Privacy notice
Privacy notice
How Macuno Digital collects, uses and protects personal data, and your rights.
1. Who we are
The controller of your personal data is Macuno Ltd, trading as Macuno Digital. Macuno Ltd is registered in England and Wales, company number 16406548. Registered office: 71–75 Shelton Street, Covent Garden, London WC2H 9JQ.
Contact us about privacy at hello@macunodigital.com, or by post at the address above. We are registered with the Information Commissioner's Office (ICO) under registration number ZC267233. We are not required to appoint a data protection officer and have not done so.
2. What we use personal data for, and our lawful bases
Free check requests and enquiries
When you use our free check form or email us, we collect your name, email address, business name, website address, your company number and sector if you give them, your confirmation that you're asking for a business, whether you ticked the optional updates box, and anything else you tell us. We use it to carry out the check and reply to you.
Lawful basis: legitimate interests (UK GDPR Article 6(1)(f)). Our interest is responding to business enquiries. If you are a sole trader asking us to do work for you, our basis is taking steps at your request before entering into a contract (Article 6(1)(b)). We need your email address and website to do the check; without them we can't respond.
Customers
When you buy a report, Fix Pack, add-on or monitoring, we use your contact details, business details, questionnaire answers, emails and payment records to deliver the service, send you service updates and keep accounts.
Lawful bases: performance of a contract (Article 6(1)(b)) where you are our customer; legitimate interests (Article 6(1)(f)) where you are a contact at a company that is our customer; and legal obligation (Article 6(1)(c)) for the tax and company records we have to keep.
Updates you've signed up for
If you tick the optional box on our form, we send occasional emails about website rules and our services. Lawful basis: consent (Article 6(1)(a)). You can withdraw consent at any time by clicking unsubscribe or emailing us; this doesn't affect anything we did before.
Information on websites we check
Our checks read public web pages. Those pages sometimes include personal data, such as a director's name or a staff email address. We record only what is needed as evidence for a report. Lawful basis: legitimate interests (Article 6(1)(f)) in providing accurate, evidenced reports.
Complaints
If you complain to us, we collect your name, email address, your business name if you give it, what the complaint is about, what happened and what you'd like us to do. We use this to investigate and respond. Lawful bases: legal obligation (Article 6(1)(c)) for data protection complaints, and legitimate interests (Article 6(1)(f)) for other complaints.
Website security and operation
Our hosting provider keeps standard web server access logs (IP address, date and time, the request made, the response code and size, the referring page, and the browser's user agent, which shows the browser and operating system) to deliver the site and keep it secure (Namecheap: visitor information on hosted websites). Lawful basis: legitimate interests (Article 6(1)(f)) in running a secure website. We don't use cookies, analytics or tracking: see our cookie policy.
We don't make decisions about you based solely on automated processing that have legal or similarly significant effects. We use automated tools to scan websites, but a report describes a website, not a person.
3. Business prospecting emails
We sometimes email businesses that haven't contacted us, to offer a free website check. This section explains how that works.
Who we contact
We only email limited companies and limited liability partnerships. Before we email, we check on Companies House that the business is an active company or LLP. We don't send prospecting emails to sole traders or ordinary partnerships.
Where we get the details
We take the business name, company number, registered office and website from the company's public website and from the public register at Companies House. We take email addresses only from the company's own website. Where possible we use a general business address (such as info@). If we use a named work address, that is personal data and this notice applies to it.
What we keep
Company name and number, website address, the email address we used, the page where we found it, the date, the findings of our check, and the emails we sent and any reply.
Lawful basis
Legitimate interests (Article 6(1)(f)). Our interest is offering a relevant service to businesses. We complete a legitimate interests assessment before we send any prospecting email, and you can ask for a copy. Our emails say who we are, where we got the address and how to opt out. We don't use tracking pixels or tracked links in our emails. See the ICO's guidance on business-to-business marketing and legitimate interests.
Your right to object
You can object at any time, and we will stop. Reply "unsubscribe" or "no thanks" to any of our emails, or email hello@macunodigital.com. Your right to object to direct marketing is absolute: we don't need a reason.
Our suppression list
When someone objects, we add them to our do-not-contact (suppression) list, and check that list before every email we send. The suppression list stores the email address, the company's domain, the reason for suppression, the date and where the address came from. We keep it so that we don't contact you again.
