Privacy Policy

ARLT LTD (“we”, “us”) is a web design and digital services studio operating across Scotland. For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018), we are the data controller for personal data collected through this website.

Registered office: ARLT LTD, 35 Ruthven Place, St Andrews, Fife, KY16 8SJ. Company number: SC900600.

Contact: info@arltdigital.com. If you have any questions about how we handle your personal data, please contact us via that address first. You may also contact the UK data protection authority, the Information Commissioner’s Office (ico.org.uk).

Contact form and enquiry data: your full name, business name, email address, sector and mobile number, together with any information you choose to provide. We use these to respond to your enquiry, prepare a proposal and, where you have consented, contact you about our services. Enquiries are delivered to us by email via a transactional email provider; where that delivery is unavailable, they may be stored briefly on our hosting infrastructure (organised by date) as a backup until processed.

Communication records: emails, WhatsApp messages, call notes and other correspondence exchanged with you, used to manage our relationship and provide services. To help us prepare proposals, respond efficiently and manage client relationships, we may use AI-assisted tools to organise and draft communications for these purposes.

Technical data: pages visited, device type and anonymous usage information. We use Plausible Analytics on this site, which is privacy-friendly and cookie-free by default; it is loaded only where you have given consent, and we do not use this technical data to identify you personally.

Responding to enquiries and preparing proposals — legitimate interests (to operate our business and respond to prospective clients).

Delivering retainers and support under our Client Services Agreement — performance of a contract.

Sending you updates about our services — your consent, given via the tick box on our contact form. You may withdraw consent at any time by contacting us or by unsubscribing, and we will stop sending marketing materials.

Cookie and analytics preferences — your consent, which you can change at any time through our cookie banner.

Essential cookies are required for the operation of this site and do not require consent. Optional analytics are provided by Plausible Analytics, which by default runs without setting any cookies and does not collect personal or identifiable data; it is loaded only after you select “Accept all”. You can change your decision at any time by clearing this site’s cookies in your browser or reselecting your preference on the cookie banner.

We never sell personal data. Enquiry submissions are delivered to us by email through our transactional email provider (Resend) and held in our inbox. They may also be stored on our own hosting infrastructure as a backup while unprocessed. We share data with processors acting on our instructions, such as our hosting provider, our email provider, our website analytics provider (Plausible Analytics), the communication tools and the AI providers we use to support client work and relationship management. Each processor is bound by a data processing agreement in line with Article 28 UK GDPR, and we use them only to the extent necessary for the purposes described in this policy.

Where data is transferred outside the UK, we rely on appropriate safeguards, including the UK International Data Transfer Addendum (“IDTA”) and Standard Contractual Clauses. A copy is available on request. Where the name of a specific AI provider is needed for your own assessment, we can confirm it on request.

We use AI-assisted tools to help develop client work and to support the management of client relationships — for example, drafting proposals, drafting or summarising communications, producing code, design assets and marketing copy, and organising client information.

Where client personal data is involved, we only send the minimum necessary to get the task done and do not use client data to train third-party models used for our benefit unless the provider applicable terms and your rights allow it. You can ask us, at any time and free of charge, to confirm which AI tools we use and how your data is handled by them.

No AI system is used to make automated decisions about you that have legal or similarly significant effects. A person always reviews and approves any decision affecting your enquiry or our working relationship.

Some of our platform providers and AI tools are based in the United States or other countries outside the UK, or route data through servers outside the UK. Where their servers are located outside the UK, we ensure that a valid transfer mechanism under UK GDPR (including the UK International Data Transfer Addendum and, where applicable, Standard Contractual Clauses) is in place before any personal data is transferred, and we keep the relevant documentation on request.

Enquiry records are kept for up to 24 months unless a client relationship follows, in which case records are retained for the duration of the engagement plus six years, in line with normal accounting and business practice.

Under the UK GDPR you have the right to access, rectify, erase, restrict and object to the processing of your personal data, the right to data portability, and the right to withdraw consent at any time.

To exercise any right, email info@arltdigital.com. If you are not satisfied with our response, you may complain to the Information Commissioner’s Office (ico.org.uk).

We do not use automated decision-making, including profiling, that produces legal or similarly significant effects concerning you. Where AI tools are used, any decision about your enquiry or our services is always reviewed and confirmed by a human before it is made.

This site is served over HTTPS on managed hosting. Access to source code, hosting and customer data is restricted to authorised personnel on a least-privilege basis, and we take reasonable technical and organisational measures appropriate to the risk.