Privacy Policy

1. Introduction

Montaj Digital Ltd (Company Number: 13521589) ("we", "us", "our") is committed to protecting the privacy and security of your personal data. This Privacy Policy explains how we collect, use, store, and share information when you visit our website at montajdigital.io and all associated subdomains (collectively, the "Website"), submit forms, book calls, or otherwise interact with our services.

We are a UK-based company and act as the "data controller" under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Where we process personal data of individuals in the European Economic Area (EEA), we also comply with the EU GDPR. For visitors located in the United States, we also comply with applicable US privacy laws, including the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), and other applicable state privacy laws.

This Privacy Policy applies to personal data we collect as a data controller through our Website. Where we process personal data on behalf of our clients as a data processor (for example, when delivering marketing, advertising, or automation services on their behalf), that processing is governed by separate data processing agreements with those clients and is not covered by this policy.

Registered Address: C/O SGB Accountants, Sopers House, Sopers Road, Cuffley, United Kingdom, EN6 4RY

Data Protection Contact: kaiyan@montajdigital.io

2. Information We Collect

We collect personal data that you voluntarily provide to us, and a limited amount of technical data that is collected automatically when you use the Website. The types of information we may collect include:

2.1 Information You Provide Directly

• Full name
• Email address
• Phone number
• Business name and role
• Any other information you include in form submissions or call bookings

This data is collected when you submit a form on our Website, book a call, complete our AI Readiness Quiz, or otherwise voluntarily provide your details to us.

2.2 Automatically Collected Information

When you visit our Website, certain technical data may be collected automatically through server logs, cookies, and similar tracking technologies. Non-essential cookies and tracking are only used where you have given consent. This may include:

• IP address (which may be anonymised)
• Browser type and version
• Device type and operating system
• Pages visited and time spent on the Website
• Referring URL (how you arrived at our Website)
• Click and interaction data

2.3 Tracking and Advertising Data

We use advertising and analytics platforms to measure the effectiveness of our marketing campaigns and to serve relevant advertisements. These platforms may collect data through cookies, pixels, and similar technologies. We use the following:

• Google Analytics: for website traffic analysis and user behaviour insights
• Google Ads (including Google Tag Manager): for conversion tracking and remarketing
• Meta Pixel (Facebook/Instagram): for conversion tracking and remarketing
• LinkedIn Insight Tag: for conversion tracking and audience building (if applicable)
• Microsoft Advertising UET Tag: for conversion tracking (if applicable)
• TikTok Pixel: for conversion tracking and audience building (if applicable)

These tools may collect data such as your IP address, device identifiers, browsing behaviour, and conversion events. This data is used to optimise our advertising and improve user experience.

In addition to browser-based cookies and pixels, we use server-side conversion tracking (including the Meta Conversions API and Google's server-side tagging). This shares limited hashed identifiers, such as an encrypted version of your email address or phone number, directly with advertising platforms to measure conversions and reduce reliance on browser cookies. We rely on your consent to advertising cookies and technologies as the basis for this processing. For more information about cookies, please see Section 7.

3. How We Use Your Information

We use your personal data for the following purposes:

• To respond to your enquiries and provide the services you have requested
• To send you marketing communications (email and/or SMS) where you have opted in to receive them
• To analyse website usage and improve our Website and services
• To run and optimise advertising campaigns across Google, Meta, and other advertising platforms
• To create custom and lookalike audiences for targeted advertising
• To retarget you with relevant advertisements across third-party platforms
• To comply with legal obligations

4. Legal Basis for Processing (UK/EU GDPR)

Under the UK GDPR and EU GDPR, we rely on the following legal bases:

Consent: Where you have given clear consent for us to process your personal data for specific purposes, including marketing communications and non-essential cookies. You may withdraw consent at any time.

Legitimate Interests: Where processing is necessary for our legitimate business interests, such as improving our Website, analysing advertising performance, and administering our business, provided these interests are not overridden by your rights and freedoms.

Contractual Necessity: Where processing is necessary to take steps at your request prior to entering into a contract or to perform a contract with you.

Legal Obligation: Where processing is necessary to comply with a legal obligation to which we are subject.

5. Sharing Your Information

We do not sell your personal data. We may share your information with the following categories of third parties:

• GoHighLevel (our CRM and marketing automation platform): for managing contact records, email/SMS communications, and form submissions
• Calendly (our scheduling platform): for booking and managing calls
• Website hosting providers (including Vercel, which hosts our aiquiz.montajdigital.io subdomain, and our WordPress hosting provider): for serving the Website and maintaining server logs
• n8n (our workflow automation platform): for routing form submissions and lead data between our Website and our CRM
• Google (Analytics, Ads, Tag Manager): for advertising and analytics purposes
• Meta Platforms (Facebook, Instagram): for advertising and analytics purposes
• Other advertising platforms as applicable (LinkedIn, Microsoft, TikTok): for advertising and analytics purposes
• Professional advisors (accountants, lawyers): where required for business administration or compliance
• Regulatory authorities: where required by law

All third-party processors are required to handle your data in accordance with applicable data protection laws and our instructions.

6. International Data Transfers

Some of our third-party service providers (including GoHighLevel, Calendly, Vercel, Google, and Meta) are based in the United States or process data in countries outside of the UK and EEA. Where personal data is transferred outside the UK or EEA, we ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) approved by the UK Information Commissioner's Office (ICO) or the European Commission
• UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU SCCs
• The recipient being in a country that the UK or EU has determined provides an adequate level of data protection
• Any other applicable lawful transfer mechanism

You may contact us at kaiyan@montajdigital.io to request further details about the safeguards in place for specific transfers.

