Privacy Policy

1. Who We Are

Fig Limited ("Fig", "we", "us", or "our") is a web design and hosting company registered in England. Our registered address is Penwortham, Preston, Lancashire. We are the data controller responsible for your personal data.

If you have any questions about this privacy policy or how we handle your data, please contact us at support@fig.limited or by WhatsApp on 07515 382159.

2. What Data We Collect

Information you provide to us

• Name, email address, phone number, and postcode when you submit our contact form.
• Business name, domain name, and other details when you become a client.
• Payment information when you subscribe to one of our plans (processed securely by our payment provider — we do not store card details).
• Any information you include in emails or messages to us.

Information collected automatically

• Technical data such as your IP address, browser type and version, operating system, and device information.
• Usage data including pages visited, time spent on pages, and navigation paths.
• Cookie data — see Section 7 below for full details.

3. How We Use Your Data

• To provide our services: Designing, building, hosting, and managing your website as agreed in your plan.
• To respond to enquiries: Replying to messages submitted through our contact form, email, or WhatsApp.
• To process payments: Managing subscriptions and invoicing for our hosting plans.
• To improve our website: Analysing how visitors use our site so we can make it better.
• To comply with legal obligations: Meeting our legal and regulatory requirements under UK and EU law.

4. Legal Basis for Processing (GDPR)

Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, we rely on the following lawful bases:

• Consent: Where you have given clear consent for us to process your personal data for a specific purpose, such as submitting the contact form or accepting cookies.
• Contract: Where processing is necessary to perform a contract with you, or to take steps at your request before entering into a contract (e.g. providing hosting services).
• Legitimate interests: Where processing is necessary for our legitimate business interests, provided these are not overridden by your rights. This includes improving our services and website security.
• Legal obligation: Where we need to process your data to comply with a legal requirement.

5. Data Sharing

We do not sell, rent, or trade your personal data. We may share your data with:

• Hosting infrastructure providers who help us deliver our services (servers, CDN, DNS).
• Payment processors for handling subscription payments securely.
• Email service providers for transactional communications.
• Professional advisers including accountants and legal advisers where necessary.
• Law enforcement or regulatory bodies where required by law.

All third-party providers are required to process your data securely and in accordance with applicable data protection law.

6. Data Retention

• Contact form submissions are retained for 12 months unless you become a client, in which case they form part of your client record.
• Client data is retained for the duration of your contract and for 6 years afterwards (in line with HMRC requirements).
• Website analytics data is anonymised after 26 months.
• Cookie consent preferences are stored for 12 months.

7. Cookies

Our website uses cookies to ensure it functions correctly and to improve your experience. When you first visit our site, a cookie consent banner will ask for your permission before any non-essential cookies are set.

You can control cookies through your browser settings. Disabling essential cookies may affect the functionality of our website.

8. Your Rights Under GDPR

Under the UK GDPR, you have the following rights in relation to your personal data:

• Right of access: You can request a copy of the personal data we hold about you.
• Right to rectification: You can ask us to correct inaccurate or incomplete data.
• Right to erasure: You can ask us to delete your data where there is no compelling reason to continue processing it.
• Right to restrict processing: You can ask us to suspend processing of your data in certain circumstances.
• Right to data portability: You can request your data in a structured, commonly used, machine-readable format.
• Right to object: You can object to processing based on legitimate interests or for direct marketing purposes.
• Right to withdraw consent: Where we rely on consent, you can withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please email us at support@fig.limited. We will respond within one month. If you are not satisfied with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

9. Data Security

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These include SSL/TLS encryption on all pages, secure hosting infrastructure, regular security updates, and access controls limiting who can view personal data.

10. International Transfers

Your data is primarily processed within the United Kingdom and European Economic Area. Where data is transferred outside the UK/EEA (for example, to infrastructure providers), we ensure appropriate safeguards are in place, such as Standard Contractual Clauses or adequacy decisions recognised by the UK government.

11. Children's Privacy

Our services are not directed at individuals under 16 years of age. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us and we will delete it promptly.

12. Changes to This Policy

We may update this privacy policy from time to time. Any changes will be posted on this page with an updated revision date. We encourage you to review this policy periodically.

13. Contact Us

If you have any questions about this privacy policy, please contact us: