Compliance and data protection

West Country Digital Ltd is registered in England and Wales under company number 17305076.

View on Companies House

West Country Digital Ltd holds business insurance with Hiscox, including:

• £2 million professional indemnity cover
• £5 million public and products liability cover
• £500,000 cyber and data cover

Cover is subject to policy terms, conditions and exclusions. Evidence of cover is available on request.

When we build, host or support a system for you, you stay in control of your data. You are the data controller and we act as your processor. We only use your data to deliver the work you have asked for, and only on your written instructions.

Before any live data is shared, we both sign a data processing agreement. It sets out what data we handle, why we handle it, where it is stored and which providers are involved.

• Encrypted in transit and at rest: Data is encrypted as it moves between devices and our hosting, and when it is stored. Backups are encrypted again before they leave the hosting environment.
• Secure sign-in: Every user has their own account protected by two-factor authentication. Logins are never shared.
• Access only where it is needed: People only see the records their role requires. Our own access is limited to named team members and every sign-in is logged.
• Tested safely: Automated security checks run on every change to the code. We build and test with made-up data, never your real records.
• Backed up and monitored: Databases are backed up every night, and systems alert us to errors and failed jobs.
• A trained team: Everyone who handles client data is bound by confidentiality and trained in data protection.

We host client systems with established cloud providers, keeping data in the UK or EU wherever possible. Your data processing agreement lists every provider used for your project, what each one does and where it is based. We give you at least 14 days’ notice before adding a new provider, so you have the chance to object. Any transfer outside the UK or EU uses the safeguards UK GDPR requires.

AI features are only switched on when you ask for them. Before we enable one, we confirm the provider is set up so your data is not used to train its models and is not kept after processing.

If we become aware of a data breach affecting your data, we will tell you within 48 hours. We then explain what happened, which data is affected and what we are doing about it, and work with you on the next steps.

We securely delete your data or return it to you, whichever you prefer. If the law requires us to keep anything for longer, we tell you what it is, why we need it and when it will be deleted.

You can audit how we handle your data once a year, and we keep records of all processing that we share with you on request. If you are considering working with us, you can ask for a copy of our data processing agreement and a summary of our security measures before signing anything.

Harvey Wood, Co-founder, is responsible for data protection and security. Email harvey@westcountrydigital.com with any question about how we handle data, or to report a possible security issue.

This page covers how we handle client data. For how we use information from this website and call bookings, see our privacy notice.