Privacy Policy

1. Who We Are

Citriq Limited ("Citriq", "we", "us", or "our") is registered in England & Wales under company registration number 17370349. Our registered office is Unit 3, Vernon Drive, Battlefield Enterprise Park, Shrewsbury, Shropshire, SY1 3TF. For the purposes of the UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018, Citriq is the Data Controller for information collected via our website, client onboarding channels, and client portal.

2. Information We Collect

We only collect data necessary to provide bespoke digital systems, manage client websites, and communicate project deliverables:

• Identity & Contact Information: Full name, company name, business address, email address, and telephone/WhatsApp numbers.
• Project Briefs & Content: Business logos, photographs, service pricing, copy, domain registration credentials (when requested for DNS connection), and design preferences.
• Billing & Transaction Records: Invoicing details and payment confirmation tokens via Stripe. We do not store full debit/credit card numbers on our servers; payments are processed securely by Stripe.
• Technical & Session Data: IP addresses, browser types, session cookies, and login authentication tokens required to securely operate the Citriq Client Portal.

3. Lawful Basis for Processing

Under UK GDPR, we rely on the following lawful bases to process your personal data:

4. Third-Party Sub-Processors

We work with reputable, GDPR-compliant technology providers who assist in powering our infrastructure:

• Stripe Payments Europe: Secure subscription billing, invoicing, and PCI-DSS compliant payment processing.
• Supabase: Encrypted European cloud database storage and authenticated client session security.
• Vercel & AWS: Ultra-fast global edge hosting, continuous deployment, and SSL encryption.
• Resend: Transactional email delivery for magic login links and client portal notifications.

5. Data Retention & Security

We implement strict security measures including HTTPS SSL encryption, Row-Level Security (RLS) policies in our databases, and tokenised authentication. We retain your account data for as long as your subscription is active. If you cancel your website care plan, project files are retained for 90 days to allow for archive extraction, after which non-essential records are securely deleted.

6. Your Legal Rights

Under UK data protection laws, you retain the following rights regarding your personal information:

• The right to access and receive a copy of your personal data.
• The right to request rectification of inaccurate records.
• The right to request erasure ("Right to be Forgotten") where data is no longer necessary.
• The right to data portability (requesting your website code archive).
• The right to lodge a complaint with the UK Information Commissioner's Office (ICO).