Privacy notice
Draft pending legal review
We prepared this notice on 28 July 2026 to describe how this website handles enquiry details. Digital Movement UK should review and approve it before anyone relies on it.
This notice explains what happens to your details when you contact Digital Movement UK through this website. We wrote it for the people it affects, not for lawyers, and it deliberately covers the parts most notices gloss over: where your enquiry actually goes, that we keep a copy of it, and what we record alongside what you typed.
It covers the enquiry forms on this website and the emails they produce. It does not cover what we do with client data once you engage us for work; the agreement we would sign with you sets that out instead. Nor does it cover other companies' websites that we link to.
The UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 govern Digital Movement Marketing Ltd. Our supervisory authority is the Information Commissioner's Office.
Who is responsible for your data
Digital Movement Marketing Ltd, trading as Digital Movement UK, is the data controller for this website. That means we decide what happens to any personal data you send us through it, and we are the ones answerable for looking after it.
The company is registered in England and Wales under company number 17110525. Our registered office is 128 City Road, London, EC1V 2NX, United Kingdom. We founded the company in 2018, and we now work with clients across the United Kingdom, Australia and New Zealand.
If you have a question about this notice, want to know what we hold about you, or want us to delete something, email office@digitalmovement.uk or call 0203 815 7992. Privacy questions sent to that address reach the people who can act on them.
The personal data this site asks for
There are twenty enquiry forms on this website, two on each of the home page, the four service pages and the five city pages. Between them they ask for the fields below, and a short record travels with each submission, listed underneath.
| Field | What you give us | Where it is asked |
|---|---|---|
| Full name | Your name, as you choose to write it. | Every form |
| Phone | A number we can call you back on. | Every form |
| The address we send our reply to. | Every form | |
| Your website | The web address of your business. | Nineteen of the twenty |
| Main need / sector | One choice from a short drop-down list — for example "SEO review", "Phone calls" or "Clinic or healthcare". | Nineteen of the twenty |
| Enquiry | A free-text box. Whatever you decide to write in it. | Two forms — the lower forms on the home page and the SEO services page |
| Consent tick box | Confirmation that you are happy for us to use these details to reply to you. | Every form |
Recorded alongside your answers
We save three further items with a submission. None of them is something you type, so we would rather list them than let you find out later. We store all of it on our own server, which section 03 explains in full.
- →A record of what you agreed to. The exact wording printed next to the tick box on your screen, whether you ticked it, and the date and time you sent the form, to the second. Our system reads the wording from the live page rather than us typing it in, so the record cannot drift from the words you actually saw.
- →The page you were on. The web address of the page holding the form, so we know what you were reading when you got in touch. Your browser sends the page title along with it, but we do not keep it.
- →Which form, and how long the page was open. Whether you used the form at the top or the bottom of the page, and roughly how many seconds the page had been open before you sent it. The timing is a spam check — automated submissions arrive almost instantly.
Your IP address is not part of that record, and neither is your browser's user-agent string, any device fingerprint, or any cookie or identifier. We do no lead scoring, and we build no profile from any of it. (The server that delivers the pages may keep ordinary access logs at the infrastructure level, separately from this; section 07 covers that.)
What this record does not include
Each form also carries one field you cannot see, left empty and hidden from screen readers. Automated spam tools fill it in; people do not. If it arrives filled in, we discard the submission and send it to nobody. Either way, we never transmit its contents.
There are a few other hidden fields, and they are not about you: they tell the receiving service what to put in the subject line, how to lay the email out, and which page to send you to afterwards. They contain no personal data.
What we will not take
We do not ask for, and do not want, anything in the categories that UK data protection law protects more strictly: health, racial or ethnic origin, religious or philosophical beliefs, political opinions, trade union membership, genetic or biometric data, sex life or sexual orientation, or information about criminal offences. Please keep that kind of detail out of an enquiry form. If it reaches us anyway, we will delete it.
The free-text enquiry box is the one field where you decide the content. Whatever you write there is what we receive.
How these forms actually work
Your answers go to Digital Movement's own server, which saves them and then emails them to us. No form-handling company sits in between, and we keep a copy — the sections below explain both facts.
When you press the send button, the page checks your answers and sends them to leads.digitalmovement.uk, which is our own address on our own hosting account. That endpoint writes the enquiry to a file on the server, then sends a notification email to office@digitalmovement.uk. You stay on the page, and a confirmation appears where the button was; nothing takes you anywhere else.
There is no form service in the middle
Earlier versions of these forms went through a third-party form-to-email service. They no longer do. We hand nothing you type to a company whose business is receiving other people's form submissions, so no such company holds a copy, and no question arises about what it might do with one. The endpoint accepts submissions only from digitalmovement.uk, so it refuses a copy of our form placed on any other website.
