Privacy Policy

Last updated: August 2026 · DKT Digital, St Peter Port, Guernsey GY1 · Controller: Daniel Thomas, [email protected]

1. Who we are

DKT Digital is a business automation consultancy based in St Peter Port, Guernsey (GY1), Channel Islands. We act as the data controller for personal data collected via this website. We will register with the Office of the Data Protection Authority (ODPA), Guernsey, before processing any client personal data. Contact: [email protected].

2. What data we collect

3. Why we collect it (lawful basis)

4. How we use your data

5. Who we share it with

We do not sell your data. To deliver the service we use the processors below, each under its own data-protection terms; we share only the data each needs for its purpose:

We do not use advertising trackers, and we do not sell your data to anyone. The full list of the outside services we use is kept written down, not hidden — see the sub-processor schedule in our Data Processing Agreement and Security Overview.

5a. Where your data is stored

DKT Digital is based in St Peter Port, Guernsey. Our automation platform and the database holding client data run on a dedicated server operated by Hetzner Online GmbH in Falkenstein, Germany (European Union), reachable only through Cloudflare. Nightly backups are replicated, encrypted, to Cloudflare R2 storage.

Some of the services listed above are based outside the UK and EEA — notably Stripe, Google, Calendly, Apollo, Telegram and the AI providers. Where personal data reaches them, the transfer relies on the provider's own approved transfer mechanism (such as standard contractual clauses or an adequacy decision). We do not send personal or financial data to AI providers in jurisdictions we do not trust for it. Our Security Overview lists every provider, what it does, and where it is.

6. Data retention

How that is actually done, stated plainly: these are the periods we work to. For a client we are still working with, deletion is carried out by hand — when you ask, or on offboarding — and no scheduled job removes your data.

One automatic deletion now runs, and only one. Once a client has left us, the customer data they brought us is deleted 90 days after they leave. We switched that on on 2 August 2026, having previously said here that it was built but switched off. Being exact about it matters more than the headline:

We would rather set it out at this length than let “we have an automatic purge” stand for something broader than what actually runs. You can ask us to delete your data at any point inside these periods and we will, except where the law requires us to keep a record (principally invoices and payment records).

What deletion does not reach, said plainly. When you ask us to delete your data we erase it from the live system. Backups taken before you asked still contain it, and we do not edit them — they expire on their own. Measured on 5 September 2026: the off-site backup set holds the 14 most recent nightly archives, so a copy of your data sitting in a backup is gone within 14 days of your request; the copy held on the server itself is kept for 2 days. Two other places also age out on their own rather than on request: the automation engine keeps the details of a failed run for about 72 hours, and server and network logs are held for the provider’s own short window. We would rather give you a narrower promise we can keep than a total one we cannot.

7. Your rights (Guernsey DP Law 2017, Part 3 — and UK GDPR if you are in the UK)

We are based in Guernsey, so the Data Protection (Bailiwick of Guernsey) Law 2017 applies to us. Most of our clients and enquirers are in the UK, where the UK GDPR applies. The rights below exist under both regimes and we do not ask which one you are relying on before honouring them — if you are a UK data subject, treat the list as your UK GDPR rights under Articles 15–22.

To exercise any right, email [email protected]. We respond within 30 days (one month under the UK GDPR, which is the shorter of the two, so that is the one we work to).

If you are unhappy with how we handle a request, you can complain — to us or to a regulator. See §10. You do not have to come to us first.

8. Cookies and browser storage

We do not run our own analytics, advertising cookies, Google Analytics, or Facebook Pixel. We use browser localStorage (not a traditional cookie) to remember the choice you make below — that is strictly necessary to honour your decision, so it is not something you can be asked to consent to.

Nothing non-essential loads until you accept it. These tools stay switched off — not merely unused, but never requested — unless you press Accept on the banner:

One thing stays on either way: Cloudflare Turnstile, the bot protection on our contact and onboarding forms. It sets a short-lived challenge token and processes your IP address and browser signals to check you are human. We treat it as strictly necessary because it exists to protect a form you have chosen to use — switching it off would either leave the form open to abuse or make it unusable. It does not track you across sites, and we store nothing from it.

You can change your mind at any time: . Declining, or simply never answering, has the same effect — the tools do not load.

9. Security

All data is transmitted over encrypted HTTPS. Our automation platform is self-hosted and reachable only through Cloudflare (which provides TLS, access control, rate-limiting and bot protection); administrative access is not publicly exposed. Sensitive credentials are stored encrypted and never in source files.

10. Complaints

To us: email [email protected] with "COMPLAINT" in the subject. We acknowledge within one working day, tell you who is handling it, and respond in writing within 10 working days — or tell you why we need longer and give you a date. There is one person here, so that person is Daniel Thomas.

To a regulator — you can do this at any time and do not have to come to us first:

11. Changes

We may update this policy. Material changes will be communicated by email to active clients. Last updated: August 2026.