Privacy Notice

1. Who we are (controller)

Infinity Domain Solutions Ltd trading as Doman Digital ("we", "us") is the data controller for the personal data we collect via this website, our contact channels and our client engagements. We are registered with the Information Commissioner's Office (ICO) under number ZC222352.

We are not required to appoint a Data Protection Officer under UK GDPR Article 37. For all data protection queries, please contact Data@domandigital.co.uk.

2. Scope of this notice

This notice applies to:

• Visitors to this website.
• People who contact us via forms, email, phone or booking links.
• Clients and their representatives who buy our services.
• Suppliers and professional contacts we work with.

We work with clients in healthcare, financial services and legal sectors. Where we process personal data in that context, we do so in accordance with our agreements and applicable law. Client-specific or sector-specific obligations may be reflected in separate contracts or data processing terms; if you have questions about how we handle data for your sector, contact us at Data@domandigital.co.uk.

If you use our client portal or we process your data under a separate contract (e.g. as a processor for your business), that relationship may be covered by additional terms or a separate privacy notice. When you contact us or submit a project enquiry, we may create a client workspace in our portal to manage your project. You will be notified if we do this.

3. Personal data we collect

We may collect the following categories of personal data:

• Identity and contact: name, business name, email address, telephone number, postal address.
• Enquiry and project information: messages you send, project requirements, documents you provide, meeting notes and agreed deliverables.
• Website usage: pages viewed, approximate location (e.g. city-level), device and browser information, and interactions, only where you have accepted analytics cookies (see our Cookie Policy).
• Booking and communications: appointment times, messages and communication history.
• Payment and billing: invoice details and transaction references. We do not store full card numbers.
• Technical and security data: IP address (which may be hashed for storage), browser type and version (user agent), device information, submission timestamps and attribution data such as referral source (e.g. UTM parameters). We use this for security, rate limiting, spam prevention and to understand how visitors find us.

4. Purposes and lawful bases (UK GDPR)

We use personal data only for the purposes set out below, with the lawful basis indicated. We do not use your data for automated decision-making or profiling that has legal or similarly significant effects.

Where we rely on consent (e.g. for non-essential cookies), you may withdraw it at any time without affecting the lawfulness of processing before withdrawal. See our Cookie Policy and contact details below.

5. Recipients and processors

We may share personal data with:

• Hosting, infrastructure and delivery: providers that host the website, store data, deliver email and provide DNS and security services (e.g. hosting, database, email delivery, CDN).
• Analytics: where you have accepted analytics cookies, we may use PostHog, Google Analytics, Vercel Analytics and Apollo website visitor tracking, which identifies the organisation a visit came from rather than you as an individual; see our Cookie Policy. PostHog data is processed in the EU. Apollo processes data in the United States, under the UK Addendum to the EU Standard Contractual Clauses described in section 7.
• Payment processing: when you make a payment, we use a third-party payment processor to handle the transaction securely. We do not store full card details.
• Authentication: we use a third-party authentication provider to manage user accounts and logins for our client portal.
• CRM and relationship management: we may use a customer relationship management tool to manage client records, project status and communications.
• AI-assisted features: where we use AI to help with project summaries, analysis or drafting, your input may be processed by a third-party AI provider. We only share the information you provide in that context.
• Contract signing: we may use an electronic signature provider to send and manage contracts.
• Messaging: we may use third-party providers for SMS or messaging notifications where you have provided your contact details for that purpose.
• Error monitoring: we use error tracking tools to detect and fix problems on the site. These may capture technical details about errors you encounter (e.g. device information, page visited). Personal data in error reports is minimised and scrubbed where possible.
• Scheduling: booking and appointment tools may process your name, email and appointment details.
• Call recording and notes: we record and/or transcribe calls as standard, including sales, discovery and client delivery calls, using a connected video-calling or meeting platform. Recordings and notes are used to keep an accurate record of what was discussed and to improve how we work with clients. You can ask us not to record a specific call before it starts.
• Professional advisers (e.g. accountants, insurers, legal advisers) where necessary.
• Authorities where required by law or to protect rights, safety and security.
• Potential buyers of the business or assets, subject to confidentiality.

We do not sell your personal data.

For a list of key subprocessors and tools, see our Subprocessors & Tools page.

6. Law enforcement and government requests

We may receive requests from law enforcement or other public authorities for personal data. Any such request is reviewed for legal validity, for example a proper warrant, court order or equivalent, before any data is disclosed. Where a request appears unlawful or overly broad, we will seek legal advice before responding. Where disclosure is required, we provide only the minimum information necessary to satisfy that specific request. We keep a record of any such request, our response, and the legal basis relied upon.

