Privacy Policy
Applicable to UK and International Visitors
1. Data Controller Details
This Privacy Policy explains how Illumin IT Ltd ("ZappSites", "we", "us", or "our") collects, uses, and protects your personal information when you visit our website, request a Free Growth Audit, or use our managed website and booking services.
Legal Business Name: Illumin IT Ltd
Registered Address: 128 City Road, London, United Kingdom, EC1V 2NX
Privacy & Data Protection Enquiries: info@zappsites.com
2. Information We Collect
We only collect personal information that is strictly necessary to evaluate, deliver, and support our digital growth services. This includes:
- Free Growth Audit & Discovery Submissions: Business name, trade category, current website URL, target geographical areas, primary contact name, email address, and phone number.
- Enquiry & Contact Requests: Contact details, job details, and specific project scopes submitted via our contact or demo request forms.
- Client Onboarding & Account Setup: Business registration details, invoice billing addresses, direct debit / payment identifiers, domain names, team bios, and service pricing menus.
- Communications & Support Records: Notes and logs from email correspondence, support requests, and telephone discovery conversations.
- Technical & Analytics Data: IP addresses (anonymised where supported), browser types, operating systems, referring URLs, and interaction timestamps (collected only where analytics consent is provided).
3. Booking and End-Customer Data Roles
When ZappSites designs and builds booking and enquiry workflows for our client businesses (e.g. trades, cleaners, salons, personal trainers):
- ZappSites as Data Controller: We act as the Data Controller for direct enquiries made about ZappSites services, client commercial relationships, and our own marketing activities.
- ZappSites as Data Processor: Where ZappSites provides managed booking systems or hosting infrastructure through which our clients collect appointments and quotes from their end customers, ZappSites acts strictly as a Data Processor under instructions of the client business (the Data Controller).
- Third-Party Booking Engines: Where clients choose third-party booking tools (e.g. OpenTable, Fresha, Timely, Stripe), data processing is governed by the respective supplier's data processing agreement.
4. Lawful Bases for Processing (UK GDPR)
Under the UK General Data Protection Regulation (UK GDPR), we process personal data under the following structured lawful grounds:
| Processing Purpose | Data Category | Lawful Basis |
|---|---|---|
| Providing Free Growth Audits & Estimates | Name, business URL, email, trade info | Consent / Legitimate Interests (evaluating suitability) |
| Delivering Managed Website & Booking Services | Client contact, billing, and account info | Performance of Contract |
| Statutory Accounting & Tax Compliance | Invoices, payment references, VAT records | Legal Obligation |
| Website Analytics & Performance Measurement | Aggregated traffic, page flows | Consent (via Cookie Banner) |
5. Third-Party Processors & International Transfers
We do not sell, rent, or trade personal data to third parties. We share data only with verified infrastructure sub-processors who adhere to strict data-protection agreements:
| Service Category | Provider Reference | Purpose | Data Location & Safeguards |
|---|---|---|---|
| Cloud Hosting & CDN | AWS / Cloudflare / Vercel | Website hosting, caching, uptime monitoring and asset delivery | UK / EU / International under Standard Contractual Clauses |
| Website Analytics (Optional) | Plausible Analytics / Google Analytics | Aggregated website traffic and conversion measurement (only active with consent) | UK / EU / International under Standard Contractual Clauses |
| Enquiry & Form Delivery | Resend / Postmark | Delivering quote requests and audit notifications to business inboxes | UK / EU / International under Standard Contractual Clauses |
| Booking & Scheduling Engine | ZappSites Engine / Cal.com | Managing customer calendar slots and appointments | UK / EU under Standard Contractual Clauses |
| Payment Processing (Where Applicable) | Stripe / GoCardless | Processing deposits, subscription fees and transaction billing | PCI-DSS Level 1 Certified, UK / EU |
Where data is transferred outside the UK or European Economic Area, we ensure adequate protection through UK International Data Transfer Agreements (IDTAs) or approved Standard Contractual Clauses (SCCs).
6. Data Retention Schedule
We retain personal information only for as long as necessary to fulfil the purposes outlined in this policy:
| Record Classification | Retention Window | Business / Legal Justification |
|---|---|---|
| Free Growth Audit & Website Enquiries | 12 months following last communication | Responding to enquiry and providing audit review recommendations |
| Active Client Account Records | Duration of contract + 6 years | Contract management, financial compliance and statutory accounting |
| End-Customer Booking Submissions | 12 months (or as configured by client policy) | Delivering appointment confirmation and operational fulfilment |
| Marketing Preferences & Consent Logs | 24 months or until consent is withdrawn | Auditing cookie consent and marketing communications preferences |
7. Marketing Preferences & Opt-Out
We only send marketing communications, trade growth guides, and system updates where you have actively requested them or where permitted by applicable business-to-business rules. You can withdraw your consent or change your preferences at any time:
- Clicking the "Unsubscribe" link at the bottom of any marketing email.
- Emailing our privacy inbox at info@zappsites.com with your request.
8. Cookies and Analytics
Our website uses essential cookies for secure navigation and optional analytics cookies to measure aggregated campaign performance. We do not activate optional tracking cookies before receiving your consent.
You can review or adjust your preferences at any time by clicking "Cookie Preferences" in the website footer.
9. Your Data-Subject Rights
Under UK data-protection legislation, you have specific rights regarding your personal data:
- Right of Access: Request a copy of the personal data we hold about you.
- Right to Rectification: Request correction of any inaccurate or incomplete information.
- Right to Erasure ("Right to be Forgotten"): Request deletion of your personal data where there is no ongoing contractual or statutory reason for retention.
- Right to Restrict Processing: Request that we limit how we use your data in specific scenarios.
- Right to Object: Object to processing based on legitimate interests or direct marketing.
- Right to Data Portability: Request that your data be provided in a structured, machine-readable format.
- Right to Withdraw Consent: Withdraw consent at any time where processing was based on consent.
To exercise any of these rights, please contact us at info@zappsites.com. We respond to all verified requests within one calendar month without fee.