Privacy Policy

1. Who We Are

Debut Web Consultants is an AI development and premium web design agency based in Manchester, United Kingdom. We are the data controller for personal information collected through our website at debutwebconsultants.co.uk and our associated services, including our SEO Engine platform and client portal.

For data protection enquiries, contact us at: privacy@debutwebconsultants.co.uk

2. What Data We Collect

We collect the following categories of personal data when you interact with our Manchester-based services:

2.1 Information You Provide

• Contact form submissions: Name, email address, phone number, company name, and message content
• Consultation bookings: Name, email, phone, business details, and project requirements
• Client portal accounts: Login credentials, business information, project data
• SEO Engine platform users: Account information, website data, analytics credentials, API keys for connected services
• AI chatbot interactions: Messages and conversation history with our on-site AI assistant

2.2 Information Collected Automatically

• Device and browser information: IP address, browser type, operating system, screen resolution
• Usage data: Pages visited, time on site, referral source, click patterns
• Cookies and tracking technologies: See Section 7 for full cookie details

3. How We Use Your Data

We process personal data for the following purposes:

• Service delivery: To provide AI development, web design, SEO, and marketing services you have requested
• Communication: To respond to enquiries, provide project updates, and send service-related notifications
• Marketing (with consent): To send newsletters, case studies, and promotional content about our Manchester AI services. You can unsubscribe at any time.
• Analytics: To understand how visitors use our website and improve our services
• Legal compliance: To meet our obligations under UK law, including tax and accounting requirements
• Platform operation: To maintain and improve our SEO Engine platform and client portal functionality

4. Lawful Basis for Processing

Under the UK General Data Protection Regulation (UK GDPR), we rely on the following lawful bases:

• Consent: For marketing communications and non-essential cookies
• Contract: To deliver services you have engaged us for
• Legitimate interests: For website analytics, fraud prevention, and improving our services for Manchester and UK businesses
• Legal obligation: For tax records and regulatory compliance

5. Third-Party Services

We use the following third-party services that may process your data:

• Google Analytics: Website usage analytics (data may be transferred to the US under Standard Contractual Clauses)
• OpenAI: Powers our AI chatbot assistant. Conversation data is sent to OpenAI's API for processing. OpenAI does not use API data for model training.
• ElevenLabs: Provides voice synthesis for our Voice AI demos. Audio data is processed through their API.
• Cloudflare: CDN and security services. May process IP addresses for DDoS protection and performance optimisation.
• Render: Cloud hosting provider where our application servers are hosted.
• Meta (Facebook/Instagram): Social media integration for clients using our Messenger and Instagram DM features through our marketing platform.
• WhatsApp Business API: For clients using our unified messaging inbox, messages are processed through the WhatsApp Business Platform.
• Klaviyo: Email marketing platform used for client campaigns through our SEO Engine.

6. Messaging and Social Media Data

If you communicate with our clients through WhatsApp Business, Facebook Messenger, or Instagram Direct Messages via our unified messaging inbox:

• Messages are stored securely in our database and are accessible only to the relevant client business and our Manchester-based support team
• We do not sell or share messaging data with third parties for advertising purposes
• Message data is retained for the duration of the client relationship plus 12 months, unless you request earlier deletion
• Each platform's own privacy policy also applies (Meta Privacy Policy, WhatsApp Privacy Policy)

7. Cookies

Our website uses the following types of cookies:

7.1 Essential Cookies

Required for the website to function. These include session cookies, authentication tokens for the client portal, and CSRF protection tokens. Cannot be disabled.

7.2 Analytics Cookies

Google Analytics cookies that help us understand how visitors use our site. These are only set with your consent. They collect anonymous data about page views, session duration, and traffic sources.

7.3 Marketing Cookies

Used to deliver relevant advertisements and track campaign performance. These are only set with your explicit consent and may include Meta Pixel and LinkedIn Insight Tag.

8. Data Retention

We retain personal data for the following periods:

• Contact form enquiries: 24 months from submission, or until you request deletion
• Client project data: Duration of engagement plus 6 years (UK legal requirement for financial records)
• SEO Engine platform data: Duration of subscription plus 12 months
• Analytics data: 26 months (Google Analytics default)
• AI chatbot conversations: 12 months from interaction
• Marketing consent records: Duration of consent plus 3 years

9. Your Rights Under GDPR

Under the UK GDPR, you have the following rights regarding your personal data:

• Right of access: Request a copy of all personal data we hold about you
• Right to rectification: Request correction of inaccurate or incomplete data
• Right to erasure: Request deletion of your personal data (subject to legal retention requirements)
• Right to restrict processing: Request limitation on how we use your data
• Right to data portability: Receive your data in a structured, machine-readable format
• Right to object: Object to processing based on legitimate interests or for direct marketing
• Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time

To exercise any of these rights, email us at privacy@debutwebconsultants.co.uk. We will respond within 30 days.

10. Data Processing for SEO Engine Clients

For clients using our SEO Engine platform, Debut Web Consultants acts as a data processor on your behalf. The specific terms of data processing are outlined in the Data Processing Agreement (DPA) included in your service contract. This covers:

• Processing of your customers' data through connected platforms (Google Analytics, Search Console, social media accounts)
• Storage of API credentials and access tokens for third-party integrations
• Automated reporting and analysis performed on your behalf
• Sub-processor arrangements with our hosting and analytics providers

11. Data Security

We implement appropriate technical and organisational measures to protect your data, including:

• TLS/SSL encryption for all data in transit
• Encrypted storage for sensitive data at rest
• Regular security audits and vulnerability assessments
• Access controls and authentication for all administrative systems
• DDoS protection via Cloudflare

12. International Data Transfers

Some of our third-party service providers are based outside the UK. Where data is transferred internationally, we ensure adequate safeguards are in place through Standard Contractual Clauses (SCCs) or equivalent mechanisms approved by the UK Information Commissioner's Office (ICO).

13. Children's Privacy

Our services are not directed at individuals under 18 years of age. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us immediately.

14. Changes to This Policy

We may update this privacy policy from time to time. Material changes will be communicated via our website and, where appropriate, by email. We encourage you to review this page periodically.

15. Contact and Complaints

If you have questions about this privacy policy or wish to exercise your data rights, contact our Manchester team:

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.