Last Updated: September 2026
TwistedFlip Limited ("we", "us", "our") is an independent web design and technical search engine optimization studio registered in England & Wales. We are committed to protecting and respecting your privacy in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
For the purpose of applicable data protection legislation, the data controller is:
Entity: TwistedFlip Limited
Domain: twistedflip.co.uk
Email: billing@twistedflip.co.uk
We collect and process personal information strictly necessary to provide our digital engineering and search marketing services:
Contact Data: Name, business name, corporate email address, telephone number, and physical billing/trading address submitted via our consultation forms or telephone inquiries.
Project Intake & Credential Data: Technical assets, domain registrar logins, DNS records, hosting logins, and CMS credentials provided by clients to execute development or technical SEO audits under an active Statement of Work.
Technical & Usage Data: IP addresses, browser types, device operating systems, referral URLs, and page interaction timestamps collected automatically via server access logs and performance diagnostic tools.
Financial & Transactional Records: Invoicing records, BACS transfer confirmations, and payment histories. (Note: We do not store raw payment card numbers; online card transactions are processed securely via encrypted third-party processors).
Under UK GDPR, we process personal data under the following lawful bases:
Contractual Necessity (Article 6(1)(b)): Processing necessary to prepare quotations, execute milestone web builds, manage cloud infrastructure, or deliver SEO services under our Master Services Agreement.
Legitimate Interests (Article 6(1)(f)): Managing client relationships, preventing malicious server attacks, ensuring network security, and responding to business inquiries.
Legal Obligation (Article 6(1)(c)): Retaining commercial invoices, accounting documentation, and tax records in accordance with UK statutory corporate requirements.
We do not sell, rent, or trade your personal data. We disclose information only to vetted service providers strictly for operational fulfilment:
Managed Cloud Hosting & Infrastructure Providers: High-performance NVMe cloud environments located in secure UK/EU data centres.
Transactional Communication & Booking APIs: Calendar management systems (e.g., Calendly) and SMS/WhatsApp notification gateways used exclusively for client onboarding and appointment dispatch.
Accounting & Invoicing Platforms: Cloud accounting tools (e.g., Xero) used for statutory bookkeeping and VAT reporting.
Inquiry Data: Prospect information collected through discovery calls or form inquiries is retained for twelve (12) months if no commercial relationship ensues.
Client Project Data: Technical credentials and project documentation are retained for the duration of the active agreement plus thirty (30) days following offboarding.
Financial Records: Invoices and payment records are retained for six (6) statutory years in compliance with HMRC and UK corporate reporting requirements.
You hold explicit rights regarding your personal information, including:
The right to access your personal data (Subject Access Request).
The right to rectification of inaccurate or incomplete records.
The right to erasure ("right to be forgotten"), subject to statutory tax retention exemptions.
The right to restrict or object to data processing.
The right to data portability.
To exercise any of these rights, contact us directly at billing@twistedflip.co.uk. If you believe we have not resolved an issue satisfactorily, you have the right to lodge a formal complaint with the UK Information Commissioner’s Office (ICO) at ico.org.uk.
