United Kingdom

Privacy Policy

This policy explains how Legend DigiTech Limited collects, uses, shares, stores and protects personal information when you use our website, contact us, request a proposal or receive digital marketing, web development, software, CRM, advertising, SEO, cybersecurity or related services from us.

Plain-language summary: We use personal information to respond to enquiries, prepare proposals, deliver digital services, manage campaigns and platforms, operate our website, communicate with clients, meet legal obligations and protect our systems. We do not sell personal information.

1. Who we are

Legend DigiTech Limited is a private limited company registered in England and Wales under company number 08530032. Our registered office is Citygate House, 246–250 Romford Road, London, United Kingdom, E7 9HZ.

For personal information covered by this UK policy, the controller is:

Legend DigiTech Limited
Company number: 08530032
Citygate House, 246–250 Romford Road, London, United Kingdom, E7 9HZ
General enquiries: info@legenddigitech.com
Phone: +44 330 236 9333

Where we provide services to a client, our role may vary. We may act as a controller for our own business administration, compliance, account management, marketing and security purposes. Where we process personal information on a client’s behalf within client systems or campaigns, we may act as a processor or service provider under the relevant contract or instructions.

2. Scope of this policy

This policy applies when you:

visit or interact with legenddigitech.com or related Legend DigiTech web pages;
submit an enquiry, request a proposal, book a consultation or ask for a service quotation;
become, or represent, a client or prospective client;
receive digital marketing, PPC, SEO, social media, email marketing, web design, web development, software, CRM, cybersecurity, analytics or related services from us;
give us access to client websites, social media pages, advertising accounts, CRM systems, analytics tools, hosting environments or other platforms;
communicate with us by email, telephone, online meeting, form, approved messaging channel or another business channel; or
act as an employee, contractor, supplier, partner, authorised representative or contact person of a client or prospective client.

Separate notices may apply to employees, contractors, job applicants or specific client projects where additional information is required.

3. Personal information we collect

The information we collect depends on your relationship with us and the services requested. It may include:

Identity and contact information

name, job title, company name, business address, email address and telephone number;
billing, contract, proposal and authorised representative details;
meeting notes, enquiry details, service requirements and communication records; and
information you provide through forms, questionnaires, onboarding documents or project briefs.

Client project and platform information

website URLs, hosting details, domain information and content-management-system information;
brand assets, business content, product or service information, images, videos and marketing materials;
advertising-account, analytics, CRM, email-marketing, social-media and lead-generation data where authorised by the client;
campaign audiences, targeting instructions, keyword plans, conversion events, lead forms, performance reports and analytics dashboards;
technical diagnostics, website-speed results, security observations, support requests and change records; and
limited credentials or access tokens where these are necessary and approved for service delivery.

Website, analytics and technical information

IP address, device information, browser type, approximate location and referral source;
pages viewed, form interactions, session information and website behaviour;
cookie preferences and consent records;
marketing-campaign and conversion information where you consent to relevant technologies; and
security, diagnostic and access logs used to operate and protect our website and systems.

Please do not send passwords, access codes, payment-card details, highly sensitive information, children’s information or confidential client records through a general website form unless specifically requested through an approved secure channel.

4. Where personal information comes from

We may receive personal information from:

you directly;
your employer, business, client, colleague, agency, supplier or authorised representative;
client-provided websites, CRMs, advertising accounts, analytics accounts, email-marketing platforms, social media pages, hosting platforms and project-management tools;
public business sources, search engines, company websites, professional profiles and official registers;
our website, forms, cookies, analytics and security technologies;
partners, subcontractors and service providers involved in an authorised project; and
Google, Meta, Microsoft, LinkedIn or other digital platforms where the client authorises us to access or use those platforms.

Where another organisation gives us personal information, that organisation is responsible for confirming it is authorised to share it and, where required, for giving affected individuals appropriate privacy information.

5. How and why we use personal information

UK data protection law requires us to identify a lawful basis for each purpose. The bases we most commonly rely on are contract, steps before a contract, legal obligation, legitimate interests and consent.

Purpose	Examples	Typical lawful basis
Responding to enquiries and preparing proposals	Reviewing your request, arranging a consultation, providing service information or preparing a quote.	Steps before a contract; legitimate interests.
Providing digital services	SEO, PPC, social media, content, web design, web development, software, CRM, analytics, cybersecurity and campaign support.	Contract; legitimate interests; client instructions where we act as processor.
Managing client projects	Project planning, communication, support, change requests, quality control, billing, reporting and account management.	Contract; legitimate interests.
Operating client campaigns and platforms	Configuring tracking, tags, audiences, conversion events, lead forms, analytics reports or dashboards where authorised.	Contract; legitimate interests; consent where required for cookies or direct marketing.
Marketing our own services	Sending service updates, newsletters, event information, offers or digital-marketing insights.	Consent, or another rule permitted by PECR where clearly applicable.
Website analytics and advertising measurement	Google Analytics, advertising pixels, conversion tracking and campaign measurement on our own website.	Consent for non-essential cookies and similar technologies.
Security and fraud prevention	Monitoring website misuse, protecting accounts, investigating suspicious activity and maintaining logs.	Legitimate interests; legal obligation.
Legal, regulatory and business administration	Contracts, invoices, accounting records, audit trails, dispute handling, legal claims and compliance.	Legal obligation; contract; legitimate interests.

