Privacy Policy

Solid Digital Marketing Ltd (“Solid DM”, “we”, “us”) is a company registered in England and Wales, company number 09888926. Our registered office is Suite 33 Peel House, 30 The Downs, Altrincham, WA14 2PX. We are registered with the Information Commissioner’s Office (ICO), registration number Z1437832.

This policy explains what personal data we collect, why we collect it, how long we keep it, and the rights you have over it. It covers visitors to soliddm.com, our clients and prospective clients, and the data we process when we build and operate software integrations on behalf of clients, including integrations with TikTok Shop and Shopify.

1. Who we are and how to contact us

We are the data controller for the personal data described in sections 3 and 4. For integration work described in section 5 we act as a data processor on behalf of the client, who is the controller.

Data protection lead: Tom Thorns
Email: [email protected]
Post: Solid Digital Marketing Ltd, Suite 33 Peel House, 30 The Downs, Altrincham, WA14 2PX

2. The data we collect and why

We only collect personal data where we have a lawful basis to do so. We do not sell personal data and we do not use it for automated decision making.

3. Visitors to our website

When you visit soliddm.com we may collect:

• Technical data such as IP address, browser type, device type, pages visited and referring site, collected through server logs and cookieless analytics.
• Any information you choose to send us through a contact form or by email, such as your name, email address, company and message. Our contact form uses Cloudflare Turnstile to check that a person, not a bot, is sending it. Turnstile reads technical signals from your browser and your IP address for that check only. Messages from the form reach us by email through our email delivery provider.

Purpose and lawful basis:

• To run and secure the website. Legitimate interest.
• To understand how the site is used so we can improve it. Legitimate interest. Our analytics do not use cookies and do not track you across other websites.
• To respond to your enquiry. Legitimate interest, or steps taken before entering into a contract.

4. Clients and prospective clients

If you are a client, or you are considering working with us, we hold:

• Contact details: name, job title, company, email address, phone number, postal address.
• Contract and billing information: proposals, agreements, invoices and payment records.
• Correspondence and project records.

Purpose and lawful basis:

• To provide our services and manage the contract. Performance of a contract.
• To invoice and keep accounting records. Legal obligation.
• To keep in touch about work we are doing or could do for you. Legitimate interest. You can ask us to stop at any time.

5. Data we process on behalf of clients

Part of our work involves building and operating software that connects our clients’ systems, for example linking a Shopify store to TikTok Shop. When we do this we act on the client’s instructions as a processor.

What we access depends on the integration and the permissions the client grants. Typically this is product catalogue data such as titles, descriptions, prices, images, stock levels and category attributes. Where an integration handles orders we may also process customer names, delivery addresses and order contents, but only where the client has authorised that scope and it is needed for the service.

We:

• Access only the data needed for the agreed integration and request the narrowest permissions available.
• Process the data only on the client’s documented instructions.
• Store the data in the United Kingdom.
• Keep access limited to named staff who need it, protected by multi-factor authentication.
• Encrypt data at rest and in transit.
• Help the client respond to any request from an individual to access, correct or delete their data.
• Notify the client without undue delay if we become aware of a personal data breach affecting their data.
• Delete or return the data when the integration is switched off or the engagement ends, unless we are legally required to keep it.

If you are a customer of one of our clients and have a question about your data, please contact that business directly. Their privacy policy will explain how they use your data. We will help them respond.

6. Sharing your data

We share personal data only with:

• Service providers who host our systems, provide email, accounting, analytics or similar services, under contracts that require them to protect the data.
• Platforms our clients have asked us to integrate with, such as TikTok Shop and Shopify, to the extent needed to deliver the integration.
• Professional advisers, regulators, or law enforcement where we are legally required to do so.

Where a provider is outside the United Kingdom we make sure appropriate safeguards are in place, such as the UK International Data Transfer Agreement or an adequacy decision.

7. How long we keep data

• Website logs and analytics: up to 26 months.
• Enquiries that do not lead to work: 12 months.
• Client contact, contract and project records: for the length of the engagement and 6 years after it ends, to meet legal and accounting obligations.
• Data processed on behalf of clients: for the length of the integration, then deleted within 30 days of the integration ending or access being revoked.

8. Security

We take appropriate technical and organisational measures to protect personal data, including full disk encryption on company devices, encrypted connections, multi-factor authentication on all business accounts, least-privilege access, automatic security updates, and a documented incident response procedure. Our internal Information Security and Data Protection Policy is reviewed at least once a year.

9. Your rights

Under UK data protection law you have the right to:

• Ask for a copy of the personal data we hold about you.
• Ask us to correct data that is wrong or incomplete.
• Ask us to delete your data, where there is no good reason for us to keep it.
• Ask us to restrict how we use your data.
• Object to us using your data where we rely on legitimate interest.
• Receive your data in a portable format.
• Withdraw consent at any time where consent is our lawful basis.

To exercise any of these rights, email [email protected]. We will respond within one month. We may need to confirm your identity first.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. We would appreciate the chance to resolve your concern first.

10. Cookies

Our website does not use analytics or advertising cookies. We measure site usage with Cloudflare Web Analytics, which works without cookies, does not fingerprint your device and does not track you across other websites. Any cookie that is set is strictly necessary for security or for the site to work, and does not require your consent. If we introduce any other cookies in future we will ask for your consent first and update this policy.

11. Changes to this policy

We may update this policy from time to time. The date at the top shows when it was last changed. Significant changes will be highlighted on this page.