and calls to action are effective.

• pseudonymous cookie and session identifiers
• pages viewed, page titles and visit timestamps
• referral source and campaign information
• approximate geographic area
• browser, device category, operating system, language and screen information
• controlled interactions such as section views, scroll-depth milestones, CTA clicks and, if configured, outbound booking-link selections

We do not intentionally send names, email addresses, telephone numbers, message or form content, or booking details to GA4. Google's email-address redaction is enabled on a best-effort basis, and the values of URL query parameters identified in our data-minimisation configuration are redacted before events are sent. This is an additional safeguard and does not replace our rule that personal data must not be included in Analytics events.

For visitors in the EU, Switzerland and the United Kingdom, Google states that IP addresses are used temporarily to derive coarse location information and are discarded before the data is logged.

The legal basis is your consent under Article 6(1)(a) GDPR. GA4 is not loaded and no Analytics request is sent before consent. You may refuse or withdraw consent without losing access to the website. Google Signals, advertising features, remarketing and ad personalisation are disabled. We do not link the GA4 property to Google Ads or use Analytics data to build advertising audiences.

Personal data may be received by:

• persons authorised to manage the website and respond to enquiries
• OVHcloud, which provides website hosting and infrastructure services
• the email service provider used to receive and store messages sent to sales@dddigitalstudio.com
• Calendly, LLC and its subprocessors, which provide the embedded scheduling service and process booking information
• Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and its subprocessors, but only when you consent to GA4
• professional advisers or public authorities where disclosure is necessary to establish, exercise or defend legal claims or comply with a legal obligation

Service providers acting as processors may process personal data only for the relevant service and under applicable contractual and data-protection obligations. We do not sell personal data.

Some service providers, including Calendly and Google group companies and subprocessors supporting Google Analytics, may process personal data outside the European Economic Area. Where personal data is transferred to a country without an applicable European Commission adequacy decision, the transfer must rely on an appropriate safeguard, such as the European Commission's Standard Contractual Clauses, together with supplementary measures where required.

You may contact us for information about safeguards applicable to a particular transfer.

• Website and security logs: automatically deleted within 30 days. Relevant entries may be isolated and retained for up to 12 months after a specific security incident is closed where necessary to investigate the incident or protect legal rights. They may be kept longer only where required by law or ongoing legal proceedings.
• Email enquiries that do not result in a contract: retained for 24 months after the last substantive communication, then deleted unless continued retention is necessary for an ongoing dispute or legal obligation.
• Communications connected with a contract: retained for the duration of the relationship and afterwards for the applicable contractual, accounting, tax and legal-limitation periods.
• Calendly booking information: retained while needed to arrange and manage the requested call and afterwards for applicable contractual, legal-limitation or compliance periods; Calendly also applies the retention rules described in its services and privacy documentation.
• Privacy-choice record: retained for six months, or until you delete it or a material policy change requires a new choice.
• GA4 user-level and event-level data: retained for 14 months without resetting the period after new activity. Google's setting does not affect standard aggregated reports, which may remain available for longer.

When data is no longer required, we delete it or make it anonymous, unless continued storage is legally required.

Subject to applicable law, you may request:

• access to your personal data
• correction of inaccurate or incomplete data
• deletion of your data
• restriction of processing
• portability of data processed by automated means on the basis of consent or contract
• withdrawal of consent at any time
• objection to processing based on legitimate interests

Withdrawing consent does not affect processing carried out lawfully before withdrawal. You can withdraw Analytics consent through Manage cookie preferences on the Cookie Policy page.

To exercise a right, email sales@dddigitalstudio.com. We may request information reasonably necessary to confirm your identity and protect personal data from unauthorised access. We normally respond within one month, subject to extensions permitted by GDPR.

You may lodge a complaint with the supervisory authority in your country of habitual residence, place of work or place of the alleged infringement. In Bulgaria, this is the Commission for Personal Data Protection, 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria.

Technical access data is generated automatically when your browser requests the website and is necessary to deliver and secure it. Providing information by email is voluntary. If you do not provide sufficient contact or enquiry information, we may be unable to respond or assess your request. Analytics is optional, and refusing it does not restrict access to the website.

We do not use personal data collected through this website to make decisions based solely on automated processing that produce legal or similarly significant effects. GA4 is used for aggregate website measurement, not to make decisions about individual visitors or create advertising profiles.

We use appropriate technical and organisational measures designed to protect personal data against unauthorised access, alteration, disclosure, loss or destruction. These include access controls, encrypted transmission, system maintenance and limiting access to persons who need the information for the stated purposes. No internet transmission or storage system can be guaranteed to be completely secure.

The website may contain links to external websites. Their operators determine how they process personal data when you visit them. We recommend reviewing the privacy information provided by the relevant external website. The booking pages also contain the Calendly integration described in this policy.

We may update this policy when our processing activities, service providers or legal obligations change. The current version and effective date will be published on this page. If a change introduces a new optional purpose or materially different analytics processing, we will request consent again before activating it.