Privacy Policy

This policy covers Monument Digital Limited (“we”, “us”, “our”). We are the controller of the personal data described here under the UK GDPR and the Data Protection Act 2018. The Privacy and Electronic Communications Regulations (PECR) also apply to our cookies.

• Company number 13464127, registered in England and Wales.
• Registered office: 1 Brassey Road, Old Potts Way, Shrewsbury, SY3 7FA.
• Registered with the Information Commissioner’s Office (ICO): ZC081784.
• Data protection contact: our data protection lead, at enquiries@monumentdigital.co.uk or 01939 839 005.

This policy covers people who visit monumentdigital.co.uk, send us an enquiry or book a call, and the contacts at our clients and suppliers.

When you use our contact form or a form on one of our landing pages, we collect your name, email address, phone number (optional), company, your message, and which page or service you enquired about.

The form sends this to our inbox as an email. The email is delivered by Resend, an email delivery service, and stored in our Google Workspace account. We do not attach ad click IDs or campaign tags to your enquiry.

We use it to reply, to prepare a quote or proposal, and to keep a record of what was discussed. Our legal basis is taking steps at your request before a contract and, where no contract follows, our legitimate interest in answering business enquiries.

We keep enquiry emails for 24 months from last contact, then delete them. If you become a client, section 9 applies instead.

We do not add you to a mailing list or send you marketing emails.

Our “Book a call” links open a booking calendar run by Calendly. Nothing loads from Calendly until you click one. Calendly then collects your name, email address, the time you choose and any answers you give, and sends the booking to our calendar.

Calendly handles your booking details on our behalf, and we keep them as we keep enquiries (section 2). Calendly also sets its own cookies and collects technical data on its booking page. Its privacy notice covers that, and its booking page has its own cookie settings.

When you first visit, a banner asks which cookies you allow. There are three categories:

• Necessary. Always on. They remember your cookie choice and keep site administrators signed in.
• Analytics. Off until you allow them. They show us which pages people visit (section 5).
• Marketing. Off until you allow them. They measure which of our Google ads lead to enquiries (section 6).

Until you choose, nothing from Google, Vercel Analytics or any other third party loads. Google Consent Mode is set to “denied” for everything by default.

If your browser sends a Global Privacy Control signal, we treat it as a refusal of marketing cookies. You can still switch marketing on yourself.

You can change or withdraw your choice at any time with the “Cookie Settings” link at the bottom of every page. If you withdraw, we delete our analytics and advertising cookies and reload the page. You can also block or delete cookies in your browser.

Our fonts and certification badges are stored on our own servers, so they make no requests to third parties. Some images are served from our Supabase file storage in Ireland, which sets no cookies.

Every cookie and storage item the site can set:

Google lists its cookies and their durations at business.safety.google/adscookies. Google may change the names or durations of its own cookies.

If you allow analytics cookies, two tools run:

• Google Analytics 4, loaded through Google Tag Manager. It records the pages you view, how you arrived (for example a search engine or an ad), your approximate location, device and browser, and actions such as sending a form or clicking “Book a call”. It does not receive your name, email or phone number. Google Analytics keeps this data for 14 months.
• Vercel Web Analytics. It counts page views in aggregate. It sets no cookies and does not track you across visits or sites.

Our legal basis is your consent.

If you allow marketing cookies, Google Tag Manager also loads Google Ads conversion tracking. It tells us which of our ads led to an enquiry or booking, so we can stop paying for ads that do not work.

• We do not send your email address, phone number or any other form details to Google.
• We have not set up remarketing audiences to follow you with our ads.
• When you allow marketing cookies, our site tells Google (through Consent Mode) that it may store advertising cookies, use your data for advertising, and personalise ads. Google may then use the data for ad measurement and, under its own policies, to personalise the ads you see. Google explains this at policies.google.com/technologies/partner-sites.

Our legal basis is your consent. If you leave marketing cookies off, none of this runs.

