Hosting
The site is hosted on DigitalOcean infrastructure. Access is restricted, and backups are taken daily and stored separately from the live server.
Legal
Privacy notice
This notice explains what personal data this website and our business collect, why we hold it, and what you can ask us to do with it. It is written to be read, not to be survived.
Who we are
The controller
Grey Matter Digital is a web design and AI implementation studio based in Dorset, United Kingdom. For the purposes of UK GDPR, we are the controller of the personal data described below.
You can reach us through the contact form on this site or, if a telephone number is published on our contact page, by phone. If you need a postal address for correspondence, ask and we will provide one.
What we hold
Data, purpose and lawful basis
| What we collect | Why | Lawful basis | Kept for |
|---|---|---|---|
| Name, email, phone and message from the contact form | To reply to your enquiry and, if you become a client, to deliver the work | Legitimate interests (responding to a business enquiry); contract where one exists | 24 months from last contact, or 6 years for client and accounting records |
| IP address and basic request logs | Security, abuse prevention and diagnosing faults | Legitimate interests (keeping the service available and secure) | 30 days, then deleted or aggregated |
| Email correspondence | To keep a record of what was agreed | Legitimate interests; contract where relevant | 24 months from last contact, or 6 years for client records |
| Invoicing and payment records | Legal and accounting obligations | Legal obligation | 6 years from the end of the accounting period |
Cookies
Cookies and tracking
This site sets no analytics, advertising or social media cookies. There is no Google Analytics, no Meta pixel, no heatmap recorder and no chat widget. That is why you have not been asked to accept anything.
The site may set a strictly necessary cookie or use a short-lived token to protect forms against abuse. Anything of that kind is required for the site to function and is not used to track you across other sites.
Server logs record the IP address, the requested page, the time and the user agent. They are used for security and fault diagnosis, and are retained for 30 days.
Sharing
Who processes data for us
Business email is handled by a UK-based provider. Messages are stored in the UK or the EEA under a data processing agreement.
Notifications
New enquiry alerts may be forwarded to a private Telegram channel. Telegram is an independent messaging service; the alert contains your name and message. If you would prefer we did not, say so and we will use email only.
Accounting
Invoices and payment records are shared with our accountant and, where relevant, HMRC, as required by law.
Transfers
International transfers
We keep personal data in the UK wherever possible. Where a processor stores data outside the UK — for example, a messaging service with servers in another jurisdiction — we rely on the UK's adequacy regulations or the International Data Transfer Addendum, and we keep the set of such processors small.
We do not sell personal data, and we do not share it with advertisers or data brokers.
Your rights
What you can ask us to do
- AccessAsk for a copy of the personal data we hold about you.
- CorrectionAsk us to correct anything inaccurate or incomplete.
- ErasureAsk us to delete data we no longer need, subject to legal retention obligations.
- Restriction and objectionAsk us to stop or limit processing, including direct marketing, which we do not send without consent.
- PortabilityAsk for data you gave us in a structured, commonly used format.
- ComplainComplain to the Information Commissioner's Office at ico.org.uk. We would appreciate the chance to resolve it first.
Security
How it is protected
Access to systems is limited to the people who need it, protected by strong authentication, and reviewed when someone leaves. Data is encrypted in transit. Backups are encrypted and tested. The site runs with a strict content security policy and a minimal attack surface.
No system is perfectly secure. If a breach occurs that is likely to result in a risk to your rights, we will notify the ICO within 72 hours and tell affected individuals without undue delay.
Changes
Changes to this notice
This notice was last updated on 20 October 2026. If we change how we handle personal data, we will update this page and change the date. We will not apply a materially different use to data we already hold without telling you first.