7. International transfers

Some of our service providers may process data outside the UK. Where we do transfer personal data outside the UK, we ensure appropriate safeguards are in place, such as the UK International Data Transfer Agreement (UK IDTA), UK Addendum to the EU Standard Contractual Clauses, or equivalent protections recognised by UK data protection law. You may request details of the safeguards applicable to your data by contacting Data@domandigital.co.uk.

8. Retention

• Enquiries, including a pre-contract sales or strategy call recording: typically up to 24 months after last contact, unless you become a client.
• Client delivery-call recordings and notes: typically 12 months after the project closes, then deleted.
• Client records: typically 6 years after the end of the engagement for legal, tax and claims purposes.
• Support and correspondence: retained as needed to provide support and maintain records.
• Analytics: retained according to each provider's policy; collected only when you have accepted analytics cookies (see Cookie Policy).

9. Marketing communications (where applicable)

We send an occasional marketing email about our own services. Which of the following applies depends on how your details reached us:

• You ticked a box, or clicked a link, asking for it. We rely on your consent.
• You asked us about our services: an enquiry, a free preview, a call or a referral. We may email you about similar services of ours, relying on our legitimate interests (the “soft opt-in” in regulation 22 of the Privacy and Electronic Communications Regulations). That form offers a box to refuse, and every email offers a way to unsubscribe.
• You used our free website review with an email address at your company’s own domain, and your website shows a UK company number. We may email that address about our services, relying on our legitimate interests, unless you ticked the box to refuse. We keep a note of the company number and the page it was on, as the record of why.
• Anyone else who used the free review. We do not add you to any marketing list. Your results email includes a one-click link if you want to be added.

You can unsubscribe from any marketing email, withdraw consent, or object to marketing at any time, free of charge, and we will stop. Objecting to marketing always succeeds. We do not sell your personal data or use it for third-party marketing. Emails that only deliver something you asked for, such as your review results, are not marketing.

10. Your rights

Under UK GDPR you may have the right to:

• Access: request a copy of the personal data we hold about you.
• Rectification: request correction of inaccurate or incomplete data.
• Erasure: request deletion in certain circumstances.
• Restriction: request that we limit processing in certain circumstances.
• Data portability: receive your data in a structured, machine-readable format where applicable.
• Object: object to processing based on legitimate interests.
• Withdraw consent: where processing is based on consent, withdraw it at any time.

To exercise any of these rights, contact us at legal@domandigital.co.uk or, for data protection matters, Data@domandigital.co.uk. We will respond within one month, subject to any extension permitted by law. We may need to verify your identity.

11. Right to complain to the ICO

You have the right to complain to the UK Information Commissioner's Office (ICO) if you are concerned about how we handle your personal data. The ICO can be contacted at: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF; website ico.org.uk/make-a-complaint. We encourage you to contact us first so we can try to resolve your concern.

Where you raise a concern with us directly, we handle it as a complaint under our Complaints and Legal Notices process: acknowledged within 2 business days and logged for oversight by a named data protection lead.

12. Automated decision-making

We do not use your personal data for automated decision-making or profiling that produces legal effects or similarly significantly affects you.

13. Children's data

Our services are not directed at individuals under 18. We do not knowingly collect personal data from children. If you believe we have received data from a child, please contact Data@domandigital.co.uk and we will delete it.

14. Security

We use appropriate technical and organisational measures to protect personal data, including access controls, secure authentication and least-privilege access. No method of transmission or storage is completely secure; we work to reduce risk and respond to incidents. For more detail, see our Security Statement.

15. Cookies and similar technologies

Our use of cookies and similar technologies is described in our Cookie Policy. That policy explains which cookies we use, how we obtain consent where required, and how you can change your preferences.

16. Third-party links

The Site may contain links to third-party websites. We are not responsible for their privacy practices. We encourage you to read their privacy notices before providing any personal data.

17. Changes to this notice

We may update this notice from time to time. We will publish the current version on this page with an updated effective date and version number. For significant changes we may notify you where appropriate. We encourage you to review this page periodically.

18. Contact

For general enquiries: hello@domandigital.co.uk or +44 7534 605926. For legal notices: legal@domandigital.co.uk. For data protection requests and privacy enquiries: Data@domandigital.co.uk. For all our policies, see /policies.