Privacy Policy

Last updated: 6 October 2026 · Applies to visitors and business contacts using igbooster.digital

This Privacy Policy explains how IGBOOSTER LTD ("we", "us", "our"), a business-to-business marketing research and advertising agency based in the United Kingdom, collects, uses, stores, and protects personal data when you visit our website, submit enquiries through our contact form, correspond with us by email or telephone, or otherwise interact with us in a professional capacity. We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR) as incorporated into UK law by the Data Protection Act 2018, and with the Privacy and Electronic Communications Regulations (PECR) where relevant to electronic communications.

This document is provided for transparency and does not constitute legal advice. If you require interpretation of your rights or our obligations in a specific situation, you should consult an independent adviser. We aim to describe our practices plainly while retaining the precision needed for regulatory compliance.

1. Data controller and contact details

The data controller responsible for personal data described in this Privacy Policy is IGBOOSTER LTD, registered office and principal place of business at 280 King Street, London, W6 0SP United Kingdom.

For privacy-related enquiries, requests to exercise data subject rights, or complaints about our handling of personal data, contact us at devops@igbooster.digital or +44 7400 382910. Postal correspondence may be sent to the address above, marked for the attention of Data Protection.

When we act as a processor on behalf of a client under a separate contract—for example, when conducting market research interviews or handling campaign data strictly under client instructions—that processing is governed by the client’s privacy notice and our contractual data processing terms. This Privacy Policy primarily addresses processing for which we determine purposes and means as controller.

2. Scope and audience

This Privacy Policy applies to personal data relating to identifiable individuals who interact with our public website, submit business enquiries, attend meetings we arrange, receive proposals, or communicate with us about potential or ongoing agency services. Our services are directed at organisations and professional buyers; we do not knowingly offer consumer-facing products through this website.

It does not apply to third-party websites linked from our pages, to social platforms operated by others, or to processing undertaken entirely under a signed client agreement where we act only as processor. In those cases, the relevant party’s documentation and contract terms prevail.

2.1 Website visitors

When you browse our site without submitting the contact form, we may process a limited set of technical data necessary to deliver pages securely and to maintain basic functionality, as described in the sections on cookies and server logs.

2.2 Business contacts and prospects

If you complete our contact form or email us, we process identity and contact details, your organisation name, and the content of your message so we can respond, qualify enquiries, and—where appropriate—prepare commercial proposals for marketing research, public relations, or strategic brand advertising work.

2.3 Client personnel

If your organisation engages us, we may process personal data of your employees, contractors, or authorised representatives for project delivery, invoicing, and account management. Much of that processing is contractual and may also be documented in our Terms and Conditions or a statement of work.

3. Categories of personal data we collect

We collect only personal data that is adequate, relevant, and limited to what is necessary for the purposes set out in this policy. The categories below are indicative; not every category applies to every individual.

3.1 Identity and contact data

Name, job title, business email address, business telephone number, organisation name, and postal address where you provide it. We obtain this data directly from you via the contact form, email, telephone calls you initiate, or meeting arrangements.

3.2 Enquiry and correspondence content

The substance of messages you send, attachments you choose to share, and notes we make in good faith to record professional discussions. Please avoid sending special category data (such as health information) unless strictly necessary and agreed in writing; our contact form is not designed for sensitive disclosures.

3.3 Technical and usage data

Internet protocol (IP) address, browser type and version, device type, operating system, referring URL, pages viewed, and timestamps. This data may be collected through essential cookies and standard server logging required to operate the website. We do not describe use of invasive tracking beyond what is needed for security, load balancing, and core site function unless we later update this policy and, where required, obtain consent.

3.4 Cookie-related identifiers

Where cookies or similar technologies store identifiers on your device, those identifiers may constitute personal data when linked to you. Our Cookie Policy explains categories, purposes, and retention in more detail.

3.5 Data we do not intentionally collect via the public website

We do not operate a client login area on the public site as described in this policy, do not run public recruitment forms here, and do not request payment card data through the contact form. Financial details for contracted work are handled through separate invoicing arrangements agreed with clients.

4. Sources of personal data

Personal data comes from the following sources:

Directly from you when you submit the contact form, email, call, or meet with us.
From your organisation when it appoints us and designates contact persons for projects.
From publicly available professional sources (for example, corporate websites or business directories) where we verify business contact details for B2B outreach that complies with PECR and UK GDPR.
From our hosting and infrastructure providers in the form of server logs and security records.

We do not purchase consumer marketing lists for this website’s operations. Any prospecting we conduct is oriented toward business audiences and is balanced against privacy expectations and legal requirements.

5. Purposes and lawful bases for processing

Under UK GDPR, we must identify a lawful basis for each processing activity. We rely on one or more of the bases below. Where multiple bases could apply, we document our primary basis internally.