Two other companies are still involved further down the line, for ordinary reasons: the firm that hosts our server, and the provider that runs our mailbox. Section 06 says who does what.
A copy is kept on our server
This is new, and it is the part most worth reading. Before we changed this, we stored nothing you typed anywhere on this website. Now we do.
What we keep is the record listed in section 02: your answers, the fact that you ticked the consent box, the wording you agreed to, the time you agreed, the address of the page you were on, which of the two forms you used, how long the page had been open, and the moment the enquiry arrived.
What we do not keep matters just as much. The record contains no IP address, no browser user-agent string and no fingerprint of any kind. It holds nothing technical that could identify you elsewhere. The previous third-party service logged the IP address of everyone who submitted a form; this one does not.
Where we keep it is a folder that sits outside the public part of the server, one file per month with one enquiry per line. We do not publish it or link to it, and no web address reaches it — not for you, not for us, not for anyone who goes looking. Reaching it requires signing in to the hosting account itself.
Why we keep it is worth being blunt about. A mail server can accept an email for delivery and still never deliver it, and nobody finds out when that happens. If the only copy of your enquiry were an email and that email failed quietly, your enquiry would simply vanish and neither of us would ever know. The stored file is the record; the email is the notification. It exists so that getting in touch with us actually works.
The consent box is checked on the server, not just in the page
If a submission arrives without the consent box ticked, the server refuses it at once and returns an error instead of quietly accepting it for later. You can edit a page in a browser, but you cannot get around this check that way.
If the send fails
We treat your enquiry as safe if it reaches either the file or the mailbox; it only counts as failed if both fail. If that does happen, you lose nothing: your answers stay in the form, and a message offers you our phone number and a link that opens a message in your own email program with your details already filled in.
Older browsers, and no JavaScript
If your browser cannot use the modern method the page prefers, it posts the form to the same endpoint directly, and the reply you see is a short machine-readable confirmation rather than a normal page. Even so, the enquiry reaches us in exactly the same way. If you switch JavaScript off altogether, the form falls back to opening a new message in your own email program, addressed to us; in that case, we store nothing on our server, and nothing reaches anyone until you press send yourself.
Please keep sensitive detail out of it
An enquiry form, and the email it becomes, is not a secure channel. Please do not use one for anything sensitive — health details, financial details, or anything to do with a legal or criminal matter. Call us instead and we will find a better way to take it.
What we use it for, and the lawful basis
We use the details you send for one thing: reading and answering your enquiry, and having whatever conversation follows from it. If that conversation heads towards working together, we use the same details to prepare a proposal or a quote.
Our lawful basis
UK GDPR requires a lawful basis for every use of personal data. Depending on why you contacted us, one of two applies.
- →Steps taken at your request before entering into a contract — Article 6(1)(b). If your enquiry is about hiring us, replying to it is one of the steps you asked us to take.
- →Our legitimate interests — Article 6(1)(f). Where the enquiry is not about becoming a client — a general question, a press enquiry, a supplier introduction — our legitimate interest is simply being able to answer people who write to us. You contacted us and would expect a reply, we use your details for nothing else, and we do not consider this to override your rights or interests. If you disagree, you can object; see section 08.
About the tick box, and the record we keep of it
The tick box on each form confirms that you are happy for us to use those details to reply to you. It is not, on its own, the whole of our legal basis — the two above are. We spell this out because "consent" has a narrow, specific meaning in data protection law, and treating a tick box as if it were doing more work than it is would be misleading.
We do keep a record of it, described in section 02: the exact words that were on your screen, and when you sent the form. That record exists so that if you ever ask what you agreed to, you get the actual sentence you read rather than somebody's recollection of it. We rely on our legitimate interest in being able to show that we handled your details properly.
Where we rely on consent for something separate — if you ask us to send you a document, or to add you to something — you can withdraw it at any time by emailing office@digitalmovement.uk. Withdrawing consent does not make what we did beforehand unlawful; it stops us going any further.
What we do not do with it
We do not add enquiries to a mailing list. We do not use your details to advertise to you, we do not build a profile of you, and we do not make any decision about you by automated means.
How long we keep it
There are two copies of your enquiry: the one stored on our server, and the notification email in our inbox. We keep both for as long as we need them for the purpose you sent the enquiry for — answering you, and any conversation that comes out of that — and beyond that, on the fixed schedule below.
We delete the stored file automatically after 12 months. We write enquiries to a file one calendar month at a time; an automated job on our own server checks every month and deletes any monthly file once it is more than 12 months old. By default, we keep nothing indefinitely, and no person needs to remember to delete it.
The notification email is not on that automatic schedule. It sits in our ordinary mailbox, and we delete it the same way as any other email we no longer need. There is no fixed number of months for it yet, and we would rather say that plainly than publish a figure we do not actually apply.
