Data Controller Identity & Corporate Scope
This Privacy Policy governs the collection, processing, and protection of personal data by DigiWebFX ("DigiWebFX", "we", "us", or "our"), an international digital marketing, web engineering, and technical search agency operating across the United States, United Kingdom, European Union, United Arab Emirates (GCC), Australia, and India.
When you visit our website (digiwebfx.com), engage our engineering teams for web or software development, submit URLs for technical SEO & speed autopsies, or communicate with our strategy consultants, DigiWebFX serves as the Data Controller under applicable global privacy legislation.
Categories of Information We Collect
We strictly adhere to data minimization principles (GDPR Article 5(1)(c)). We only collect data that is strictly necessary to evaluate, architect, execute, and deliver client digital solutions:
| Data Category | Specific Data Points | Purpose & Business Utility |
|---|---|---|
| Inquiry & Contact Data | Full name, corporate email, verified phone/WhatsApp number, company name, industry sector. | Scheduling strategy calls, delivering proposal scopes, preparing commercial NDA contracts. |
| Diagnostic & Audit Data | Submitted website URLs, public robots.txt, sitemaps, Core Web Vitals, server response headers. | Generating simulated speed autopsies, schema diagnostics, and competitor keyword gap roadmaps. |
| Client Staging & Access | Staging CMS credentials, Google Search Console tokens, GA4 property IDs, Git repository access. | Custom theme engineering, server-side CAPI deployment, speed optimization, and migration execution. |
| Technical Telemetry | Anonymized IP hash, browser type, viewport resolution, localized region preference. | Zero-cookie server routing, network load balancing, security firewall protection (DDoS mitigation). |
Lawful Basis for Processing (GDPR Article 6)
Under international statutory frameworks, we process personal information strictly pursuant to legitimate lawful bases:
-
Contractual Performance (Art. 6(1)(b)): To formulate statements of work (SOWs), configure staging environments, deliver bespoke code, and fulfill retainer milestones.
-
Legitimate Interests (Art. 6(1)(f)): To prevent fraudulent inquiries, protect staging servers from brute-force penetration, and optimize platform latency.
-
Legal Obligation (Art. 6(1)(c)): Maintaining financial transaction ledgers, invoicing compliance across IRS, HMRC, FTA UAE, and GST India statutory tax codes.
-
Explicit Consent (Art. 6(1)(a)): Opt-in communications via WhatsApp Business or direct email notifications, revocable at any moment with 1 click.
Client Staging Environments & Repository Security
During the design and engineering phases of any web or software project, DigiWebFX operates on isolated, password-protected staging sandboxes. All source code is hosted on private, SOC2-compliant Git repositories (GitHub/Bitbucket) with mandatory Two-Factor Authentication (2FA) across all development workstations.
Non-Disclosure & Code Ownership Assurance
Every client engagement is covered by our comprehensive Mutual Non-Disclosure Agreement (NDA). We never reuse proprietary algorithms, internal database schemas, or customer contact records across client builds.
Approved Sub-Processors & Infrastructure
We do not sell client data. To deliver enterprise-grade availability and security, we partner exclusively with verified Tier-1 infrastructure sub-processors who adhere to Data Processing Agreements (DPAs):
-
Cloudflare Inc. (USA/Global): Enterprise DNS routing, DDoS mitigation, Web Application Firewall (WAF), and SSL edge termination.
-
Amazon Web Services / Google Cloud: ISO 27001 and SOC 2 Type II certified data center infrastructure for staging workloads.
-
Postorie Verified Partner Network: Reputation verification and B2B vendor accreditation monitoring.
-
WhatsApp Business API (Meta Platforms Ireland Ltd.): Direct encrypted instant messaging for real-time strategy consultations.
International Data Transfers (Cross-Border Compliance)
As a global digital agency, personal and project data may be securely transferred between our delivery centers in India and client locations in the United States, United Kingdom, European Economic Area (EEA), United Arab Emirates, and Australia.
All international transfers from the EEA or UK are governed by the European Commission Standard Contractual Clauses (SCCs) (Module 1 and Module 2) and the UK International Data Transfer Addendum (IDTA), ensuring an equivalent standard of protection regardless of physical geographic territory.
Data Retention & Erasure Protocols
We retain personal and business records only for as long as strictly necessary to fulfill contractual deliverables or statutory legal requirements:
-
Pre-Contract Proposals & Audit URLs: Retained for 180 days, then permanently purged from crawler caches unless an active engagement begins.
-
Staging Database Credentials: Purged and rotated within 14 business days following production launch and sign-off.
-
Invoicing & Tax Records: Retained for 7 statutory tax fiscal years in compliance with HMRC, IRS, and Indian tax law.
Your Statutory Privacy Rights (GDPR, CCPA/CPRA, UAE PDPL)
Regardless of geographic location, DigiWebFX grants all clients and site visitors comprehensive statutory rights:
-
Right to Access & Portability: Request a copy of all personal and project data processed by us in a structured, machine-readable format (JSON/CSV).
-
Right to Erasure ("Right to be Forgotten"): Request the total permanent deletion of your business contact data and staging records.
-
Right to Rectification: Correct any inaccurate or obsolete billing, contact, or technical records.
-
CCPA/CPRA Non-Discrimination: We never deny services, charge differentiated pricing, or degrade engineering quality if you exercise statutory rights.
Technical & Organizational Security Safeguards
DigiWebFX deploys multi-layered defense-in-depth protocols to prevent unauthorized access, alteration, or disclosure of confidential business assets:
-
Immutable Git History: All custom code commits are cryptographically signed (GPG) and audited.
-
Zero Third-Party Ad Pixels on Staging: Staging servers block all advertising trackers, keeping new client features completely confidential.
-
Strict Role-Based Access Control (RBAC): Engineering staff are provisioned access on a strict principle-of-least-privilege basis.
Data Protection Officer (DPO) & Supervisory Contact
For inquiries regarding this Privacy Policy, statutory compliance submissions, or international data protection inquiries, contact our Data Protection Office directly:
DigiWebFX Legal & Data Governance Office
Direct executive oversight for GDPR, CCPA, UAE PDPL, and international regulatory inquiries.