Privacy notice
What we do with your information.
Short version: we collect the least we can, we use it only to do the work you asked for, we do not sell it, and you can have it back or deleted whenever you like.
Who we are
T19 Digital ("we", "us") is the data controller for the information described here.
Reach us at hello@t19digital.co.uk or 01204 961969. That is also the route for exercising any of the rights below — you will get a person, not a ticket queue.
What we collect, and why
| What | Why | Lawful basis | Kept for |
|---|---|---|---|
| Name, email, phone, business name — from the contact form or the assistant | To answer your enquiry and, if it goes anywhere, to quote for the work | Legitimate interests (responding to someone who contacted us) | 24 months from last contact |
| What you tell us about your project | To write a proposal that fits | Legitimate interests, then contract | 24 months, or 7 years if we work together |
| Proposal and contract activity — when a link was opened, when it was accepted, the name typed as a signature and the time | To know where a quote stands, and to evidence that an agreement was signed | Contract, and legitimate interests | 7 years after the work ends (contract and tax records) |
| Technical: IP address and browser string, briefly | Security — rate-limiting sign-in attempts, and evidencing a signature | Legitimate interests (keeping the service secure) | Sign-in throttling: 15 minutes. Signature evidence: with the contract. |
| Billing details, if we work together | Invoicing and statutory accounts | Contract, and legal obligation | 7 years (HMRC) |
We do not collect special category data, we do not profile you, and nothing here is used for automated decision-making that has a legal effect on you.
Cookies and tracking
This site sets no cookies at all for ordinary visitors and runs no advertising or analytics trackers. Fonts are served from this domain rather than a third party, so your visit is not shared with anyone. See the cookie notice for the full detail, including the two exceptions: our own staff sign-in, and the contact form.
Who else handles it
We use a small number of suppliers as data processors. Each may only act on our instructions, under a data processing agreement — either the one contained in their standard terms, which applies automatically to our account, or one signed separately.
| Supplier | What for | Where |
|---|---|---|
| Vercel Inc. | Website hosting and delivery | EU/UK regions; US company, transfers under the UK Addendum to the EU SCCs |
| Lead Capture AI (our own product) | The contact form and assistant | UK |
| Neon Inc. | Database holding proposals and contracts | EU (London/Frankfurt region); US company, UK Addendum to the EU SCCs |
| GitHub, Inc. | Storing the site's own code and content | US; UK Addendum to the EU SCCs |
| Anthropic PBC | Drafting assistance inside our tools, where used | US; UK Addendum to the EU SCCs |
We never sell personal data and we do not share it for anyone else's marketing. We will disclose it if the law requires us to.
Sending data outside the UK
Where a supplier is outside the UK, transfers are covered by the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or by UK adequacy regulations. You can ask us for a copy of the safeguards.
Your rights
Under UK GDPR you can ask us to: give you a copy of what we hold; correct anything wrong; delete it; restrict or stop how we use it; give it to you in a portable format; or object to us relying on legitimate interests. Where we rely on consent, you can withdraw it at any time.
Email hello@t19digital.co.uk and we will respond within one month, free of charge. We may ask you to confirm who you are first.
If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office — ico.org.uk, 0303 123 1113. We would rather you told us first so we can put it right.
Keeping it safe
Sensible, proportionate measures: everything served over HTTPS with strict transport security, administrative access behind a password with rate-limiting and time-limited sessions, credentials held as environment variables and never in code, database access restricted and encrypted in transit, and least-privilege tokens throughout. More detail on the security page.
Children
This is a business-to-business service and is not directed at children. We do not knowingly collect data about anyone under 18.
Last updated 21 August 2026. We will post any changes here and update this date.