5.1 Responding to enquiries (contact form and email)

Purpose: to read, assess, and reply to your message; to schedule calls; to determine whether we can assist with market research, PR, or advertising mandates; to maintain records of pre-contract discussions. Lawful basis: legitimate interests (Article 6(1)(f)) in operating a professional services business and communicating with prospective clients, balanced against your rights; where your message explicitly requests a proposal, steps prior to entering a contract (Article 6(1)(b)) may also apply.

5.2 Performing client contracts

Purpose: delivering agreed research, creative, media, and advisory services; project management; quality assurance; billing and account administration. Lawful basis: performance of a contract (Article 6(1)(b)) and, where necessary, legitimate interests in administering commercial relationships.

5.3 Website operation, security, and essential cookies

Purpose: serving web pages, remembering essential preferences, protecting against abuse, diagnosing technical faults. Lawful basis: legitimate interests in secure, reliable website operation; for strictly necessary cookies, consent may not be required under PECR, as explained in our Cookie Policy.

5.4 Legal and regulatory compliance

Purpose: complying with tax and accounting obligations, responding to lawful requests from authorities, establishing or defending legal claims. Lawful basis: compliance with legal obligation (Article 6(1)(c)) and legitimate interests in the administration of justice.

5.5 B2B marketing communications

Purpose: sending relevant information about our agency capabilities to business contacts who expect professional communications, where permitted. Lawful basis: legitimate interests or, where PECR requires consent for certain electronic marketing, your opt-in. You may opt out at any time using instructions in the message or by contacting us.

6. How we use personal data in practice

We use personal data only for purposes compatible with those for which it was collected, unless law requires otherwise or you have been informed of a new purpose.

Assigning enquiries to the appropriate practice lead for research, PR, or brand advertising.
Preparing non-binding proposals, scopes, and timelines subject to separate contractual terms.
Coordinating meetings, workshops, and discovery sessions at your organisation or remotely.
Maintaining CRM or file records of business relationships with appropriate access controls.
Improving website reliability based on aggregated technical metrics rather than profiling individuals.
Detecting malicious traffic, credential stuffing, or other attacks against our infrastructure.

We do not use personal data collected through the contact form for automated decision-making that produces legal or similarly significant effects. We do not perform behavioural advertising profiles based on website browsing on the public site beyond what is described for essential and optional analytics, if any are enabled in future with appropriate notices.

7. Cookies and similar technologies

Our website uses cookies and similar storage mechanisms as described in our Cookie Policy. Essential cookies support functions such as load distribution, session integrity, and remembering cookie consent choices where implemented. We do not claim to use extensive third-party advertising trackers on this site; if our practices change, we will update both policies and banners as required.

You can manage cookies through browser settings and, where provided, through our on-site preference controls. Blocking essential cookies may impair site functionality.

8. Disclosure and sharing of personal data

We share personal data with third parties only where necessary, under appropriate contracts, and with a clear purpose. We do not sell personal data.

8.1 Service providers (processors)

Hosting providers, email service providers, IT support, backup services, and professional advisers may process personal data on our instructions. We require processors to implement appropriate security measures and to process data only for specified purposes.

8.2 Professional advisers

Lawyers, accountants, or insurers may receive limited data where needed for advice, compliance, or claims handling, subject to confidentiality duties.

8.3 Legal disclosure

We may disclose data where required by law, court order, or lawful request by public authorities, or where necessary to protect rights, property, or safety.

8.4 Business transfers

If we undergo restructuring, merger, or asset sale, personal data may transfer to a successor entity subject to continuity of protection consistent with this policy, with notice where practicable.

We do not publish client names or contact details as marketing testimonials on this site unless agreed separately in writing.

9. International transfers

We prefer to store and process data within the United Kingdom and European Economic Area. If we or our processors transfer personal data outside the UK, we implement appropriate safeguards such as UK International Data Transfer Agreement addenda, adequacy regulations, or equivalent mechanisms recognised under UK GDPR, and we assess transfer risks commensurate with the nature of the data.

When you email us or use cloud-based meeting tools, data may transit global networks. We select reputable providers and configure services to align with our security standards.

10. Data retention

We retain personal data only for as long as necessary for the purposes collected, including statutory retention periods.

Contact form and general enquiries: typically up to twenty-four months from last meaningful contact, unless a client relationship continues or a longer period is needed for legal claims.
Client project records: for the duration of the contract and up to seven years thereafter for accounting, tax, and dispute limitation purposes, unless a longer period is required by law or agreed.
Server logs: for a short rolling window appropriate to security monitoring, often between thirty and ninety days unless extended for incident investigation.
Marketing suppression lists: indefinitely as needed to honour opt-out requests.

When retention expires, we delete or anonymise data using procedures designed to prevent casual recovery.

