UK GDPR Statement — shopifywebdeveloper.co.uk

01 — Our role under UK GDPR

We act in two roles depending on the activity:

Data controller — for personal data we collect directly (form submissions, our own analytics, server logs).
Data processor — for personal data we handle on behalf of a client during a delivery engagement (e.g. customer records in a Shopify store we're migrating).

When we act as a processor, our responsibilities and your responsibilities are governed by our Data Processing Agreement.

02 — Principles we follow

UK GDPR requires data to be processed:

Lawfully, fairly, and transparently — we publish what we collect and why (see Privacy Policy).
For specified, explicit, and legitimate purposes — we don't repurpose your data without consent.
Adequately, relevantly, and limited to what's necessary — minimum data, no more.
Accurately and kept up to date — we honour rectification requests.
Kept no longer than necessary — see retention schedule in our Privacy Policy.
Securely — encryption in transit (TLS), encryption at rest, access controls, audit logs.

03 — Your rights as a data subject

You have eight rights under UK GDPR:

Right	What it means
Be informed	You know what we do with your data — that's what this page and the Privacy Policy are for.
Access	Request a copy of the personal data we hold about you.
Rectification	Ask us to correct inaccurate data.
Erasure	Ask us to delete your data ("right to be forgotten").
Restrict processing	Pause processing while a query is resolved.
Data portability	Receive your data in a machine-readable format.
Object	Object to processing based on legitimate interests.
Rights re. automated decisions	We don't use automated decision-making, so this rarely applies.

04 — How to exercise your rights

Email dpo@shopifywebdeveloper.co.uk. Include:

Your name and the email address you used to contact us.
What right you're exercising.
Any specific data or time period you want included.

We respond within 30 days (typically 5 working days). The first request is free; further requests within 12 months may attract a reasonable admin fee. If we refuse a request, we'll tell you why and how to appeal.

05 — International transfers

We host primarily in the UK and EU. Where data is transferred outside the UK / EEA (e.g. to a US-based processor like Microsoft Clarity), the transfer is governed by:

The UK International Data Transfer Agreement (IDTA), or
The UK Addendum to the EU Standard Contractual Clauses, or
An adequacy decision (where the destination country has one).

06 — Breach notification

If we become aware of a personal data breach that risks the rights and freedoms of data subjects:

We notify the Information Commissioner's Office (ICO) within 72 hours.
If the risk is high, we notify affected data subjects directly and without undue delay.
We document the breach internally regardless of notification status.

To date we have had no reportable breaches.

07 — Children's data

We don't knowingly collect personal data from anyone under 18. Our services are sold to businesses, not children. If you believe we hold data about someone under 18, contact the DPO and we'll delete it.

08 — Documentation we maintain

We maintain (and can produce on request from a data subject or the ICO):

Records of processing activities (Article 30).
Lawful basis register.
Sub-processor list with locations and safeguards.
Data Protection Impact Assessments where applicable.
Breach register.

09 — EU GDPR (for EU customers)

For EU-resident data subjects and EU clients, we honour the equivalent rights under EU GDPR. Our DPO email accepts requests from any jurisdiction. EU clients may, in addition, complain to their local supervisory authority.

10 — Contact and ICO

Data Protection Officer: dpo@shopifywebdeveloper.co.uk.

If we don't resolve your concern, the supervisory authority for the UK is the Information Commissioner's Office: ico.org.uk · 0303 123 1113.