Last updated: March 2026
Our Contact Details
Name: KK Digital Marketing t/n of Grafty Ltd
Website: https://kk-digital.co.uk
Email: hello@kk-digital.co.uk
ICO Registration Number: ZB549510 (Grafty Ltd)
Introduction
This privacy policy explains how KK Digital Marketing (“we”, “us”, “our”) collects, uses, and stores your personal data when you visit our website or engage with our services.
We are registered with the Information Commissioner’s Office (ICO) as a data controller. If you have any concerns about how we handle your data, you have the right to contact the ICO directly at www.ico.org.uk or on 0303 123 1113. We would appreciate the opportunity to address any concerns first (please contact us using the details above).
Our Role: Controller and Processor
For data collected through our own website (enquiries, analytics, contact forms), KK Digital Marketing acts as the data controller – we determine why and how your data is used.
When we provide web design, SEO or digital marketing services to clients, we may also process personal data on their behalf as a data processor. In those cases, our clients are the data controllers and our processing is governed by a data processing agreement.
What Personal Data We Collect
We collect and process the following categories of personal data:
- Identity Data: first name, last name and the name of your business
- Contact Data: email address, telephone number and business address
- Enquiry and Project Data: details you provide about your business, requirements or any existing website
- Payment and Billing Data: invoicing details (note: card payments are processed securely by our payment provider; we do not store card details)
- Technical Data: IP address, browser type and version, device type, pages visited and time spent on our website – collected automatically via cookies and analytics tools
- Communications Data: records of emails, calls or messages exchanged with us
How We Collect Personal Data
We collect personal data in the following ways:
- Directly from you when you complete a contact form, send an email, call us or engage us for a project
- Automatically via cookies and analytics tools when you visit our website
- Occasionally from third parties such as referrals, social media platforms or business directories
Our Lawful Bases for Processing
Under the UK General Data Protection Regulation (UK GDPR), we rely on the following lawful bases:
(a) Contractual obligation: to provide our services, issue quotes, raise invoices and deliver project work.
(b) Legitimate interests: to respond to enquiries, improve our website and services, understand how our site is used and maintain business records. We have balanced these interests against your rights and do not believe this processing will cause harm.
(c) Legal obligation: to comply with tax, accounting and other legal requirements.
(d) Consent: where you have opted in to receive marketing updates from us. You may withdraw consent at any time by contacting us or using the unsubscribe link in any marketing email.
How We Use Your Personal Data
We use your personal data to:
- Respond to your enquiries and provide quotes
- Deliver agreed web design, SEO or other digital marketing services
- Raise and process invoices
- Send service updates relevant to your project
- Send occasional marketing about our services (only where you have opted in)
- Analyse website traffic and improve user experience
- Meet our legal and accounting obligations
We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects.
Third-Party Processors
To run our business effectively and provide our services, we share personal data with a limited number of trusted third-party service providers. These providers act as data processors and are only permitted to use your data according to our strict instructions.
The categories of processors we use include:
- Website Infrastructure: Providers who host our website and ensure its security and performance.
- Analytics & Performance: Tools that help us understand how visitors interact with our website so we can improve the user experience.
- Communication & Marketing: Systems used to manage enquiries, maintain our client database (CRM) and send requested email updates.
- Finance & Operations: Professional software used for invoicing, accounting and managing project tasks.
- Payment Processing: Secure, encrypted gateways used to process payments (we do not see or store your full card details).
We vet all our providers to ensure they have appropriate technical and organisational measures in place to protect your data. We do not sell your personal data to any third party.
International Data Transfers
Some of our third-party processors are based outside the UK. Where this is the case, we ensure appropriate safeguards are in place – either through the UK’s international adequacy decisions or through the International Data Transfer Agreement (IDTA) or equivalent standard contractual clauses approved for use under UK law.
Cookies
All scripts, tracking and functionality on our website is 100% cookieless to ensure our customers privacy. No cookie consent to use our website. We do not use marketing or advertising cookies. If this changes, we’ll update our policies.
For more details, see our Cookie Policy.
Data Retention
We retain personal data only for as long as necessary:
| Data Type | Retention Period |
|---|---|
| Enquiry records (no project) | 12 months |
| Client project files and correspondence | 7 years after project completion (HMRC requirement) |
| Financial and billing records | 7 years (legal obligation) |
| Website analytics data | 26 months (Google Analytics default) |
| Marketing contact data | Until consent is withdrawn |
When data reaches the end of its retention period, it is securely deleted or anonymised.
Your Data Protection Rights
Under UK GDPR, you have the right to:
- Access: request a copy of the personal data we hold about you
- Rectification: ask us to correct inaccurate or incomplete data
- Erasure: ask us to delete your data in certain circumstances
- Restriction: ask us to limit how we use your data in certain circumstances
- Objection: object to processing based on legitimate interests or for direct marketing
- Portability: receive your data in a structured, machine-readable format and transfer it to another organisation where technically feasible
- Withdraw consent: at any time, where our processing is based on your consent
To exercise any of these rights, contact us at hello@kk-digital.co.uk. We will respond within one calendar month.
Changes to This Policy
We may update this policy from time to time to reflect changes in our services, legal obligations or data practices. The “last updated” date at the top of this page will always reflect the most recent version. For significant changes, we will notify active clients directly.
How to Complain
If you are unhappy with how we have handled your personal data, please contact us first so we can try to resolve it. If you remain dissatisfied, you have the right to lodge a complaint with the ICO:
Information Commissioner’s Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline: 0303 123 1113
Website: www.ico.org.uk