Privacy Policy

Last updated: 22 June 2026

1. Who we are

North Digital ("we", "us", "our") is a web analytics and tracking consultancy based in the United Kingdom. We are the data controller for personal data collected through this website, north-digital.eu.

You can contact us at any time regarding your data:

• Email: contact@north-digital.eu
• Post: Available on request via the email above

2. What data we collect

We collect minimal data, and only through the following channels:

• Website analytics: When you visit north-digital.eu and accept analytics cookies, Google Analytics 4 (GA4) collects anonymised usage data: pages visited, time on site, referrer URL, device type, browser, and approximate location (country/city level only). No personal identifiers (names, email addresses, IP addresses in full) are stored by GA4 — IP anonymisation is enabled by default.
• Contact form: When you submit our contact form, we collect the name, email address, and project description you provide. This data is processed by Formspree (our form provider) and forwarded to us via email. We see only what you type into the form.
• Server logs: Our hosting provider (Hostinger) maintains standard server access logs including IP addresses, timestamps, and requested URLs. These are used for security and diagnostics, not for analytics or profiling.

We do not collect or process any special category data (health, political opinions, biometrics, etc.) through this website.

3. How we collect your data

Data collection happens in three ways:

• Automatically (with consent): GA4 tracking fires only after you accept analytics cookies via our consent banner. Before consent, only essential technical data (security_storage) is set.
• Directly from you: Contact form data is only collected when you choose to submit a message.
• Server infrastructure: Access logs are collected automatically by our hosting provider as part of standard server operation. These are stored for a limited time (see section 7).

4. Why we process your data (legal basis)

We process personal data under the following lawful bases as defined by UK GDPR:

• Consent (Article 6(1)(a)): For analytics and marketing cookies. You give explicit consent via our cookie banner and can withdraw it at any time.
• Legitimate interest (Article 6(1)(f)): For essential website functionality (security_storage cookies), responding to contact form enquiries, and server log analysis for security purposes. We have assessed that these interests are not overridden by your rights given the minimal nature of the data involved.
• Performance of a contract (Article 6(1)(b)): When you engage our consultancy services, we process the data necessary to deliver that service under our service agreement.

5. Cookies and consent

We use Google Consent Mode v2 with a self-hosted Silktide Consent Manager. On your first visit, our consent banner asks you to accept or reject the following categories:

• Essential: Required for the site to function (security_storage). Always active. Cannot be disabled.
• Analytics: GA4 tracking (analytics_storage). Only active if you explicitly accept.
• Marketing: Google Ads tracking (ad_storage, ad_user_data, ad_personalization). Only active if you explicitly accept.
• Preferences: Language and display preferences (functionality_storage, personalization_storage). Only active if you explicitly accept.

All non-essential cookies default to denied before you interact with the banner. This is a hard default — no tracking occurs until you opt in. Your consent choice is stored in your browser's localStorage and honoured on return visits. You can change your preferences at any time by clicking the cookie icon in the bottom-left corner of any page. Consent signals are automatically re-evaluated every 30 days or on significant changes to our consent configuration.

6. How we use your data

• Analytics data: Used solely to understand how visitors find and use our website — which pages are popular, which blog posts perform well, and whether our content strategy is reaching the right audience. We do not use this data for individual profiling or automated decision-making.
• Contact form data: Used only to respond to your enquiry. We do not add your email address to any mailing list, send unsolicited marketing emails, or share your details with third parties for their own purposes.
• Server logs: Used exclusively for security monitoring, DDoS detection, debugging, and performance diagnostics.

7. Data retention

• GA4 data: Retained for 14 months (standard GA4 maximum). After this period, data is automatically deleted by Google.
• Contact form submissions: Retained indefinitely in our email inbox for reference purposes related to the enquiry you made. You can request deletion at any time (see section 9).
• Server logs: Retained by Hostinger for up to 30 days, then automatically rotated.
• Consent records: Your consent preferences stored in localStorage persist until you clear your browser data or change your preferences via the consent manager.

