Privacy Policy — NEXOVIK

1. What Data We Collect

We collect only the personal data necessary to provide our services. This includes:

Name and contact details — collected when you fill out our contact form or checkout (name, email address, phone number if provided)
Project information — details about your website requirements, desired domain name, and business needs
Communication records — emails and messages exchanged during your project
Payment information — we do not store card details. Payments are processed via secure third-party providers

We do not collect sensitive personal data (such as health information, racial or ethnic origin, political opinions, or religious beliefs). We do not use automated decision-making or profiling.

2. How We Use Your Data

We use your personal data solely for the following purposes:

To respond to your enquiries and provide quotes
To deliver the web design and digital services you have requested
To communicate with you about your project
To send invoices and process payments
To comply with legal obligations (e.g., tax records)

We do not use your data for marketing purposes unless you have explicitly opted in. We do not sell your data to third parties.

3. Legal Basis for Processing

Under UK GDPR, we process your data on the following legal bases:

Contract — processing is necessary to fulfil our contract with you (Article 6(1)(b))
Legitimate interests — to manage our business relationship and improve our services (Article 6(1)(f))
Legal obligation — to comply with tax, accounting, and other legal requirements (Article 6(1)(c))
Consent — where you have explicitly agreed (e.g., marketing emails) (Article 6(1)(a))

4. How We Share Your Data

We share your data only when necessary and only with trusted third parties:

FormSubmit.co — used to deliver contact form submissions and order enquiries to our email. Data is processed in accordance with their privacy policy
Payment processors — to process invoices and payments securely
Hosting providers — when setting up hosting for your website, we share necessary details with your chosen hosting company
Legal authorities — only if required by law or court order

All third parties we work with are GDPR-compliant and process data only on our instructions.

5. Data Retention

We keep your personal data for as long as necessary:

Active projects — throughout the duration of your project and for 12 months after completion
Financial records — 6 years, as required by UK tax law (HMRC)
Enquiry emails — 24 months, after which they are securely deleted

You may request deletion of your data at any time (see "Your Rights" below), though we may need to retain certain information to comply with legal obligations.

6. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

Right to access — request a copy of the data we hold about you
Right to rectification — ask us to correct inaccurate or incomplete data
Right to erasure ("right to be forgotten") — request deletion of your data
Right to restrict processing — ask us to limit how we use your data
Right to data portability — receive your data in a structured, machine-readable format
Right to object — object to processing based on legitimate interests
Right to withdraw consent — withdraw consent at any time where processing is based on consent

To exercise any of these rights, email us at yasin@sparkpixel.co.uk. We will respond within 30 days. You also have the right to complain to the Information Commissioner's Office (ICO) if you believe we have mishandled your data.

7. Data Security

We take appropriate technical and organisational measures to protect your data:

Secure email communication
Strong passwords and two-factor authentication on all accounts
Limited access to personal data (only the person handling your project)
Secure storage of project files and backups

In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and the ICO within 72 hours as required by UK GDPR.

8. Cookies

Our website uses minimal cookies. See our Cookie Policy for full details. We do not use third-party tracking cookies or analytics cookies without your consent.

9. International Transfers

We are based in the United Kingdom and primarily work with UK and EU clients. Where data is transferred outside the UK/EEA (e.g., to FormSubmit.co or Cloudflare), we ensure adequate safeguards are in place, such as Standard Contractual Clauses (SCCs) or equivalent protections.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated date. We encourage you to review this policy periodically.

11. Contact Us

For any privacy-related questions, concerns, or to exercise your rights, contact:

NEXOVIK (Data Controller)
Email: yasin@sparkpixel.co.uk
Location: Birmingham, United Kingdom