1. Who We Are & The Data Controller
For the purposes of the UK GDPR and the Data Protection Act 2018, the commercial enterprise responsible for the processing of your personal data on this website operates under the trading name Emin Deniz UK (referred to as "we", "us", or "our" in this notice).
Authoritative Contact Information:
Trading Name: Emin Deniz UK
Primary Domain: https://emindeniz.uk/
Designated Privacy & Data Requests Email: bymrdeniz@gmail.com
Corporate Structure Transparency Note: Formal corporate incorporation registration details, statutory company registration number (CRN), registered office address, and statutory registration numbers are currently subject to administrative confirmation. All data protection and subject access requests are handled directly by agency leadership at the confirmed email address above.
2. Scope of this Notice
This Notice applies exclusively to personal data collected through:
- The public marketing website hosted at
https://emindeniz.uk; - Our general commercial enquiry forms (located at /contact);
- Our 7-Day Performance Marketing Trial application form (located at /trial);
- Direct email communications initiated via bymrdeniz@gmail.com.
This notice does not govern third-party websites or external platforms (such as Google Ads, Meta Ads Manager, or LinkedIn) to which our website may link or with which clients may maintain independent contractual arrangements.
3. Personal Information We Collect
In accordance with the principle of Data Minimisation (UK GDPR Article 5(1)(c)), we collect only the personal information strictly necessary to communicate with you, evaluate your digital marketing requirements, and deliver requested services.
| Processing Activity | Specific Data Fields Collected | Collection Point |
|---|---|---|
| General Inquiries | Full Name, Business Email Address, Business Name (optional), Service Interest, Message Outline. | /contact Form |
| 7-Day Trial Applications | Full Name, Business Email Address, Business Name, Website URL, Service Interest (Meta/Google Ads), Current Advertising Status, Target UK Locations, Growth Goals. | /trial Form |
| Security & Abuse Defense | Internet Protocol (IP) address, Browser User-Agent, submission timestamp, cryptographic CSRF token. | Automated Server Logs & Audit Tables |
| Cookie Consent Preferences | First-party consent status token (Necessary: true; Analytics: boolean; Marketing: boolean; Timestamp). | Consent Banner / Preference Modal |
4. Lawful Bases for Processing (UK GDPR Article 6)
Under UK data protection law, we must establish a valid lawful basis for every processing activity:
A. Taking Steps Prior to Entering into a Contract (Article 6(1)(b))
When you submit an enquiry or apply for our 7-Day Performance Marketing Trial, processing your contact information, website URL, and advertising requirements is necessary to evaluate your eligibility, conduct preliminary feasibility audits, and prepare bespoke commercial proposals.
B. Legitimate Interests (Article 6(1)(f))
We process technical connection logs (IP addresses, user agents) and security audit events where necessary for our legitimate interests in protecting our web application against automated spam, denial-of-service attempts, cross-site request forgery (CSRF), and unauthorized administrative access. We also rely on legitimate interests to maintain commercial communication records with UK B2B prospects.
C. Consent (Article 6(1)(a) & PECR Regulation 6)
Where optional non-essential technologies (such as Google Analytics 4 performance measurement or advertising attribution tags) are deployed, we strictly require and record your prior affirmative consent before setting cookies or accessing device storage. You retain the absolute right to refuse or withdraw consent at any time without affecting your access to our website.
D. Legal Obligation (Article 6(1)(c))
Where commercial engagements proceed, we retain business transaction records, signed client agreements, and invoices as required to comply with UK statutory accounting, tax (HMRC), and corporate legal obligations.
5. Third-Party Recipients & Data Processors
We do not sell, rent, trade, or commercially monetize personal data. We disclose personal information only to trusted technical service providers who assist in operating our website, subject to strict confidentiality and data protection obligations:
- Web Hosting Infrastructure: cPanel Linux hosting environment operating on secure UK/EU server nodes with isolated filesystem permissions and daily backups.