8. Who we share your data with (third parties)

We use the following third-party services which may process data on our behalf. Each is selected for its GDPR compliance posture and we have data processing agreements (or equivalent safeguards) in place where required:

• Google Analytics 4 — website analytics. Provider: Google Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland. Data is processed under Google's EU Data Processing Terms and Standard Contractual Clauses. IP anonymisation is enabled. Google Privacy Policy
• Google Tag Manager — tag management. GTM itself stores no data; it deploys GA4 and other tags based on consent state.
• Formspree — contact form processing. Provider: Formspree, Inc., 2483 Old Middlefield Way, Suite 200, Mountain View, CA 94043, USA. Data is transferred to the US under Standard Contractual Clauses. Formspree acts as a data processor and does not use your form data for its own purposes. Formspree Privacy Policy
• Hostinger — website hosting. Provider: Hostinger International Ltd, 61 Lordou Vyronos, 6023 Larnaca, Cyprus (EU-based, GDPR-compliant). Hostinger Privacy Policy

We do not sell, rent, or trade your personal data to any other third party. We do not share your data with advertising networks, data brokers, or affiliate platforms.

9. International data transfers

Some of our processors are based outside the UK and EEA:

• Formspree (USA): Data is transferred under the UK International Data Transfer Agreement and EU Standard Contractual Clauses (SCCs). Formspree's DPA incorporates the current SCCs and supplementary measures.
• Google (Ireland / global infrastructure): GA4 data is processed primarily on Google's European infrastructure. Where transfers outside the EEA occur, Google relies on SCCs and its EU Data Processing Terms.

We have assessed the laws and practices of these destination countries and concluded that the safeguards in place provide an adequate level of protection for your data.

10. Your rights

Under UK GDPR, you have the following rights regarding your personal data:

• Right of access: Request a copy of any personal data we hold about you.
• Right to rectification: Correct any inaccurate or incomplete data we hold.
• Right to erasure ("right to be forgotten"): Request deletion of your data where there is no compelling reason for us to continue processing it.
• Right to restrict processing: Request that we limit how we use your data while a concern is investigated.
• Right to data portability: Receive your data in a structured, commonly used, machine-readable format and have it transferred to another controller.
• Right to object: Object to processing based on legitimate interests. We will stop processing unless we demonstrate compelling legitimate grounds.
• Right to withdraw consent: Withdraw consent for analytics or marketing cookies at any time via our consent banner or by clearing your browser's localStorage for this domain.
• Rights related to automated decision-making: We do not perform any automated decision-making or profiling that produces legal effects or similarly significant effects. If that changes, we will update this policy and inform you.

To exercise any of these rights, email us at contact@north-digital.eu. We will respond within one month (30 calendar days) as required by law. We may ask you to verify your identity before fulfilling certain requests. There is no fee for exercising your rights unless the request is manifestly unfounded or excessive.

If you are dissatisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection.

11. Data security

We take appropriate technical and organisational measures to protect your data against unauthorised access, alteration, disclosure, or destruction:

• All traffic to north-digital.eu is encrypted via HTTPS (TLS 1.3).
• Our contact form uses Formspree's encrypted submission pipeline (HTTPS, encrypted at rest).
• Access to server infrastructure is restricted to authorised personnel with multi-factor authentication.
• We apply Content Security Policy headers and other HTTP security headers to reduce attack surface.
• Software dependencies and server packages are regularly updated.

While we implement strong safeguards, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security.

12. Children's data

Our website and services are not directed at children under the age of 16. We do not knowingly collect personal data from children. If you are a parent or guardian and believe your child has provided us with personal data, please contact us immediately and we will delete it.

13. Links to other websites

Our website contains links to external sites (Google policies, LinkedIn, ICO, partner sites). We are not responsible for the privacy practices or content of those sites. When you follow an external link, please review the destination's privacy policy.

14. Changes to this policy

We may update this privacy policy from time to time to reflect changes in our practices, legal requirements, or services. The latest version will always be available at this URL with the effective date shown at the top. Significant changes will be noted on our blog and, where required, communicated to existing contacts via email.

Questions about this policy? contact@north-digital.eu