How Enigmatio Ltd collects, uses and protects personal information when you use enigmat.io or contact us.

Last updated: 3 September 2026

Plain-English summary

We collect only the information we reasonably need to run our website, respond to enquiries, deliver services, manage referrals and send newsletters where you have chosen to subscribe. We do not sell personal data. Optional analytics is controlled through our cookie-consent choices.

1. Who we are

Enigmatio Ltd is a digital agency based in Scotland, United Kingdom. For the purposes of UK data protection law, Enigmatio Ltd is the controller of personal information described in this policy unless we explain otherwise.

You can contact us about privacy or data protection at:

• Email: contact@enigmat.io
• Telephone: 01698 688939
• Location: Glasgow, United Kingdom
• Website: https://enigmat.io/

2. What this policy covers

This policy explains how we handle personal information when you visit our website, contact us, subscribe to our newsletter, take part in our referral programme, apply for a role, or otherwise communicate with Enigmatio through the website.

If you become a client, supplier, contractor or employee, we may also provide or agree additional privacy information where the relationship requires it.

3. Information we may collect
  • Contact and enquiry data – name, email address, telephone number, business name, website address, project details and the contents of your message.
  • Newsletter data – email address, subscription status and information needed to record or manage your consent.
  • Referral programme data – referrer name and contact details; referred person or business name, contact details and any referral notes supplied to us.
  • Client and commercial data – information needed to prepare quotes, contracts, invoices, provide services, support clients and keep business records.
  • Technical and security data – IP address and technical browser/device signals used for security, anti-spam and fraud prevention, including information processed by Cloudflare Turnstile.
  • Analytics data – pages viewed, events, session information, device/browser information, approximate location and similar usage statistics collected through Google Analytics 4 where analytics is enabled.
  • Cookie and consent data – your cookie preferences and, depending on the cookie-consent configuration, records showing the choices you made.
  • Recruitment data – information you provide if you apply for a role, such as your CV, portfolio, contact details and application messages.
4. Where we get personal information from

We usually receive personal information directly from you when you complete a form, email or call us, subscribe to our newsletter, become a client, apply for a role or communicate with us in another way.

We may also receive information about you from another person, for example where an existing client refers you to Enigmatio. Anyone submitting another person’s details through our referral form should make sure that person is happy for their details to be shared with us.

Some technical and analytics information is collected automatically when you use the website, subject to your cookie choices where consent is required.

5. Why we use personal information and our lawful bases
  • Responding to enquiries and discussing potential work – legitimate interests in responding to people who contact us and, where relevant, taking steps at your request before entering into a contract.
  • Providing services, managing projects and client support – performance of a contract and taking steps connected with a contract.
  • Quotes, invoicing, accounting and business administration – contract, legitimate interests in running our business, and legal obligations where applicable.
  • Sending our newsletter and blog updates – consent. You can unsubscribe at any time.
  • Operating the referral programme – Legitimate interests in administering genuine referrals and rewarding existing clients; contract or pre-contract steps may also apply where a referred person becomes a client.
  • Website analytics and improvement – consent where we use optional analytics cookies or similar storage.
  • Protecting forms and the website from spam, bots, abuse and security threats – Legitimate interests in keeping our website, systems and users secure.
  • Recruitment – legitimate interests in assessing applications and, where relevant, taking steps before entering into an employment or contractor relationship.
  • Establishing, exercising or defending legal claims – legitimate interests and legal obligations where applicable.
Your right to object

Where we rely on legitimate interests, you may have the right to object to our use of your personal information. See section 12 below for your rights and how to contact us.

6. Contact forms and enquiries

When you submit a contact or enquiry form, we use the information you provide to read and respond to your message, assess what you need, prepare a quotation where appropriate and keep a reasonable record of our communications.

Our standard WordPress contact-form setup sends submissions to our business email account. We do not intentionally store those submissions in the WordPress database unless we later enable a separate form-storage feature. Email copies may remain in our business email systems for the retention periods described below.

7. Newsletter and marketing emails

If you subscribe to our newsletter, we use your email address to send new blog posts, useful digital advice and occasional Enigmatio updates. We expect to send these messages roughly once every one to two months, although the frequency may vary.

We rely on your consent for newsletter emails. You can withdraw that consent at any time by using the unsubscribe link in an email or contacting us at contact@enigmat.io. Withdrawing consent does not affect processing that was lawful before withdrawal.

We do not automatically add people who submit an enquiry or are referred to us to our marketing list.

8. Analytics, Google Site Kit and Search Console

We use Google Site Kit to connect our WordPress website with selected Google services, including Google Analytics 4 and Google Search Console.

Google Analytics 4 helps us understand how visitors use the website, for example which pages are visited, how people arrive at the site, broad device/browser information and how visitors interact with content. Where analytics storage is enabled, Google Analytics uses first-party cookies such as _ga and _ga_<measurement-id>. Optional analytics is intended to operate only in accordance with the choices made through our cookie-consent controls.

Google states that IP addresses are not logged or stored in Google Analytics 4. Analytics information is retained in line with the data-retention settings configured in our Google Analytics property.