11. Security measures

We implement technical and organisational measures appropriate to the risk, including access controls, encryption in transit where supported, patching, backups, and staff awareness for handling business confidentiality. No method of transmission over the internet is completely secure; we encourage use of business email domains and careful handling of attachments.

If we become aware of a personal data breach likely to affect your rights, we will notify the Information Commissioner's Office where required and communicate with affected individuals when legally necessary.

12. Your rights under UK GDPR

Subject to conditions and exemptions in law, individuals whose personal data we control may exercise the following rights by contacting us at the details above. We may need to verify identity before responding.

Right of access: obtain confirmation of processing and a copy of personal data.
Right to rectification: correct inaccurate or incomplete data.
Right to erasure: request deletion where grounds apply (for example, unnecessary data or withdrawn consent where consent was the sole basis).
Right to restrict processing: limit use in specific circumstances.
Right to data portability: receive data you provided in a structured, commonly used format where processing is automated and based on contract or consent.
Right to object: object to processing based on legitimate interests or direct marketing.
Rights related to automated decision-making: not applicable to our contact form processing as described.

We respond within one month in most cases, extendable by two further months for complex requests with notice. We do not charge a fee unless a request is manifestly unfounded or excessive.

You may lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority, at ico.org.uk or by contacting the ICO helpline. We welcome the opportunity to address concerns directly first.

13. Children

Our website and services are intended for business professionals. We do not knowingly collect personal data from children under eighteen through the contact form. If you believe a child has submitted data, contact us and we will take appropriate steps to delete it.

14. Third-party links

Our pages may link to external resources for convenience. Those sites have independent privacy practices. Review their policies before submitting personal data.

15. Changes to this Privacy Policy

We may update this Privacy Policy to reflect legal, technical, or business changes. The "Last updated" date at the top will change, and material updates may be highlighted on the website. Continued use after changes constitutes acknowledgement of the updated policy where permitted by law.

16. Additional notes for research and advertising engagements

When we conduct market research involving interviews or surveys on behalf of clients, separate participant information sheets and consent mechanisms may apply. When we manage advertising campaigns, platform providers (such as search or social networks) may process data under their own terms; we configure campaigns to respect client instructions and applicable law, but platform operators remain independent controllers for many processing activities.

Clients remain responsible for ensuring they have appropriate bases to share personal data with us for processing instructions, including any customer or prospect lists supplied for campaigns.

17. Accountability and records of processing

We maintain records of processing activities as required for an organisation of our size and risk profile. These records describe categories of data subjects, data categories, purposes, recipients, retention, and safeguards for transfers. Internal reviews are conducted periodically to ensure descriptions remain accurate when we introduce new tools or change website functionality.

Where we conduct data protection impact assessments for higher-risk processing introduced in client projects, those assessments are scoped to the relevant engagement and shared with clients as contractual deliverables when appropriate.

18. Legitimate interests assessments

For processing based on legitimate interests—such as responding to unsolicited B2B enquiries, securing our website, or maintaining basic business records—we balance our interests against individuals' expectations and rights. We document key balancing tests, including measures to minimise data use, provide transparency through this policy, and offer opt-out mechanisms for marketing.

19. Contact form processing workflow

Submissions to our contact form typically generate a notification to monitored agency inboxes. Fields are validated for basic format to reduce spam. Automated filtering may quarantine abusive submissions without extensive profiling of individuals. Human staff review legitimate messages during business hours aligned to United Kingdom time zones unless otherwise stated on the contact page.

We may use the email address you provide to respond once or to continue a thread you initiated. We do not use the contact form to subscribe you to bulk newsletters without a separate clear opt-in.

20. Email and telephone communications

Email is not always encrypted end-to-end. Please do not send confidential material until mutual safeguards are agreed. Call recordings are not routinely made for general enquiries unless we inform you and have a lawful basis; meeting notes may summarise professional discussions without recording unless agreed.

21. Data minimisation and pseudonymisation

We instruct staff to collect only personal data needed for stated purposes. Where analytics are aggregated, we seek to pseudonymise or aggregate identifiers so individuals are not identifiable in reporting used for internal improvement.

22. Processor due diligence

Before engaging subprocessors that may handle website or email data, we review security certifications, data processing terms, and location of processing. Contracts include confidentiality, assistance with data subject rights, breach notification, and deletion on termination where feasible.

23. PECR and electronic marketing

For electronic mail marketing to corporate subscribers, we apply PECR rules and guidance from the ICO, including honouring objections and maintaining suppression records. Soft opt-in concessions applicable to consumer contexts are not relied upon for unrelated mass messaging.

24. Your responsibilities when contacting us

Please provide accurate contact details and update us if they change. If you submit personal data about colleagues, ensure you have authority to share that information for agency discussions.

25. Supervisory authority contact

The Information Commissioner's Office Wycliffe House Water Lane Wilmslow Cheshire SK9 5AF United Kingdom provides guidance and complaint handling. Contact details are published at ico.org.uk.

