How Enigmatio Ltd collects, uses and protects personal information when you use enigmat.io or contact us.

Last updated: 28 October 2026

Plain-English summary

We collect only the information we reasonably need to run our website, respond to enquiries, deliver services, manage referrals and send newsletters where you have chosen to subscribe. We do not sell personal data. Optional analytics is controlled through our cookie-consent choices.

1. Who we are

Enigmatio Ltd is a digital agency based in Scotland, United Kingdom. For the purposes of UK data protection law, Enigmatio Ltd is the controller of personal information described in this policy unless we explain otherwise.

You can contact us about privacy or data protection at:

• Email: contact@enigmat.io
• Telephone: 01698 688939
• Location: Glasgow, United Kingdom
• Website: https://enigmat.io/

2. What this policy covers

This policy explains how we handle personal information when you visit our website, contact us, subscribe to our newsletter, take part in our referral programme, apply for a role, or otherwise communicate with Enigmatio through the website.

If you become a client, supplier, contractor or employee, we may also provide or agree additional privacy information where the relationship requires it.

3. Information we may collect
  • Contact and enquiry data – name, email address, telephone number, business name, website address, project details and the contents of your message.
  • Newsletter data – email address, subscription status and information needed to record or manage your consent.
  • Referral programme data – referrer name and contact details; referred person or business name, contact details and any referral notes supplied to us.
  • Client and commercial data – information needed to prepare quotes, contracts, invoices, provide services, support clients and keep business records.
  • Technical and security data – IP address and technical browser/device signals used for security, anti-spam and fraud prevention, including information processed by Cloudflare Turnstile.
  • Analytics data – pages viewed, events, session information, device/browser information, approximate location and similar usage statistics collected through Google Analytics 4 where analytics is enabled.
  • Cookie and consent data – your cookie preferences and, depending on the cookie-consent configuration, records showing the choices you made.
  • Recruitment data – information you provide if you apply for a role, such as your CV, portfolio, contact details and application messages.
4. Where we get personal information from

We usually receive personal information directly from you when you complete a form, email or call us, subscribe to our newsletter, become a client, apply for a role or communicate with us in another way.

We may also receive information about you from another person, for example where an existing client refers you to Enigmatio. Anyone submitting another person’s details through our referral form should make sure that person is happy for their details to be shared with us.

Some technical and analytics information is collected automatically when you use the website, subject to your cookie choices where consent is required.

5. Why we use personal information and our lawful bases
  • Responding to enquiries and discussing potential work – legitimate interests in responding to people who contact us and, where relevant, taking steps at your request before entering into a contract.
  • Providing services, managing projects and client support – performance of a contract and taking steps connected with a contract.
  • Quotes, invoicing, accounting and business administration – contract, legitimate interests in running our business, and legal obligations where applicable.
  • Sending our newsletter and blog updates – consent. You can unsubscribe at any time.
  • Operating the referral programme – Legitimate interests in administering genuine referrals and rewarding existing clients; contract or pre-contract steps may also apply where a referred person becomes a client.
  • Website analytics and improvement – consent where we use optional analytics cookies or similar storage.
  • Protecting forms and the website from spam, bots, abuse and security threats – Legitimate interests in keeping our website, systems and users secure.
  • Recruitment – legitimate interests in assessing applications and, where relevant, taking steps before entering into an employment or contractor relationship.
  • Establishing, exercising or defending legal claims – legitimate interests and legal obligations where applicable.
Your right to object

Where we rely on legitimate interests, you may have the right to object to our use of your personal information. See section 14 below for your rights and how to contact us.

6. Contact forms and enquiries

When you submit a contact, project, referral or job application form, we use the information you provide to read and respond to your request, assess what you need and keep a reasonable record of our communications.

Form notifications are sent to contact@enigmat.io. We also send an acknowledgement to the email address you provide. Acknowledgements confirm receipt and do not add you to our newsletter.

Our website uses Post SMTP and Amazon Web Services Simple Email Service (AWS SES) to deliver these emails. Delivery logs stored in our WordPress database can include recipients, message contents and delivery information for troubleshooting. Email copies can also remain in our business email systems. See section 13 for retention information.

7. Newsletter and marketing emails

If you subscribe to our newsletter, we use your email address to send new blog posts, useful digital advice and occasional Enigmatio updates. We expect to send these messages roughly once every one to two months, although the frequency may vary.

We rely on your consent for newsletter emails. You can withdraw that consent at any time by using the unsubscribe link in an email or contacting us at contact@enigmat.io. Withdrawing consent does not affect processing that was lawful before withdrawal.

We do not automatically add people who submit an enquiry or are referred to us to our marketing list.

Where we provide newsletter subscriptions, we use MailerLite to manage subscriptions and deliver newsletter emails. Optional newsletter scripts are controlled through the Marketing category in our cookie settings. Submitting an enquiry or accepting cookies does not subscribe you to the newsletter.

8. Analytics, Google Site Kit and Search Console

We use Google Site Kit to connect our WordPress website with Google Search Console. Site Kit can also connect Google Analytics 4, where analytics is enabled.

Google Analytics 4 helps us understand how visitors use the website, for example which pages are visited, how people arrive at the site, broad device/browser information and how visitors interact with content. Where analytics storage is enabled, Google Analytics uses first-party cookies such as _ga and _ga_<measurement-id>. Optional analytics is intended to operate only in accordance with the choices made through our cookie-consent controls.

