Privacy Policy

This Privacy Policy explains how REXCODE DIGITAL LTD collects, uses, stores, shares, and protects personal data when you visit https://www.rexcode.co.uk, submit a form, request a Shopify audit, start a project, communicate with us, or use our services.

1. Who We Are

REXCODE DIGITAL LTD (trading as RexCode), company number 17088152, is the data controller for personal data collected through this website and related business communications. We are registered in England and Wales.

Our registered office is 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. Our ICO registration reference is ZC205511. For privacy or data-protection enquiries, email support@rexcode.co.uk.

2. Information We Collect

We collect personal data that you provide directly to us when you complete forms on our website, request a free Shopify store review, submit a project brief, contact us, communicate by email, or interact with our services.

The personal data we may collect includes:

• Full name
• Email address
• Phone number or WhatsApp number
• Business name or company name
• Website URL, Shopify store URL, or current store link
• Preferred contact method
• Industry, niche, or business description
• Service type or requested project category
• Shopify store status, including whether you already have a Shopify store
• Shopify Plus status, where relevant
• Access method preferences and collaborator request codes
• Project scope, project details, goals, requirements, and additional notes
• Budget range, estimated budget, priority, and ideal deadline
• Launch responsibility and project planning preferences
• Brand asset links, file sharing links, reference websites, competitor information, and app or integration details
• Any other information you voluntarily submit through forms, email, or communication with us

We do not ask you to share passwords through our website forms. If store access is required, we may ask you to use safer access methods, such as Shopify collaborator access or limited permissions.

3. Technical Data and Log Files

When you visit our website, certain technical data may be collected automatically by our website, hosting provider, analytics tools, or advertising tools. This may include:

• IP address
• Browser type and version
• Device type and operating system
• Pages visited and time spent on pages
• Referring website or campaign source
• Approximate location based on technical data
• Cookie identifiers and similar tracking technologies, where allowed
• Website interactions, conversions, and form-related events

This information helps us operate the website, understand performance, improve user experience, prevent abuse, measure marketing activity, and maintain website security.

4. How We Use Your Information

We use your personal data to:

• Respond to enquiries, requests, and project submissions
• Review Shopify stores and provide audit-related communication
• Prepare quotations, proposals, project scopes, timelines, and service recommendations
• Deliver Shopify, Webflow, design, development, CRO, SEO, migration, and related digital services
• Communicate with clients and potential clients
• Provide customer support and service-related updates
• Send marketing emails where consent has been given or where permitted by applicable law
• Improve our website, forms, content, services, and user experience
• Measure website performance, advertising campaigns, and conversion activity
• Protect our website, business, legal rights, and users
• Comply with legal, accounting, tax, and regulatory obligations

We never sell, trade, or rent your personal data to third parties.

5. Legal Basis for Processing Personal Data

Under UK data protection law, we must have a lawful basis for each processing activity. We apply the following bases to the activities described in this policy:

• Free Audit and enquiry requests — pre-contract steps and legitimate interests: to assess and respond to a request, prepare recommendations, discuss scope, or provide a quotation before a contract is entered into.
• Paid client services — contract: to deliver agreed services, manage projects, communicate about delivery, and meet our contractual obligations.
• Invoicing, tax and accounting — legal obligation: to keep required financial records and comply with tax, accounting, legal, and regulatory duties.
• Website security, fraud and abuse prevention — legitimate interests: to protect our website, systems, business, clients, and users.
• Optional analytics and advertising cookies — consent: where non-essential cookies or similar technologies are activated only after the visitor has made the relevant choice.
• Newsletter marketing — consent: where a person actively subscribes to receive RexCode ecommerce and Shopify updates.

You may withdraw your consent at any time where we rely on consent as the lawful basis. Withdrawing consent does not affect processing that took place before consent was withdrawn.

6. Email Communication and Marketing

If you provide your email address, we may use it to respond to your enquiry, provide service-related communication, send requested information, follow up on a project request, or communicate about an active or potential business relationship.

We send newsletter and similar marketing communications where you have actively subscribed or otherwise given valid consent. The acknowledgement used to request a Free Audit is not marketing consent. Service and project communications are used to respond to your request or perform a contract, not to subscribe you to marketing.

You can unsubscribe from marketing communications at any time by using the unsubscribe link in the email, replying to the message, or contacting us at support@rexcode.co.uk.

7. Cookies

We use cookies and similar technologies to operate the website, improve user experience, understand website performance, and support marketing or lead-tracking activity where consent has been given.

Cookies used on our website may include:

• Essential Cookies: required for the website to function properly.
• Analytics Cookies: used to understand how visitors use the website and how pages perform.
• Marketing Cookies: used to support Meta Pixel, lead tracking, campaign measurement, and relevant marketing activity where consent has been given.
• Preference Cookies: used to remember certain settings or choices where applicable.

Our website may display a cookie banner or privacy settings tool that allows you to manage cookie preferences. You can also manage or disable cookies through your browser settings. Some website features may not work properly if certain cookies are disabled.

More detailed information about cookies is provided in our separate Cookie Policy.

8. Analytics, Meta Pixel and Lead Tracking

We use analytics, tracking, and marketing technologies to understand website traffic, measure performance, improve our services, understand visitor behaviour, and evaluate marketing activity.

These tools may include:

• Google Analytics 4: used for website analytics, traffic measurement, performance insights, and aggregated reporting.
• Meta Pixel: used for Meta/Facebook advertising measurement, audience insights, and remarketing where enabled and where cookie consent has been provided.
• Leadsy AI: used for website visitor and lead-tracking insights, business visitor identification, and campaign performance analysis where applicable.