If you become a client
If you go on to become a client, we keep records connected to the work — agreements, invoices and correspondence about the engagement — for as long as we need them to run the engagement and to meet our legal, tax and accounting obligations. UK law sets those periods, not us.
You do not have to wait 12 months. If you would like us to delete your enquiry and our reply sooner, ask us, and we will — unless the law requires us to keep something, in which case we will tell you what, and why.
Because both copies are ours, a deletion request is straightforward: ask, and we remove the line from the stored file and the email from the mailbox. There is no third party we have to ask on your behalf.
Who else sees it, and where it goes
- →Our own team. The people who need to read your enquiry in order to answer it.
- →The hosting provider. Our website and the endpoint that receives enquiries run on hosting we rent, so the company providing it holds the server your enquiry is stored on. It acts as a processor: it does not use anything on that server for its own purposes, but it is the one other party with technical access, and it would be dishonest to describe our own server as though nobody else were near it.
- →Our mailbox provider, Google. Google delivers email for digitalmovement.uk, so the notification email containing your enquiry arrives in a Google-hosted mailbox and sits there. Google acts as a processor for that mailbox. Any reply we send also passes through your own email provider, whoever that is.
- →Suppliers who help us run the business. If you become a client, your details will also sit in the ordinary tools any small company uses — email, file storage, invoicing and a CRM. Each of those providers processes data on our instructions under a contract. We are documenting the full list; if you want to know which providers hold your details, email us and ask, and we will tell you.
- →Anyone the law requires. We will disclose personal data where we are legally obliged to, for example to a regulator, a court or a law enforcement body acting within its powers.
We do not sell your personal data. We do not share it so that anyone else can market to you, and there are no advertising networks or data brokers connected to this website.
Outside the United Kingdom
Digital Movement works across the United Kingdom, Australia and New Zealand, so depending on who is best placed to help, a colleague outside the UK may read an enquiry sent to office@digitalmovement.uk.
Under UK data protection law, UK adequacy regulations cover New Zealand: the UK Government recognises that it offers an equivalent standard of protection, so personal data can move there without additional safeguards. Adequacy regulations do not cover Australia. Personal data going there needs a specific safeguard — such as the UK's International Data Transfer Agreement, or the UK Addendum to the standard contractual clauses — or must be necessary for a contract with you or for steps you asked us to take before entering one.
Sending an enquiry no longer moves your details to another company's systems. The submission goes to our own hosting, which stores it there; the only thing that leaves is the notification email, which goes to our Google-hosted mailbox. Google is a United States company operating a global network, so it may process that mailbox copy outside the United Kingdom under its own transfer safeguards. We are confirming which country our hosting account's servers are in, and this section will say so.
We are settling the remaining questions, and this notice will state the answers plainly. If you would like to know before you send us anything, email office@digitalmovement.uk and ask.
Cookies, analytics and what this site stores
This website uses Google Analytics to count visits and see which pages lead to enquiries, but it runs only if you agree to it. Until you do, we set no analytics cookie and send nothing to Google.
What you are asked, and when
The first time you arrive, we ask you one question: whether we may use Google Analytics. Both answers take one click, and the two buttons are deliberately the same size, shape and weight, because refusing should not be harder than agreeing. If you close the question without answering, that counts as no: we store nothing, and we will ask you again next time rather than quietly opting you in.
If you say no, or say nothing
We never request Google's script. We set no cookie, send no measurement, and nothing about your visit leaves your browser. The site behaves in exactly the same way. Google Consent Mode v2 enforces this: it denies analytics, advertising, personalisation and functionality storage before any tag can run. By default, the only category we grant is security storage, which covers fraud prevention rather than measurement.
If you say yes
Google Analytics 4 loads and places cookies in your browser, normally named _ga and one beginning _ga_, which tell one browser apart from another so that it does not count a second visit as a new person. It records the pages you look at, roughly where in the world you are, how you arrived at the site, and a small number of actions we have chosen to measure: starting an enquiry form, sending one, clicking a phone or WhatsApp link, opening an FAQ, and reaching the pricing section. Advertising and personalisation storage stay denied even after you agree, because this site runs no advertising tags at all, so there is nothing there to ask you about.
Google's role, and where the data goes
For analytics, Google acts as our processor: it handles the data on our instructions under Google's data processing terms, and we remain responsible for it. Google is a United States company operating a global network, so it may process analytics data outside the United Kingdom. Google states that Google Analytics 4 does not log or store IP addresses; it uses the address in transit to work out an approximate location, then discards it. Google's own transfer safeguards cover transfers outside the UK, set out in its published privacy and data processing documentation.
Our lawful basis for analytics is your consent, under Article 6(1)(a) UK GDPR, together with the consent the Privacy and Electronic Communications Regulations require before we store anything on your device. Analytics is the one part of this site that genuinely runs on consent, which is why it is the one part with a banner.