Where we rely on legitimate interests, those interests may include operating a digital-services business, responding to enquiries, delivering projects, protecting systems, preventing fraud, improving services and maintaining business records. We assess whether these interests are necessary and balanced against your rights.

6. Client platforms, accounts and campaign data

Some projects require access to client-controlled platforms such as websites, hosting, Google Analytics, Google Tag Manager, Google Ads, Search Console, Meta Business Suite, LinkedIn, Microsoft Advertising, CRMs, email-marketing tools or ecommerce systems. Access must be authorised by the client and limited to what is necessary for the agreed service.

We expect clients to provide role-based access where possible rather than sharing personal passwords. Credentials, recovery codes, API keys or administrator permissions should only be shared through an approved secure method and should be removed or changed when no longer required.

Where campaign data includes leads, customer lists, website visitors, conversion events or audience information, we handle that information only for the authorised project purpose and in accordance with the applicable contract, platform terms and privacy requirements.

7. Cookies, analytics and advertising technologies

We use essential technologies to operate and secure our website. With your consent, we may use Google Analytics, Google Ads, remarketing or similar technologies to understand website performance, measure campaign results and improve our services. Non-essential cookies and similar technologies should not activate before the relevant consent is recorded.

Details of cookie categories, providers, purposes and retention periods are set out in our Cookie Policy and the live cookie settings tool.

8. Who we share personal information with

We do not sell personal information. Where necessary and lawful, we may share personal information with:

Legend Group companies involved in authorised support, administration or service delivery;
client-approved digital platforms, advertising networks, analytics providers, hosting providers and website tools;
cloud, email, Microsoft 365, CRM, project-management, support, cybersecurity, backup and communication providers;
designers, developers, consultants, contractors or subcontractors working under confidentiality and security obligations;
payment providers, accountants, auditors, insurers, professional advisers and legal advisers;
regulators, courts, law-enforcement bodies or public authorities where required by law; and
another person where you authorise the disclosure or the law permits or requires it.

We limit disclosures to what is necessary for the relevant purpose and apply contractual, access-control and due-diligence measures where appropriate.

9. International access and transfers

Legend DigiTech may work with clients, staff, contractors and service providers in the United Kingdom and other countries, including countries where cloud, advertising, hosting, analytics, design, support or development services are provided. Personal information may therefore be accessed or processed outside the UK.

Where UK transfer rules apply, we use an available lawful mechanism, which may include UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved EU Standard Contractual Clauses, contractual safeguards, technical safeguards and transfer risk assessment where required.

10. How long we keep personal information

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, including service delivery, client support, legal, tax, accounting, audit, security, dispute-resolution and contractual requirements.

Project files, account-access records, support tickets, campaign reports and communication records are reviewed in line with operational need and client agreements. Marketing records are kept until you withdraw consent or object, although we may retain a limited suppression record to respect your preference. Cookie and analytics retention periods are described in the Cookie Policy and live cookie inventory.

11. How we protect personal information

We use technical and organisational measures appropriate to the nature and risk of the information. These may include role-based access, multi-factor authentication, secure credential handling, encryption in transit, endpoint protection, backups, logging, supplier checks, confidentiality requirements, security monitoring and incident-response procedures.

No internet transmission or storage system is completely secure. If you need to share credentials, client lists, website administrator access, payment data, personal data exports or other sensitive material, use the secure method specified by the Legend DigiTech team.

12. Your UK data protection rights

Depending on the circumstances, you may have the right to:

be informed about how your personal information is used;
request access to personal information we hold about you;
request correction of inaccurate or incomplete information;
request erasure where the right applies;
request restriction of processing;
receive certain information in a portable format;
object to processing based on legitimate interests;
object at any time to direct marketing;
withdraw consent without affecting processing carried out before withdrawal; and
raise concerns about solely automated decisions with legal or similarly significant effects.

These rights are not absolute and may be limited by legal, contractual, evidential, security or client-instruction requirements. To exercise a right, contact us using the details below and provide enough information for us to identify the relevant records.

13. Marketing communications

Submitting an enquiry does not automatically subscribe you to marketing. Where consent is required, we use a separate, unticked option for newsletters, service updates, digital-marketing insights, offers or event information.

You can withdraw consent or object to direct marketing at any time by using the unsubscribe link in an email or contacting us. We will stop the relevant marketing as soon as reasonably possible and may keep a limited suppression record so that your preference is respected.

14. Automated decision-making and profiling

We do not use our website to make decisions about you based solely on automated processing where the decision produces legal or similarly significant effects. We may use analytics, advertising measurement, lead-scoring or campaign-reporting tools to understand website performance and marketing effectiveness, subject to cookie choices and contractual controls.

15. Children's information

Our website and services are directed primarily at businesses and adults. We do not knowingly use the website to collect information directly from children for marketing purposes. If a client project involves children’s information, it must be specifically assessed and approved before processing.

16. Changes to this policy

We may update this policy to reflect changes in our services, website, systems, suppliers, legal obligations or regulatory guidance. The effective date at the top shows when the current version applies. Where a change is material, we may provide an additional notice through the website, email or another appropriate channel.

17. Contact and complaints

Data Protection Contact

Fahad Lateef
Data Protection Contact
info@legendgroup.uk
Phone: 0742 865 4445

General enquiries: info@legenddigitech.com
Phone: +44 330 236 9333

Information Commissioner’s Office

You may complain to the ICO if you are unhappy with how we handle personal information. Details are available at ico.org.uk/make-a-complaint.