Privacy Policy

011. Introduction & Data Controller

Idle Shark Limited is committed to maintaining data privacy and security. This Privacy Policy details how we collect, handle, store, and protect personal information in compliance with the UK GDPR, the Data Protection Act 2018 (DPA 2018), and the Data (Use and Access) framework.

Idle Shark Limited acts as the Data Controller for all personal data collected directly through our website, sales enquiries, and client management workflows.

022. Categories of Personal Data Processed

We collect and process the following categories of personal information:

• Identity & Contact Information: First name, last name, business email address, phone number, job title, and employer company name.
• Financial & Billing Data: Bank details, billing addresses, VAT registration details, and payment histories (processed securely via regulated third-party payment gateways).
• Technical & Usage Information: IP addresses, browser types, operating systems, device identifiers, and page browsing patterns collected automatically via cookies or server logs.
• Marketing & Communications Data: Communication logs, newsletter subscription choices, and feedback responses.
• Client Project Information: Content, access credentials, user lists, or API connection details supplied by clients for software engineering, UX/UI design, or digital marketing projects.

033. Lawful Bases for Data Processing

Under Article 6 of the UK GDPR, we process personal data relying on the following legal bases:

• Contractual Performance: Processing required to fulfill pre-contractual steps or perform obligations under an active client contract or Statement of Work.
• Legitimate Interests: Processing required for legitimate business interests (e.g., system administration, cybersecurity, direct B2B marketing), provided these interests do not override your privacy rights.
• Legal Obligation: Processing required to comply with UK statutory regulations (e.g., HMRC tax recordkeeping, anti-money laundering checks).
• Consent: Processing based on explicit opt-in consent (e.g., subscribing to marketing communications or accepting optional tracking cookies).

044. Processing Purposes & Legal Justifications

055. Third-Party Data Sharing & Sub-Processors

We do not sell, rent, or lease personal data. We share personal data only with trusted third-party service providers bound by data processing agreements:

• Cloud Infrastructure Providers: AWS, Vercel, DigitalOcean, or client-designated server environments.
• Business Operations Tools: Accounting applications (e.g., Xero), CRM platforms, collaboration tools, and project management platforms (e.g., Notion, Jira).
• Professional Advisers: Legal counsel, accountants, auditors, and insurers in the UK.
• Statutory Authorities: Law enforcement agencies or regulatory bodies (e.g., HMRC) when mandated by UK law.

066. International Data Transfers

When personal data is transferred outside the UK or European Economic Area (EEA), we enforce appropriate safeguards in accordance with UK law, utilizing:

• The UK International Data Transfer Agreement (IDTA) or International Data Transfer Addendum to EU Standard Contractual Clauses.
• Transfers to jurisdictions backed by official UK Adequacy Regulations.

077. Data Retention Schedule

We retain personal data only for as long as necessary to satisfy the purposes for which it was collected:

• Client Financial & Tax Records: Retained for 7 years following the accounting year-end to comply with UK tax law.
• Project Files & Staging Code Backups: Retained for up to 12 months post-project launch or as defined in the specific contract.
• Marketing Contact Data: Retained until you opt-out, unsubscribe, or after 24 months of continuous inactivity.

088. Data Security Architecture

We employ technical and organizational safeguards to protect personal data:

• TLS 1.3 encryption for data in transit and AES-256 encryption for data at rest.
• Strict role-based access control (RBAC), minimum privilege policies, and mandatory Multi-Factor Authentication (MFA).
• Regular code security audits, dependency updates, and patch management protocols.

099. Your Legal Rights Under UK GDPR

Under UK GDPR, you hold the following rights regarding your personal data:

• Right to Access (DSAR): Request a copy of the personal data held about you.
• Right to Rectification: Request correction of inaccurate or incomplete records.
• Right to Erasure ("Right to be Forgotten"): Request deletion of data where no overriding legal basis exists.
• Right to Restrict or Object: Limit or object to processing based on legitimate interests or direct marketing.
• Right to Data Portability: Request transfer of your data in a structured, machine-readable format.

To exercise any of these rights, email info@idleshark.com. Statutory requests are fulfilled without charge within one calendar month.

1010. Direct Data Protection Complaints Procedure

If you have concerns regarding our handling of your personal data:

• Submit your complaint in writing to info@idleshark.com with the subject line "Data Protection Complaint".
• We will issue a written acknowledgment within 30 calendar days and conduct an internal review.

You also retain the statutory right to lodge a complaint with the UK data protection supervisory authority:

• Information Commissioner’s Office (ICO)

Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Helpline: 0303 123 1113 | Website: https://ico.org.uk/