These tools may process technical information such as IP address, device information, browser information, pages visited, interactions, campaign source, referral source, and conversion events. Where required, these tools are controlled through cookie consent settings.

We do not currently use Google Ads on this website. If Google Ads conversion tracking, remarketing, or advertising cookies are added in the future, this Privacy Policy and our Cookie Policy should be updated to reflect that change.

9. Third-Party Services We Use

We use trusted third-party service providers to operate our website, communicate with users, manage leads, process business operations, measure performance, and provide services.

These providers may include:

• Webflow: website hosting, website infrastructure, form handling, and website functionality.
• Instantly: lead management, email communication, outreach, follow-ups, and contact management. Information submitted through website forms may be added to Instantly where appropriate for business communication and lead management.
• Google Workspace: business email, file handling, communication, internal documents, and client communication.
• Google Analytics 4: website analytics, performance measurement, and aggregated reporting.
• Meta Pixel: marketing measurement, audience insights, and remarketing where enabled and consented to.
• Leadsy AI: lead tracking, visitor insights, and business visitor identification where used on the website.
• Stripe: payment processing where Stripe is used for client payments.
• PayPal: payment processing where PayPal is used for client payments.
• Bank transfer providers: where payment is made by bank transfer.

These providers may process personal data according to their own privacy policies and data processing terms. We only share information with these providers where it is necessary for the purposes described in this Privacy Policy.

10. Payments

We do not currently provide a public login system or public checkout account system on this website. If you become a client, payment may be requested separately by Stripe, PayPal, bank transfer, or another agreed payment method.

Payment providers may process information such as your name, email address, billing details, transaction details, payment status, and other information required to process the payment. We do not store full card details on our website.

11. Data Sharing

We may share personal data only where necessary, including:

• With service providers that help us operate our website, email, forms, analytics, tracking, payments, and business systems
• With payment providers where you become a client and make a payment
• With professional advisers, accountants, legal advisers, or insurers where necessary
• Where required by law, court order, regulator, tax authority, or government authority
• Where necessary to protect our rights, property, business, website, users, or legal interests

We do not sell personal data to third parties.

12. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected, including providing services, responding to enquiries, managing business relationships, maintaining records, resolving disputes, and complying with legal obligations.

As a general guide, enquiry and lead data may be retained for up to 24 months after the last meaningful interaction, unless we need to keep it longer for an active business relationship, legal requirement, dispute, accounting obligation, or legitimate business reason.

Client, invoice, payment, tax, and accounting records may be retained for longer where required by law. When data is no longer needed, we will delete, anonymise, or securely retain it only where legally necessary.

13. Data Security

We implement reasonable technical and organisational measures to protect personal data from unauthorised access, loss, misuse, alteration, disclosure, or destruction.

These measures may include:

• SSL or encrypted website connections where available
• Secure website hosting and cloud-based service providers
• Access controls and limited access to personal data
• Use of reputable third-party business systems
• Internal practices designed to reduce unnecessary data access

However, no website, email system, or online service is completely secure. We cannot guarantee absolute security, but we take reasonable steps to protect the information we process.

14. Your Rights Under UK Data Protection Law

Depending on the circumstances, you may have the following rights under UK data protection law:

• Right of access: to request a copy of the personal data we hold about you.
• Right to rectification: to ask us to correct inaccurate or incomplete personal data.
• Right to erasure: to ask us to delete your personal data in certain circumstances.
• Right to restrict processing: to ask us to limit how we use your data in certain circumstances.
• Right to object: to object to processing based on legitimate interests or direct marketing.
• Right to data portability: to request that certain personal data be provided in a structured, commonly used, machine-readable format.
• Right to withdraw consent: to withdraw consent where processing is based on consent.
• Right to complain: to complain to a data protection authority.

To exercise your rights, contact us at support@rexcode.co.uk. We may need to verify your identity before responding to certain requests.

15. Data Protection Complaints and Complaints to the ICO

If you have a concern about how we collect, use, store, share, or protect your personal data, you can make a data protection complaint directly to us by emailing support@rexcode.co.uk. Please use the subject line “Data Protection Complaint” and include enough information for us to understand and investigate your concern.

We will acknowledge receipt of your complaint within 30 days. We will begin considering the complaint when we receive it, investigate it without undue delay, keep you informed about material progress or delays, and provide the outcome without unjustifiable or excessive delay.

If you remain unhappy with our response, or you believe your personal data has been processed unlawfully, you have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO).

16. International Data Transfers

Some of our third-party providers may process personal data outside the United Kingdom. This may happen where cloud, analytics, tracking, email, payment, or business systems operate internationally.

Where personal data is transferred outside the UK, we rely on appropriate safeguards where required, such as adequacy regulations, standard contractual clauses, international data transfer agreements, or equivalent safeguards provided by our service providers.

17. Automated Decision-Making

We do not use automated decision-making or profiling that produces legal or similarly significant effects on individuals.

18. Age Restrictions

This website and our services are intended for individuals aged 18 or older and for business users. We do not knowingly collect personal data from individuals under 18.

If you believe a person under 18 has provided personal data to us, please contact us so we can review and delete it where appropriate.

19. External Links

Our website may contain links to third-party websites, platforms, tools, or resources. We are not responsible for the privacy practices, content, security, or policies of third-party websites. You should review their privacy policies before providing personal data to them.

20. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, website, legal requirements, tools, or business practices.

If we make changes, we will update the “Last updated” date shown at the top of this page. Where appropriate, we may also provide an additional notice of significant changes. The updated Privacy Policy will apply from the date stated at the top of the page.

21. Contact

If you have any questions about this Privacy Policy, how we use personal data, or how to exercise your data protection rights, you can contact us using the details below.