26. Frequently asked privacy questions

Do you use Google Analytics or similar tools?

Our public website is designed to rely primarily on essential cookies and server diagnostics. If we enable optional analytics cookies in future, we will update this Privacy Policy and Cookie Policy, describe the tool, and obtain consent where required before non-essential cookies are placed.

Can you delete my contact form message?

You may request erasure where no overriding legal basis requires retention—for example, open disputes or accounting records tied to an invoice. We will confirm what can be deleted within statutory response times.

Do you share enquiry data with advertising platforms?

We do not upload contact form submissions to advertising platforms for custom audience targeting. Campaign data handling for clients occurs under separate contracts and platform terms.

How do you handle confidentiality before a contract?

Pre-contract discussions are handled professionally and protected by our general confidentiality practices, with mutual NDAs available on request for sensitive research or brand strategy topics.

How long do you keep contact form data?

We retain enquiry data for periods described in section 10, typically up to twenty-four months from last meaningful contact unless a client relationship continues or law requires longer retention for claims or accounting.

27. Regulatory context in the United Kingdom

UK GDPR principles of lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity, confidentiality, and accountability guide our processing. We implement policies proportionate to the scale of personal data handled through our website and pre-contract communications.

Where processing involves special category data inadvertently submitted, we delete or restrict processing unless a valid condition applies and documentation exists. We do not design the public contact channel to collect such data.

28. Relationship with Terms and Conditions

When a client engagement begins, additional personal data about client personnel may be processed under contractual terms in our Terms and Conditions and any data processing schedule. This Privacy Policy continues to apply to website interactions and controller activities not superseded by processor-only processing.

29. Identity verification for data subject requests

We may request reasonable evidence of identity before disclosing personal data to a requester, particularly where data could reveal confidential business discussions. We accept corporate email verification for business contacts where appropriate.

This section supports your understanding of how IGBOOSTER LTD applies privacy principles to B2B marketing research and advertising enquiries received through https://igbooster.digital or direct channels. It supplements earlier sections and does not expand processing beyond purposes already described. Contact devops@igbooster.digital for clarification.

30. Marketing suppression and preference management

If you opt out of optional B2B updates, we retain minimal contact details solely to honour the opt-out. Suppression records are not used for promotional profiling.

31. Security incident communications

If a breach affects your personal data, we describe the nature of the incident, likely consequences, and measures taken, in plain language, when notification is required.

32. Paper records

Limited paper records may exist for signed documents or postal correspondence. These are stored securely and digitised where practical for retention management.

33. Audio and video meetings

Online meetings arranged after an enquiry may be logged in calendar systems containing participant names and email addresses. Recordings are not made unless agreed.

34. Research participant data separation

Public website enquiry data is segregated from research fieldwork databases maintained for client projects, reducing cross-use of identifiers.

35. Retention triggers

Retention clocks for enquiry data restart on meaningful two-way communication, not on automated acknowledgements alone.

36. Access by former personnel

Access credentials are revoked promptly when personnel leave or change roles, and periodic access reviews cover shared inboxes receiving contact form notifications.

37. Data protection training

Personnel handling enquiries receive guidance on recognising personal data, forwarding privacy requests, and escalating security concerns.

38. Complaint handling procedure

Privacy complaints are acknowledged promptly, investigated, and answered with outcome and remedial steps where applicable.

39. Version control of this policy

Previous versions may be archived internally to demonstrate accountability; material changes are reflected in the published last updated date.

40. Compatibility with client instructions

Where you engage us as a client and also contacted us via the website, controller and processor roles are allocated per activity and documented contractually.

41. Statistical reporting

Internal metrics on enquiry volumes may be aggregated without identifying individuals unless necessary for account management you requested.

42. Fraud prevention

We may retain minimal technical indicators associated with abusive submissions to protect the contact channel, balanced against data minimisation.

43. Contact details for EU and UK representatives

We operate from the United Kingdom. If representative requirements apply to specific processing in future, details will be published here.

44. Automated spam filtering

Automated tools may classify messages by metadata and content patterns without creating public profiles of senders.

45. Closing transparency statement

We publish this policy to meet transparency expectations under UK GDPR Article 13 for website collection.

46. Joint controller scenarios

If we co-determine limited purposes with a client in a specific project, participants receive separate notices; website enquiry processing remains under this policy as Agency controller activity.

47. Necessity and proportionality reviews

We periodically review whether contact fields remain necessary and remove optional fields that no longer serve a clear purpose.

48. Controller contact channel

The primary channel for privacy queries is email to devops@igbooster.digital with the subject line Privacy Request for efficient routing.

This Privacy Policy is issued by IGBOOSTER LTD for https://igbooster.digital. For questions, email devops@igbooster.digital or write to 280 King Street, London, W6 0SP United Kingdom.