7. Cookies and Tracking Technologies

Our Website uses cookies and similar technologies. Cookies are small text files stored on your device when you visit our Website. Our use of cookies is governed by the UK Privacy and Electronic Communications Regulations (PECR) as well as the UK GDPR.

7.1 Types of Cookies We Use

Strictly Necessary Cookies: These are essential for the Website to function properly. They do not require your consent.

Analytics Cookies: These help us understand how visitors interact with our Website (for example, Google Analytics). These are placed only with your consent.

Advertising/Marketing Cookies: These are used to deliver relevant advertisements and track the effectiveness of our advertising campaigns (for example, Meta Pixel and Google Ads tags). These are placed only with your consent.

7.2 Managing Cookies

When you first visit our Website, you will be presented with a cookie consent banner allowing you to accept or reject non-essential cookies. Non-essential cookies and tracking technologies are not activated until you provide consent. You can change your cookie preferences at any time by using the cookie settings link on our Website or by adjusting your browser settings. Please note that blocking certain cookies may affect the functionality of our Website.

8. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy any legal, accounting, or reporting requirements. Our general retention periods are:

• Contact form submissions and lead data: retained for up to 3 years from the date of last interaction, unless you request earlier deletion
• Marketing communications data: retained until you unsubscribe or withdraw consent
• Analytics data: retained in accordance with the default retention settings of the relevant platform (typically 14 to 26 months for Google Analytics)
• Advertising data: retained in accordance with the policies of the relevant advertising platform

9. Your Rights Under UK and EU Data Protection Law

If you are located in the UK or EEA, you have the following rights under applicable data protection law:

• Right of access: You have the right to request a copy of the personal data we hold about you.
• Right to rectification: You have the right to request that we correct any inaccurate or incomplete personal data.
• Right to erasure: You have the right to request that we delete your personal data, subject to certain conditions.
• Right to restrict processing: You have the right to request that we restrict the processing of your personal data in certain circumstances.
• Right to data portability: You have the right to receive your personal data in a structured, commonly used, and machine-readable format.
• Right to object: You have the right to object to the processing of your personal data where we rely on legitimate interests.
• Right to withdraw consent: Where we process data based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing before withdrawal.
• Right not to be subject to automated decision-making: You have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly significant effects.

Our AI Readiness Quiz generates an indicative readiness score based on the answers you provide. This is automated processing designed to give you a useful result and to help us tailor our follow-up, and it does not produce any legal or similarly significant effect. A member of our team reviews any subsequent engagement with you.

To exercise any of these rights, please contact us at kaiyan@montajdigital.io. We will respond to your request within one month, or inform you if an extension is required.

You also have the right to lodge a complaint with a supervisory authority. In the UK, this is the Information Commissioner's Office (ICO) at ico.org.uk. If you are located in the EEA, you may lodge a complaint with your local data protection supervisory authority.

10. Your Rights Under US Privacy Laws

If you are a resident of the United States, you may have additional rights under applicable state privacy laws, including but not limited to the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), the Virginia Consumer Data Protection Act (VCDPA), the Colorado Privacy Act (CPA), the Connecticut Data Privacy Act (CTDPA), and other state privacy legislation.

10.1 Your US Privacy Rights

Depending on your state of residence, you may have the right to:

• Know what personal information we collect, use, disclose, and sell/share
• Request deletion of your personal information
• Opt out of the sale or sharing of your personal information for targeted advertising
• Correct inaccurate personal information
• Non-discrimination for exercising your privacy rights
• Request access to and portability of your personal information

10.2 Do Not Sell or Share My Personal Information

We do not "sell" your personal information in the traditional sense. However, under certain US state privacy laws, the use of advertising cookies and pixels (such as Meta Pixel and Google Ads), server-side conversion tracking, and the creation of custom or lookalike advertising audiences that share data with third parties for targeted advertising may be classified as a "sale" or "sharing" of personal information. You can opt out of this by declining non-essential cookies via our cookie consent banner or by contacting us at kaiyan@montajdigital.io.

10.3 Exercising Your US Rights

To exercise your rights under US privacy laws, please email us at kaiyan@montajdigital.io. We will verify your identity before processing your request. We will respond within the timeframes required by applicable law (typically 45 days under the CCPA/CPRA).

11. Marketing Communications

We may send you marketing communications by email and/or SMS where you have opted in to receive them, in accordance with the UK Privacy and Electronic Communications Regulations (PECR). You can opt in by submitting a form on our Website, booking a call, or otherwise providing your explicit consent.

You have the right to opt out of marketing communications at any time by:

• Clicking the "unsubscribe" link in any marketing email
• Replying "STOP" to any SMS communication
• Contacting us at kaiyan@montajdigital.io

12. Children's Privacy

Our Website and services are not directed at individuals under the age of 18 (or the age of majority in your jurisdiction). We do not knowingly collect personal data from children. If we become aware that we have collected personal data from a child, we will take steps to delete that information promptly.

13. Third-Party Links

Our Website may contain links to third-party websites. We are not responsible for the privacy practices or content of those websites. We encourage you to read the privacy policies of any third-party sites you visit.

14. Data Security

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, or alteration. These measures include the use of encrypted connections (HTTPS/SSL), secure hosting infrastructure, access controls, and regular reviews of our data processing practices. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will post the updated policy on this page with a revised "Last Updated" date. We encourage you to review this page periodically. Material changes will be communicated through a notice on our Website.

16. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your personal data, please contact us:

• Company: Montaj Digital Ltd
• Company Number: 13521589
• Address: C/O SGB Accountants, Sopers House, Sopers Road, Cuffley, United Kingdom, EN6 4RY
• Email: kaiyan@montajdigital.io

For UK data protection complaints, you may also contact the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.