Google states that IP addresses are not logged or stored in Google Analytics 4. Analytics information is retained in line with the data-retention settings configured in our Google Analytics property.

Google Search Console helps us understand how our website appears and performs in Google Search. It is primarily an administrative and reporting service and is not used by us to create advertising profiles of website visitors.

You can find more information about Google’s handling of personal information at https://policies.google.com/privacy.

Website fonts: our website currently loads Google Fonts to display its typography. Your browser requests these font files from Google, which receives technical connection information, including your IP address. Font loading is separate from Google Analytics and can take place when optional cookies are rejected. More information is available in Google’s Privacy Policy.

9. Invisible Cloudflare Turnstile

We use Cloudflare Turnstile in invisible mode on our forms to help prevent spam and automated abuse. Verification runs in the background without a visible widget or puzzle.

Your browser connects to Cloudflare and provides technical signals, such as your IP address, browser information and connection characteristics. Cloudflare uses these signals to protect our forms and improve its bot-detection technology. Turnstile itself does not collect the contents of the fields you type into our forms.

We rely on our legitimate interest in protecting our website, systems and users for this security processing. Turnstile can run when optional cookies are rejected because it protects form submissions, rather than providing optional analytics or marketing.

For details of Cloudflare’s processing, please read the Cloudflare Turnstile Privacy Addendum and Cloudflare Privacy Policy.

10. Cookie consent and Complianz

We use Complianz to display cookie choices and remember your consent preferences. Its necessary preference cookies record which optional categories you allow and the policy version associated with your choice.

You can accept all optional categories, reject optional cookies or choose individual categories. You can change or withdraw your choice using the Cookie settings control on the website or the controls in our Cookie Policy. Necessary site and form-security functions remain available when optional categories are rejected.

Choosing a cookie category does not subscribe you to marketing emails. Newsletter subscriptions require a separate request.

11. Who we share information with

We may share personal information with trusted suppliers where this is reasonably necessary to operate our website and business. These may include:

  • website hosting and infrastructure providers, including Amazon Web Services (AWS);
  • Google services used for website fonts, optional analytics and search-performance reporting;
  • Cloudflare for Turnstile security and anti-bot protection;
  • Complianz for cookie-consent functionality, and MailerLite where newsletter services are used;
  • business email, newsletter, cloud-storage, accounting and collaboration providers;
  • professional advisers such as accountants, insurers or legal advisers where necessary; and public authorities or regulators where disclosure is required by law.

We do not sell your personal information.

12. International transfers

Some service providers we use operate internationally, which means personal information may be processed outside the United Kingdom. Where UK data protection law requires safeguards for an international transfer, we expect the relevant provider or arrangement to use an appropriate mechanism, such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, or another lawful safeguard.

13. How long we keep information

We keep personal information only for as long as we reasonably need it for the purpose for which it was collected, including legal, accounting, security and dispute-resolution requirements.

  • General enquiries that do not become client projects – normally kept for up to 24 months after the last meaningful contact, unless there is a reason to keep it longer or you ask us to delete it sooner and no overriding reason applies.
  • Client, contractual and financial records – kept for the duration of the relationship and then for the period reasonably required for accounting, tax, contractual and legal purposes. Certain business records are commonly retained for around six years.
  • Newsletter data – kept while you remain subscribed, plus limited suppression information where necessary to respect an unsubscribe request.
  • Referral programme data – kept for as long as needed to verify, administer and account for the referral and any resulting project or gift card, then retained where reasonably necessary for business or legal records.
  • Recruitment applications – normally retained only for the recruitment process and a reasonable period afterwards, unless we ask for and receive permission to keep details for future roles.
  • Analytics information – Retained according to the settings configured in Google Analytics 4.
  • Email delivery logs – our website currently keeps a rolling maximum of 999 delivery-log entries. These may contain message copies and are replaced as the entry limit is reached or deleted for operational purposes; they do not have a separate automatic expiry measured in days.
  • Security logs – kept for periods proportionate to security, fraud-prevention and troubleshooting needs.
14. Your data protection rights

Depending on the circumstances, UK data protection law may give you rights to:

  • ask for access to the personal information we hold about you;
  • ask us to correct inaccurate or incomplete information;
  • ask us to erase personal information in certain circumstances;
  • ask us to restrict how we use personal information in certain circumstances;
  • object to processing based on legitimate interests or to direct marketing;
  • receive certain information in a portable format where the right to data portability applies;
  • withdraw consent at any time where we rely on consent; and
  • complain to the Information Commissioner’s Office (ICO).

These rights are not absolute and can depend on the lawful basis and circumstances of the processing. We may need to verify your identity before completing a request.

To exercise a right, email contact@enigmat.io. You also have the right to complain to the ICO. Information about complaints and your rights is available at https://ico.org.uk/.

15. Security

We use reasonable technical and organisational measures designed to protect personal information against accidental loss, unauthorised access, misuse, alteration or disclosure. These measures include controlled access to systems, managed hosting, software updates, backups and anti-bot protection. No internet-based service can be guaranteed to be completely secure.

16. Automated decision-making

We do not use the website to make solely automated decisions about individuals that produce legal effects or similarly significant effects.

17. Changes to this policy

We may update this Privacy Policy when our website, services, suppliers or legal obligations change. The latest version will always be published on this page with the date of the most recent update.

18. Contact us

Questions about this policy or our use of personal information can be sent to contact@enigmat.io or raised by telephone on 01698 688939.

 

Request a callback

Let's create something extraordinary together!