1. Controller and scope
PORTABLE DIGITAL LIMITED, company number 16974578, is the controller for personal information used to operate this website and manage its customer relationships. Use our contact page for privacy enquiries. Our verified postal address and direct privacy email must be added before this draft is finalised.
This notice covers visitors, enquirers, account holders, customers and business contacts. Where we process personal data solely on a client’s instructions within a project, the client normally acts as controller and a separate data processing agreement must define our processor obligations.
2. Information we collect and its sources
You provide account information such as name, email and password; we store a password hash rather than a readable password. Enquiries may include phone number, project description, desired timeline and attachments. Orders contain selected services, prices, project notes, contact information and order history. Billing name and address are required to pay by card and are saved to your account for later payments.
Our systems process authentication tokens, request metadata and IP addresses for operation and security. When you pay by card, the payment provider returns a transaction reference, the payment status and any error or reconciliation information, which we store with the order. A business contact’s information may also be provided by their employer or authorised project representative.
Do not submit payment card details, credentials, special-category data or third-party personal information through project forms unless a necessary and appropriate secure arrangement has first been agreed.
3. Purposes and lawful bases
We use information to respond to requested proposals, create and administer accounts, deliver agreed work and manage orders where necessary to take steps at your request or perform a contract with you. When you act for a business rather than contract personally, our basis is our legitimate interest in communicating with that business and managing the engagement.
We rely on legitimate interests in securing systems, preventing misuse, investigating incidents and establishing or defending legal claims, after considering the effect on individuals. We process required accounting or regulatory records to comply with applicable legal obligations. Where optional consent-based processing is introduced, it requires a separate choice that can be withdrawn; acceptance of terms is not marketing consent.
Required form fields are needed to handle the relevant request or provide the account or service. Without them we may be unable to proceed. Optional fields are not a condition of unrelated services. We do not use this storefront to make solely automated decisions producing legal or similarly significant effects.
4. Recipients and payment processing
Access is limited to personnel and service providers who need information for the relevant task. Relevant categories include hosting and database providers, file storage and communications providers, delivery contractors, professional advisers and authorities where disclosure is legally required. Providers acting as processors must operate under appropriate contractual instructions.
Card payments are processed by our payment provider, WemoPay, on its own hosted payment page. To create a payment we send your name, email, billing address, the order amount, currency, a short description of the order and an order reference. We never receive or store your card number; card details entered on the provider’s page are handled under that provider’s own notice. The provider’s legal identity and privacy notice must be confirmed before live payment activation.
We do not use the current storefront to sell personal information or operate advertising profiles. A corporate reorganisation may require limited disclosure under appropriate confidentiality and data-protection safeguards.
5. Storage, international access and security
The deployment locations, supplier list and countries from which suppliers or staff can access data are still being verified for the live service. This draft does not represent that all processing is confined to the UK.
Before any restricted international transfer, we must establish a lawful transfer mechanism, such as applicable adequacy regulations or appropriate contractual safeguards, and complete required assessments. The final notice must identify relevant destinations and explain how to obtain information about safeguards. Contact us to request those details.
We use access controls and authentication safeguards appropriate to the service. No internet transmission or storage system can be guaranteed completely secure. Any incident will be assessed and notified to affected people and regulators where required.
6. Retention
Retention is determined by the purpose and applicable legal requirements. Enquiries are retained while handling the request and any justified follow-up; account information while the account is needed; project and transaction records while needed for delivery, accounting duties and applicable claims periods. Security records are retained only for a proportionate investigation and protection period.
We must confirm the operational retention schedule and backup deletion process before this notice is finalised. This text does not promise an automated deletion facility that has not been implemented. On a valid erasure request we assess what can be deleted and explain any record we must retain, its basis and relevant retention criteria.
7. Your rights and complaints
Subject to the relevant legal conditions, you may request access, correction, erasure, restriction or portability of your personal data, object to processing based on legitimate interests, and withdraw consent at any time without affecting earlier lawful processing. You have an unconditional right to object to direct marketing.
Submit requests through our contact page, identifying the right you wish to exercise. We may ask for proportionate identity information where needed. We normally respond within one month; a permitted extension of up to two further months for complexity or number of requests will be explained within the first month. Requests are normally free, subject to statutory exceptions.
You can complain to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint/ or to another competent data protection authority. You do not have to contact us first. Our services are not directed at children; contact us if you believe a child has submitted personal information.
8. Cookies and changes
Our Cookie Policy explains the authentication cookie used by the website. Material changes in processing require this notice to be updated and, where appropriate, brought to your attention before the new use begins. A notice update alone does not provide consent or a lawful basis for a new purpose.