How long we keep prospecting records
If you don't reply, we delete the prospecting record 12 months after our last email. Suppression list entries are kept for as long as we send prospecting emails, so that your objection keeps working.
4. Who we share data with
We don't sell personal data. We share it only with service providers who help us run the business, and only as needed:
- Website hosting: Namecheap, Inc. hosts this website and its server logs (Namecheap privacy policy).
- Email: Namecheap, Inc. also provides our email service (the cPanel Email service included with our Namecheap Shared Hosting plan, filtered by Namecheap's Jellyfish spam protection) and stores our emails.
- Online forms: we don't use a third-party form service. When you send our free check or complaint form, a script on our own Namecheap hosting emails your answers to our hello@macunodigital.com inbox (the Namecheap cPanel Email service described above). The script is designed not to keep a copy of your answers on the web server, and it doesn't set cookies.
- Payments: Stripe processes card payments through its payment links. Under Stripe's Services Agreement, our contracting entity is Stripe Payments Europe, Limited (Ireland). Stripe's Privacy Center says that, for UK users, Stripe Payments UK, Ltd. provides authorised payment services and other regulated activities in the UK, and Stripe Technology Company, Limited (Ireland) handles other processing. In this notice, "Stripe" means those three companies. Stripe acts as our processor when it takes payments on our instructions and provides its services to us. It acts as a controller when it chooses the banks and payment providers that handle a payment, prevents and detects fraud, manages financial and security risks, meets its legal duties (such as anti-money laundering and identity checks) and improves its own services (Stripe Data Processing Agreement). We don't see or store your full card details.
- Professional advisers and authorities: our lawyers, accountants or insurers where needed, and HMRC or other authorities where the law requires.
5. International transfers
Some of our providers are based outside the UK, or may access data from outside the UK.
Stripe. Transfers from us to Stripe's Irish companies are covered by the UK's adequacy regulations for the European Economic Area. Stripe says it may transfer personal data to the United States, including to its parent company, Stripe, LLC. Stripe says Stripe, LLC is certified under the UK Extension to the EU-US Data Privacy Framework (the UK-US data bridge), that it relies on this for transfers from the UK to the US, and that the UK International Data Transfer Addendum is also incorporated into its agreements (Stripe Privacy Center; Stripe Data Privacy Framework Policy).
Namecheap. Namecheap, Inc. is a US company, so some hosting and email data may be processed in the United States. We will ask Namecheap which UK transfer safeguard applies to our hosting and email data, and we will update this notice when we have an answer. If you would like to know more in the meantime, email hello@macunodigital.com.
6. How long we keep data
| Data | How long |
|---|---|
| Free check requests and enquiries, if you don't become a customer | 12 months after our last contact |
| Customer records, invoices and payment records | 6 years from the end of the financial year they relate to, for tax and company-law purposes |
| Reports, questionnaires and work emails | 6 years after the work ends, in case of a claim |
| Marketing consent (optional updates) | Until you unsubscribe; then your address goes on our suppression list |
| Prospecting records | 12 months after our last email if you don't reply |
| Suppression list | For as long as we send marketing or prospecting emails |
| Complaints | 3 years after the complaint is closed |
| Server logs | As set by our hosting provider |
7. Your rights
You have the right to:
- ask for a copy of your personal data (access);
- ask us to correct data that is wrong or incomplete;
- ask us to delete your data;
- ask us to restrict how we use your data;
- object to our use of your data where we rely on legitimate interests, and object to direct marketing at any time;
- ask for data you gave us in a portable format, where we rely on consent or contract;
- withdraw consent at any time, where we rely on consent;
- not be subject to decisions based solely on automated processing that significantly affect you.
To use any of these rights, email hello@macunodigital.com. We'll reply within one month. Some rights have exceptions; if one applies, we'll explain why.
8. Complaints
If you're unhappy with how we've handled your personal data, you can complain to us first, using our complaints form or by emailing hello@macunodigital.com with "Data protection complaint" in the subject, or go straight to the ICO. If you complain to us, we will acknowledge your complaint within 30 days, investigate it and tell you the outcome.
You also have the right to complain to the Information Commissioner's Office, the UK's data protection regulator: ico.org.uk/make-a-complaint, telephone 0303 123 1113, or Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.
9. Other information
This website is for businesses and is not aimed at children. We may update this notice; the date at the top shows when it last changed. If we make a significant change that affects you, we'll tell you by email where we can.