Privacy Policy

1. Who we are

Banny Digital Ltd is the data controller for the personal data described in this notice. We are registered in England and Wales, company number 14911385, and we operate from the United Kingdom. You can reach our data protection contact at hello@banny.co.uk. We are not required to appoint a Data Protection Officer, and enquiries go straight to the founder.

Where we build or run a system for a client, that client is the controller for the data of their own customers and we act as their processor. Our GDPR statement explains that arrangement.

2. What we collect

• Enquiry and brief data: your name, business name, email address, phone number, budget range, and anything you tell us about your business in a form, quiz or brief, including logos and photos you upload.
• Client portal account data: your email address, name, profile photo, role and workspace, plus the requests, tasks, comments and files you create.
• Billing data: the company details we invoice, and payment records. Card numbers are handled by our payment provider and never reach our servers.
• Technical and usage data: IP address, device and browser type, referring site, pages viewed and actions taken. Detailed analytics is collected only if you accept analytics cookies.
• Correspondence: emails, WhatsApp messages, call notes and meeting notes.

We do not ask for special category data such as health or ethnicity, and we ask you not to send it. Our services are aimed at businesses, not children, and we do not knowingly collect data about anyone under 16.

3. Why we use it and our lawful basis

• To answer your enquiry and quote for work — legitimate interests, and steps taken at your request before entering a contract.
• To deliver the services you have bought and run your workspace — performance of our contract with you.
• To take payment, invoice, and keep accounting records — contract and legal obligation.
• To keep the website and portal secure and working — legitimate interests in protecting our service, and strictly necessary cookies under PECR.
• To measure how the website is used — your consent, given through the cookie banner and withdrawable at any time.
• To send occasional updates about our services — your consent, or the soft opt-in for existing clients. Every email has an unsubscribe link.
• To handle disputes or comply with the law — legal obligation and legitimate interests.

4. Cookies and analytics

Only strictly necessary cookies are set when you arrive. Google Analytics loads solely after you press accept, we anonymise IP addresses, we do not enable advertising features, and we never send Google your contact details. Full detail of every cookie, how long it lasts and how to withdraw consent is in our Cookie Policy.

Cookie settings

5. Who we share it with

We do not sell your personal data and we do not share it for advertising. We share it only with the processors that help us run the business, each under a written data processing agreement:

We may also share data with our accountant, our professional advisers, and with authorities where the law requires it. If a referral partner introduced you, we tell them only that the introduction converted, never the content of your brief.

6. International transfers

Some providers process data outside the UK. Where they do, we rely on UK adequacy regulations or the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, together with encryption in transit and at rest.

7. How long we keep it

• Unconverted enquiries, briefs and quiz answers: up to 24 months, then deleted.
• Client accounts, projects and files: for the life of the engagement, then 12 months.
• Invoices and accounting records: 7 years, as required by HMRC.
• Marketing consents and unsubscribe records: until you object, plus a suppression record.
• Cookie consent record: 6 months, after which we ask again.

8. Your rights

Under the UK GDPR you have the right to:

• be told how your data is used, which is the purpose of this notice;
• get a copy of the personal data we hold about you;
• have inaccurate data corrected;
• have data erased where we no longer have a reason to keep it;
• restrict or object to processing, including profiling and direct marketing;
• receive your data in a portable format;
• withdraw consent at any time, without affecting anything done before you withdrew it.

Email hello@banny.co.uk to exercise any right. We respond within one month and we do not charge a fee. We may ask you to confirm your identity first. We do not use automated decision making or profiling that has a legal or similarly significant effect on you.

9. Security

We use encryption in transit and at rest, row level access controls so one workspace can never read another, role based permissions, least privilege access for our own team, multi factor authentication on our provider accounts, and regular backups. If a breach were ever likely to risk your rights we would report it to the ICO within 72 hours and tell affected people without undue delay.

10. Complaints

Please raise any concern with us first at hello@banny.co.uk so we can put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

11. Changes to this notice

We review this notice at least once a year. The date at the top shows the current version, and we highlight material changes on this page. Related documents: Cookie Policy, Terms and Conditions, GDPR statement and Acceptable Use.