Google Search Console helps us understand how our website appears and performs in Google Search. It is primarily an administrative and reporting service and is not used by us to create advertising profiles of website visitors.

You can find more information about Google’s handling of personal information at https://policies.google.com/privacy.

9. Cloudflare Turnstile

We use Cloudflare Turnstile on website forms to help distinguish genuine visitors from automated traffic and reduce spam and abuse.

Turnstile processes technical signals about the visitor or browser environment that are necessary to provide its security function. Cloudflare states that Turnstile does not access, store or transmit the contents of your form entries or other page inputs. Depending on the Turnstile configuration, Cloudflare may also use short-lived security tokens or, where pre-clearance is enabled, a cf_clearance cookie.

We use this processing because we have a legitimate interest in protecting our website, forms and systems from bots, malicious activity and spam. These security functions may operate independently of optional analytics consent where they are necessary for website security.

Cloudflare Turnstile Privacy Addendum: https://www.cloudflare.com/en-in/turnstile-privacy-policy/

10. Cookie consent and Cookie Compliance

We use Cookie Compliance for WordPress – Cookie Consent, GDPR & CCPA to present cookie choices and manage consent preferences. The tool may store a necessary preference in your browser so that the website can remember the choices you have made.

Where the Cookie Compliance plugin is connected to the Hu-manity.co consent-management platform, the service may process technical information and consent decisions in order to provide banner configuration, consent records and related compliance features. When the banner communicates with Hu-manity.co services, the visitor’s IP address may be visible as part of normal HTTPS network handling.

For more detail about cookies and similar technologies, please read our Cookie Policy.

11. Who we share information with

We may share personal information with trusted suppliers where this is reasonably necessary to operate our website and business. These may include:

  • website hosting and infrastructure providers, including Amazon Web Services (AWS);
  • Google services used for website analytics and search-performance reporting;
  • Cloudflare for Turnstile security and anti-bot protection;
  • Hu-manity.co / Cookie Compliance where connected consent-management features are used;
  • business email, newsletter, cloud-storage, accounting and collaboration providers;
  • professional advisers such as accountants, insurers or legal advisers where necessary; and public authorities or regulators where disclosure is required by law.

We do not sell your personal information.

12. International transfers

Some service providers we use operate internationally, which means personal information may be processed outside the United Kingdom. Where UK data protection law requires safeguards for an international transfer, we expect the relevant provider or arrangement to use an appropriate mechanism, such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, or another lawful safeguard.

13. How long we keep information

We keep personal information only for as long as we reasonably need it for the purpose for which it was collected, including legal, accounting, security and dispute-resolution requirements.

  • General enquiries that do not become client projects – normally kept for up to 24 months after the last meaningful contact, unless there is a reason to keep it longer or you ask us to delete it sooner and no overriding reason applies.
  • Client, contractual and financial records – kept for the duration of the relationship and then for the period reasonably required for accounting, tax, contractual and legal purposes. Certain business records are commonly retained for around six years.
  • Newsletter data – kept while you remain subscribed, plus limited suppression information where necessary to respect an unsubscribe request.
  • Referral programme data – kept for as long as needed to verify, administer and account for the referral and any resulting project or gift card, then retained where reasonably necessary for business or legal records.
  • Recruitment applications – normally retained only for the recruitment process and a reasonable period afterwards, unless we ask for and receive permission to keep details for future roles.
  • Analytics information – Retained according to the settings configured in Google Analytics 4.
  • Security logs – kept for periods proportionate to security, fraud-prevention and troubleshooting needs.
14. Your data protection rights

Depending on the circumstances, UK data protection law may give you rights to:

  • ask for access to the personal information we hold about you;
  • ask us to correct inaccurate or incomplete information;
  • ask us to erase personal information in certain circumstances;
  • ask us to restrict how we use personal information in certain circumstances;
  • object to processing based on legitimate interests or to direct marketing;
  • receive certain information in a portable format where the right to data portability applies;
  • withdraw consent at any time where we rely on consent; and
  • complain to the Information Commissioner’s Office (ICO).

These rights are not absolute and can depend on the lawful basis and circumstances of the processing. We may need to verify your identity before completing a request.

To exercise a right, email contact@enigmat.io. You also have the right to complain to the ICO. Information about complaints and your rights is available at https://ico.org.uk/.

15. Security

We use reasonable technical and organisational measures designed to protect personal information against accidental loss, unauthorised access, misuse, alteration or disclosure. These measures include controlled access to systems, managed hosting, software updates, backups and anti-bot protection. No internet-based service can be guaranteed to be completely secure.

16. Automated decision-making

We do not use the website to make solely automated decisions about individuals that produce legal effects or similarly significant effects.

17. Changes to this policy

We may update this Privacy Policy when our website, services, suppliers or legal obligations change. The latest version will always be published on this page with the date of the most recent update.

18. Contact us

Questions about this policy or our use of personal information can be sent to contact@enigmat.io or raised by telephone on 01698 688939.

 

Request a callback

Let's create something extraordinary together!