- Transactional Email Transport: Outbound transactional notification emails (such as enquiry acknowledgements and admin notifications) are transmitted via authenticated SMTP (cPanel Exim / Google Workspace).
- Analytics & Measurement (Subject to Consent): If and when enabled with genuine property identifiers, Google Analytics 4 (Google Ireland Limited / Google LLC) processes pseudonymous page interaction telemetry under strict Google Consent Mode v2 controls. No personally identifying form data is ever transmitted to Google.
- Legal & Regulatory Authorities: We may disclose information if required to do so by applicable UK law, court order, or governmental regulation.
6. International Data Transfers
Our core application backend, database stores, and web servers are hosted within the United Kingdom and the European Economic Area (EEA).
Where third-party service providers (such as Google LLC for mail transport or analytics) process data in countries outside the UK or EEA that may not have an adequacy regulation under UK law, transfers are governed by UK-approved transfer safeguards, including the UK International Data Transfer Addendum to the European Commission's Standard Contractual Clauses (SCCs), or the UK-US Data Bridge (Extension to the EU-US Data Privacy Framework) where certified.
7. Data Retention & Storage Limitation
In accordance with UK GDPR Article 5(1)(e), personal data is retained only for the duration necessary to satisfy the commercial and operational purposes for which it was gathered:
- Unconverted Commercial Enquiries: Retained for a maximum of 24 months from the date of last communication to allow follow-up regarding requested marketing services, after which records are purged.
- 7-Day Trial Applications: Retained for 12 to 24 months following audit evaluation to maintain historical records of qualification reviews.
- Contracted Client Accounts: Retained for the active duration of the commercial engagement plus 6 years following contract termination, in compliance with UK statutory limitation periods and tax reporting requirements.
- System Security & Audit Logs: Maintained on a rolling 12-month window to ensure security oversight and incident forensic capabilities.
- Consent Records: Retained for 180 days within your browser's first-party cookie before requiring renewed preference confirmation.
8. Your Data Subject Rights
Under Chapter III of the UK GDPR and the Data Protection Act 2018, you possess comprehensive legal rights concerning your personal data:
Request confirmation of whether we hold your personal data and obtain a copy of that data free of charge.
Require us to update, complete, or correct any inaccurate or incomplete personal details.
Request deletion of your data when it is no longer required for the purpose for which it was collected.
Request that we limit processing of your personal data under specific statutory circumstances.
Object to processing based on legitimate interests or direct commercial communications.
Withdraw your consent for non-essential cookies or marketing at any time via our Cookie Preferences control.
To exercise any of these rights, please email our data governance lead at bymrdeniz@gmail.com. We respond to all verified requests within one calendar month in accordance with statutory requirements.
9. Security & Technical Safeguards
We employ robust technical and organizational security controls designed to prevent accidental loss, unauthorized access, alteration, or disclosure of personal data:
- Transport Layer Security (TLS/HTTPS): All data transmitted between your browser and our web application is encrypted using modern TLS 1.3/1.2 protocols;
- SQL Injection Immunity: Database operations strictly utilise parameterised PDO prepared statements across both MySQL and SQLite drivers;
- Cryptographic Token Protection: All form submissions are protected by synchronizer anti-CSRF tokens to eliminate forgery attacks;
- Access Controls: Administrative access is restricted to verified personnel with strong passwords hashed via
PASSWORD_DEFAULT(bcrypt/Argon2id) and session-based rate limiting; - Media Sanitisation: Uploaded assets are strictly vetted for binary MIME type compliance and stored outside executable execution paths.
10. Complaints to the Information Commissioner's Office (ICO)
If you have concerns about our data protection practices, we encourage you to contact us directly at bymrdeniz@gmail.com so we can address your inquiry promptly.
You also have the statutory right to lodge a complaint with the UK supervisory authority for data protection:
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline: 0303 123 1113
Official Website: https://ico.org.uk/
11. Updates to this Notice
We may update this Privacy Notice periodically to reflect changes in our operational practices, technical capabilities, or applicable UK legislation. Any revisions will be published on this page with an updated version number and effective date.