Changing your mind
Use the Cookie settings control in the footer of any page. Switching from yes to no takes effect at once and does three things: it stops any further measurement, it turns on Google's own kill switch for this site, and it deletes the Google Analytics cookies already sitting in your browser. You do not have to tell us why, and nothing else about the site changes.
Where your answer is kept, and for how long
We store your choice in your browser's local storage under the name dm-consent, with the date you made it. It is not a cookie, so we never transmit it with a request to us or to anyone else. Keeping a record of a preference you asked us to remember is strictly necessary in order to provide it, so that record does not itself need consent. Clearing your browser's site data removes it, and we will simply ask you again.
Google itself holds the analytics data for 14 months, after which it deletes the event-level records; aggregated totals in reports are unaffected.
The fonts are served from our own server
This site uses three typefaces — Inter Tight, Plus Jakarta Sans and JetBrains Mono. This website's own server serves them, not Google. Earlier versions of this site loaded them from fonts.googleapis.com, which meant Google received your IP address on every page view before you had agreed to anything. That request no longer happens. The SIL Open Font License covers the font files, which permits us to host them ourselves.
One page remembers that you unlocked it
The Bupa SEO teardown, at /resources/bupa-seo-teardown/, is a gated report: you give your details once and the full report opens. So that it does not ask you again on your next visit, that page saves a single marker in your browser's local storage recording that you unlocked it. It is a yes-or-no flag and holds none of your details. Local storage sits on your own device, and your browser never sends it to us; you can clear it at any time through your browser settings, usually under "clear site data". An earlier version of that page also kept a copy of the name, email address and phone number you had typed. It no longer does.
The server keeps ordinary logs
Like any website, the server that delivers these pages may keep standard access logs — the technical record of an IP address, a browser type and which file a visitor requested. Our hosting provider creates those as part of running and securing the service, not us, and we do not use them to identify or follow individual visitors. We are confirming what our host retains and for how long, and this notice will say so.
Links to other sites
The site links out to Google, to WhatsApp and to a small number of other sites. Those links do nothing at all until you click one. Once you do, you are on somebody else's site, under their privacy policy rather than ours.
Your rights under UK GDPR
These are yours by law. You do not have to give a reason for using most of them, and it costs nothing.
| Right | What it means in practice |
|---|---|
| Access | Ask for a copy of the personal data we hold about you, and an explanation of what we do with it. |
| Rectification | You can ask us to correct anything that is wrong, or complete anything that is missing. |
| Erasure | Ask us to delete your details. We will, unless there is a legal reason we must keep something — and then we will tell you what and why. |
| Restriction | You can ask us to pause using your data while we resolve a question about it. |
| Objection | Object to our use of your data where we rely on legitimate interests. If you object, we stop unless we can show compelling grounds not to. |
| Portability | Ask for the data you gave us in a common, machine-readable format, or ask us to send it to someone else. This applies where we process it on the basis of consent or a contract, by automated means. |
| Withdraw consent | Where we rely on consent, take it back at any time. It does not affect anything already done before you withdrew it. |
| Complain | Take the matter to the Information Commissioner's Office. See section 09. |
How to use any of them
Email office@digitalmovement.uk, or write to Digital Movement Marketing Ltd, 128 City Road, London, EC1V 2NX, United Kingdom. You do not need any particular form of words; telling us plainly what you want is enough.
We will respond within one month, as UK GDPR requires. If a request is complex we may extend that by up to two further months, and we will tell you within the first month if that happens. There is no charge. We may ask for something that confirms you are who you say you are, so that we do not hand your details to somebody else.
We do not make decisions about you by automated means and we do not profile you, so the right relating to automated decision-making does not arise here.
Complaints, changes and contact
If you think we have handled your personal data badly, please tell us first: email office@digitalmovement.uk and we will look into it and come back to you.
You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office, whether or not you have raised it with us first. Coming to us first does not reduce that right in any way. You can reach the ICO through ico.org.uk, and you can make a complaint at ico.org.uk/make-a-complaint or on the helpline, 0303 123 1113.
Changes to this notice
If what we do with personal data changes — where we send or store enquiries, switch analytics on, or add a new tool holding client records — we will update this page before that change goes live, and change the date below. The most likely next change is analytics, and section 07 sets out what will happen when it comes.
Data protection enquiries
- Controller
- Digital Movement Marketing Ltd, trading as Digital Movement UK
- Registered office
- 128 City Road, London, EC1V 2NX, United Kingdom
- Company number
- 17110525, registered in England & Wales
- office@digitalmovement.uk
- Phone
- 0203 815 7992
- Supervisory authority
- Information Commissioner's Office (ICO), ico.org.uk
- Last updated
- 28 July 2026