Privacy Policy

Forma Digital is a trading name used by an agency offering app development, business software and AI automation services across the UK. This notice explains how personal information is handled in connection with this website and enquiries. It does not replace any project-specific privacy information needed for client systems or services.

Legal data controller identity: To be confirmed before publication.
Controller contact address: To be confirmed before publication. The person or legal entity responsible for deciding how and why your personal information is used must be identified here before the site is published.

For privacy questions or rights requests, email hello@formadigital.uk. New project enquiries can be sent to sales@formadigital.uk, existing-client support to support@formadigital.uk, and billing queries to accounts@formadigital.uk. These addresses feed the same business inbox; choosing an address helps categorise your enquiry.

The enquiry form collects your full name, business name, email address, optional phone number, selected service, optional budget and project description, together with your checkbox acknowledgement of this notice. We also receive information you include in subsequent emails or other correspondence.

Information is normally provided directly by you. A business name or project description may include personal information about you or others. Please provide only what is relevant and avoid sending sensitive personal information, passwords, financial account details or confidential third-party data through the enquiry form.

The form uses a hidden anti-spam field and submission timing checks. Any additional technical information held in hosting or service logs, such as IP addresses or device information, and its use and retention must be checked before publication; this notice does not assert that particular logs are collected or retained.

Required fields are needed to understand and respond to a form enquiry. Optional phone and budget details help the discussion but are not required. If you prefer not to use the form, you can email us.

We use enquiry information to understand your requirements, respond to you, discuss suitability and scope, prepare a potential proposal and manage related correspondence. Our legitimate interests are handling business enquiries and developing appropriate business relationships. This basis requires consideration of your interests, rights and reasonable expectations; it is not permission for unrestricted use.

Where you ask us to take steps before entering a contract with you personally, those necessary steps may instead rely on the pre-contractual basis under UK GDPR. This basis does not automatically apply when you are acting for a company that would be the contracting party; legitimate interests may be appropriate in that situation.

If a project proceeds, personal information may also be needed to administer the contract, provide support and manage accounts. The contractual basis applies where necessary for a contract with the individual concerned; legitimate interests may apply to business representatives. Legal obligations may apply to records we are required to keep, for example relevant accounting records. Any additional project-specific processing needs its own appropriate information and lawful basis.

Spam checks support our legitimate interest in protecting the enquiry service from abuse. We do not use the enquiry form to make decisions about you solely by automated means that have legal or similarly significant effects.

The form checkbox acknowledges that you have read this privacy notice. It is not blanket GDPR consent, does not waive your rights and is not an opt-in to marketing. Responding to your request is distinct from sending promotional messages.

Any future marketing must have an appropriate lawful basis and comply with applicable UK electronic marketing rules. Where consent is required, a separate, freely given and specific opt-in must be obtained; submitting an enquiry alone is not that consent. You may object to direct marketing at any time and withdraw any marketing consent without affecting the lawfulness of earlier processing.

Enquiries are saved in a hosted database. Resend is used to attempt email notifications to our business inbox, and Google Workspace is used for business email. Notifications include enquiry information and are categorised for sales, general enquiries, support or accounts as applicable. Saving an enquiry and delivering its email notification are separate actions; an email delivery failure does not mean the saved enquiry has been lost.

These services handle personal information as part of their respective services. Their precise contracting entities, processing roles, contractual safeguards, relevant subprocessors and access arrangements must be verified before publication. Where a provider acts as a processor, appropriate data processing terms are required.

Access should be limited to people who need the information for the purposes described here. Relevant information may also need to be shared with professional advisers or authorities where justified by an applicable lawful basis or required by law. Any other project-related sharing should be explained when relevant. This notice does not claim a verified audit of provider access or storage locations.

Depending on the actual hosting, email and support arrangements, personal information may be stored in or accessed from outside the UK. Data locations and international access have not yet been verified, so we do not claim that information remains exclusively in the UK.

Transfer arrangements: To be confirmed before publication. If a restricted international transfer takes place, the applicable UK GDPR transfer requirements must be met. Depending on the destination and arrangement, this may involve UK adequacy regulations or appropriate safeguards such as the UK International Data Transfer Agreement or UK Addendum, together with the required assessment and any necessary supplementary measures. The actual destinations and safeguards must be confirmed, and information about relevant safeguards can be requested at hello@formadigital.uk.

Information should be retained only for as long as necessary for the purpose for which it is held, taking account of enquiry progress, any resulting working relationship, applicable record-keeping obligations and legitimate needs to establish, exercise or defend legal claims.

Retention periods and review arrangements: To be confirmed before publication. A documented schedule for enquiry records, correspondence, any logs and provider-held copies must be established, with periodic reviews to identify information no longer needed. No fixed period or verified automatic deletion process is claimed here.

You may request deletion by emailing hello@formadigital.uk. Requests must be considered under applicable data protection law; deletion is not absolute and information may need to be retained where there is a lawful reason, including legal obligations or legal claims. Any deletion from live records, backups and provider systems depends on the verified arrangements and applicable obligations, rather than a promise of immediate removal from every system.

Subject to the conditions and exemptions in UK data protection law, you may request access to your personal information, correction of inaccurate information, erasure or restriction of processing. You may object to processing based on legitimate interests. The right to data portability applies in certain circumstances to information you provided where processing is automated and based on consent or a contract. Where processing relies on consent, you can withdraw it.

Contact hello@formadigital.uk to exercise a right. We may need proportionate information to verify your identity and clarify the request. Requests are normally answered within one month; the law allows an extension for complex or multiple requests, with an explanation. Requests are normally free, subject to the limited exceptions permitted by law.

You can complain to the UK Information Commissioner's Office (ICO) about the handling of your personal information. Visit ico.org.uk/make-a-complaint. You may contact us first so we can address your concerns, but you are not required to do so before approaching the ICO.

No analytics or advertising cookie deployment has been verified for this website. That is not a claim that the site or its hosting services use no cookies, local storage or similar technologies.

Cookie and storage audit: To be completed before publication. The audit must identify the technologies actually used, their providers, purposes and duration, and whether consent is required under the applicable UK rules. Where required, non-exempt technologies must not be used until valid consent is obtained, with a way to withdraw it. Technologies qualifying for a legal exemption must still be assessed and explained, including any applicable information or objection requirements. This notice must be updated to reflect the audit; it does not imply that a consent banner or analytics service is already installed.

Appropriate technical and organisational measures must reflect the nature of the information and the risks of processing it. The enquiry form includes server-side validation and anti-spam checks, but these are not a guarantee against unauthorised access, loss or misuse.

The wider security arrangements, including permissions, provider settings and handling procedures, require verification before publication. No claim is made here about particular certifications, encryption standards or guaranteed security. Avoid submitting sensitive information through the form and contact us if you believe information has been misdirected or exposed.

Links to other websites lead to services with their own privacy notices and practices. Review those notices before sharing information with them; this notice applies to Forma Digital's website and enquiry handling, not independently operated third-party sites.

We may update this notice to reflect verified practices or legal changes. The date shown above identifies the latest revision. Material changes should be brought to your attention where appropriate; updating a notice does not itself authorise a new use of your information or replace any required consent.