Each time you make or change a cookie choice, we log it so we can prove what you agreed to. The record holds:

• the random consent ID stored in your monument_consent cookie;
• your choice for each category, and whether your browser sent Global Privacy Control;
• the version of the banner and of this policy you saw;
• the page you were on (the address only, without any query string);
• your browser family (for example Chrome or Safari), not the full browser details;
• a shortened, salted hash of your IP address (we never store the IP address itself);
• your country, and the date and time.

This does not name you, but it is still personal data, because the consent ID links to your browser. Our legal basis is our legal obligation to be able to show consent (UK GDPR Article 7(1)) and our legitimate interest in keeping accurate records. We store it in Supabase in Ireland and delete each record after 2 years.

Our website is hosted by Vercel. Like any web host, Vercel’s servers receive your IP address, browser details and the page requested each time you load a page, and keep them in logs for a short period. We use them to run the site, fix faults and keep it secure. Our legal basis is our legitimate interest in running a secure website.

Our content editor and database run on Supabase, stored in Ireland. They hold the pages of this site and the cookie choice records in section 7, but no enquiry details.

If you work for one of our clients or suppliers, we hold your name, work contact details and our correspondence, plus contract, billing and payment records. We use them to deliver and manage our services and to meet tax and accounting rules. Our legal bases are performing our contract, our legitimate interest in managing the relationship, and our legal obligations.

Where we host, build or maintain systems that hold your own customers’ data, we act as your processor under our contract with you, and your privacy notice covers that data.

We keep client and supplier records for 6 years after the end of the financial year in which our work together ends, as tax law requires.

We do not sell personal data. We share it only with these service providers, who process it for us under written contracts:

• Vercel Inc. (US): website hosting and Vercel Web Analytics.
• Supabase Inc. (data stored in Ireland): content database, file storage and cookie choice records.
• Resend (US): delivers contact form emails to our inbox.
• Google (US): Google Workspace for email and calendar, and, with your consent, Google Tag Manager, Google Analytics and Google Ads.
• Calendly LLC (US): call bookings.

We also share data with our professional advisers, such as accountants and lawyers, and with regulators or the police where the law requires it.

Google, Vercel, Resend and Calendly are based in the US, so your data may be processed there. Each of them is certified under the UK Extension to the EU-US Data Privacy Framework, which the UK government recognises as giving adequate protection. Where a transfer falls outside that certification, we rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses. Supabase stores our data in Ireland, which the UK recognises as giving adequate protection.

We are certified to ISO 27001 for information security. We limit access to personal data to the people who need it, use encrypted connections, and only use service providers that are bound by contract to protect it. No system is completely secure, so if a breach affects your data and puts you at risk, we will tell you and the ICO as the law requires.

This website has no AI features. We do not make decisions about you by automated means. We are certified to ISO 42001 for the responsible use of AI in our wider work.

Under UK data protection law you have the right to:

• get a copy of the personal data we hold about you;
• have inaccurate data corrected;
• have your data deleted;
• have our use of your data restricted;
• object to our use of your data where we rely on legitimate interests;
• receive data you gave us in a format you can pass to someone else;
• withdraw your consent at any time, without affecting what we did before.

Some rights apply only in certain situations. To use any of them, email enquiries@monumentdigital.co.uk. We may ask you to confirm who you are. We will reply within one month, and it is free.

For cookie data, the quickest route is the “Cookie Settings” link. Because we do not know who you are from the consent record, we can only find your record if you give us the consent ID from your monument_consent cookie.

Please contact us first so we can try to put things right. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.

Our website and services are for businesses. They are not aimed at anyone under 16, and we do not knowingly collect their data.

The date at the top of this page shows when we last changed this policy. Each version is recorded against the cookie choices made under it. If we start using a new kind of cookie or tool, we will ask for your consent again.

Monument Digital Limited
1 Brassey Road, Old Potts Way, Shrewsbury, SY3 7FA
enquiries@monumentdigital.co.uk
01939 839 005