...

Hello. We are Toasted Digital

Websites, Microsites & Games #❤

0 / 100

Client Privacy Policy and Terms of Service


Updated 24th May 2018


 

As a client of Toasted Digital, you share certain datasets with us in order for us to be able to deliver the services you have asked us to provide you with. We are committed to safeguarding the privacy of this data. The following privacy policy sets out in as simple terms as possible:

  • - The client data that we hold and process.
  • - What we do with this data.
  • - Security and our extended policies concerning your data. 
  • - Your rights concerning your data.

 

In preparation for GDPR, we have performed a full audit of our data sets and reviewed all of our data policies. 

 

If you have any questions about your personal data, privacy or security, please contact [email protected] - You may also contact us at:

Toasted Digital Ltd
Unit 606 Cannon Wharf
Pell Street
London SE8 5EN

 

Clients


 

The data we collect

We may collect the following data.

  • - Your name
  • - Business name
  • - Email address
  • - Business address
  • - Website Address
  • - Social Media Links
  • - Data specific to projects including project descriptions, briefs, meeting times and locations, feedback, estimates, invoices and receipts.

 

What we do with the data

We only use this data in the legitimate interest of the day to day running of our business. This includes:

  • - Contacting you with regards queries to do with existing and past projects.
  • - Generating bookkeeping documents such as estimates/quotes/invoices concerning your projects.
  • - Operational processes that are required to complete your project. For example, sharing an email internally so that a developer can contact you with regards a technical question.

 

Data Processors

We use third-party processors to process some data on our behalf. We only use processors with clear GDPR commitments, and only in the legitimate interest of running our business and delivering your projects. 

We may use:

 

A note on GoCardless

We do not have access to bank account or sort code information that you share with GoCardless. We can access and edit your name, address and email address only. We can view but not edit your bank name. When you create a direct debit mandate with GoCardless, you must read and understand their Privacy Policy.

 

Internal Data Proccessing

We process some data internally in the legitimate interest of running our business and delivering your projects. 

We may use

  • - Our custom CRM to manage your website hosting. This is a basic system which monitors your website's version number and allows us to upgrade it for you when a new CMS version is available. We store your name and email address here so that we can contact you in relation to upgrades. 

 

Security 

Toasted Digital takes security seriously. We:

  • - Have a secure by design password manager. Passwords are shared internally on a need to know basis only. Passwords are encrypted using AES256 bit encryption with PBKDF2 SHA256, 4096 iterations.
  • - Have an internal password policy for limiting the spread of password data.
  • - Require all of our devices have as much security as possible. This includes computer encryption where compatible, password protection and 2-factor auth where available. 
  • - Have 2 Factor Auth set up on any third party services where possible
  • - Have SSL on our website
  • - Have offices in a secure managed building
  • - Have reviewed the security of our third-party services. Please see the above GDPR commitment links under "Data Processors."

 

Consent

At this time, we don't use your data for anything other than delivering your projects (including communicating with you about them) and administering our business in accordance with local (English) law. If this were ever to change (for example if we started a mailing list), we would require consent from you to use your data in this way.

We do not share your data with any third parties other than specified in this privacy policy. We do not sell your data to anyone.

 

Request of data or deletion

You can request a copy of, or request deletion of the data we hold on you at any time. Please see:

 

Data breaches

Please see our data breach policy for what happens in the event of a data breach.

 

What does all of this actually mean for you?

In short:

  • - We do everything we can to keep your data secure and safe.
  • - We only use your data to deliver your projects and administer our business in accordance with local law.
  • - You have to right to get in touch with us and request a copy of all the data we store for you.
  • - You also have the right to request that data is deleted.

 

Legacy Data

Toasted Digital is still in the process of reviewing its legacy data in relation to our data retention schedule. We hope to have this process completed by the end of 2018.

 


Hosting Clients

If your website is hosted with Toasted Digital, you and we both have responsibilities with regards GDPR and any personal data that you choose to upload to our servers. 

Hosting clients are responsible for the security of their code and processing of any personal data uploaded to their server space.

By default, we do not access client hosted data unless we are asked to undertake specific tasks by a client. Clients maintain the position of primary administrator for their websites and data. Toasted Digital only provides hosting space for clients, and ultimately clients control what data processing will occur in this space.

As a hosting client, you are required to obtain and handle all personal data in accordance with GDPR. If you do not, we will suspend your account until you can resolve this. 

If Toasted Digital becomes aware of any issue that arises from code uploaded to your server space by you or on your behalf that could threaten the security of your server space or our extended servers as a whole, we will suspend your account until you can resolve it.

We will also suspend any accounts found to be:

  • - Hosting content which breaks English law.
  • - Hosting any pornographic content
  • - Hosting any gambling content 
  • - Hosting mass mail out software

We'll always reach out to you to see if we can help and assist in any way in making sure you adhere to our terms of service. 


What we do

We may store login credentials for your hosting space and content management systems so that we can perform ad hoc and agreed regular maintenance tasks for you. These are encrypted in our password manager using AES256 bit encryption with PBKDF2 SHA256, 4096 iterations. They are shared internally on a need to know basis only and subject to our password policy.

We take security on our servers very seriously, so our third-party suppliers and we take regular actions to maintain the security of our servers. Please find their GDPR commitments:

  • - For MODx clients please see our server supplier SkyToaster: https://my.skytoaster.com/index.php?rp=/knowledgebase/99999223/General-Data-Protection-Regulation-GDPR.html
  • - For WordPress clients please see our server supplier FlyWheel: https://getflywheel.com/wordpress-support/how-flywheel-is-preparing-for-gdpr/

If you are a maintenance client, we may also perform other security tasks. Such as:

  • - Updating your content management system
  • - Updating your site plugins
  • - Malware removal 

 

Addtional key information

  • - Toasted Digital does not store or process any additional personal data for our hosting clients than already outlined in this privacy policy. 
  • - Hosting clients can request at any time a backup of their server from Toasted Digital. We will endeavour to deliver this within 7 working days or as soon as is possible.
  • - Toasted Digital does not offer email hosting.
  • - All of our server data centres are located in the UK. 

 


 

By continuing to use Toasted Digital services from the 25th of May 2018, you understand and agree to this client privacy policy and terms of service. 

 


Related Documents