Privacy Policy

Last updated: 20 May 2026

Ambos Digital Ltd respects your privacy and is committed to protecting your personal information.

This Privacy Policy explains how we collect, use, share, store and protect personal information when you:

• visit our website;
• contact us about our services;
• request a quotation or proposal;
• become or act on behalf of a customer, supplier or business partner;
• receive website development, hosting, maintenance or support services from us;
• communicate with us by email, telephone, video call or another channel; or
• otherwise interact with Ambos.

It also explains your rights under applicable UK data protection law.

1. Who we are

Ambos Digital Ltd is a company registered in England and Wales under company number 07900690.

Our contact details are:

Ambos Digital Ltd
Unit 14, Tower Street
Brunswick Business Park
Liverpool
L3 4BJ

Email: hello@ambos.uk
Telephone: 0800 774 7025

For personal information that we use for our own business purposes, Ambos Digital Ltd is the data controller. This means that we determine why and how that personal information is processed.

We have not appointed a statutory Data Protection Officer. Questions, requests and complaints about personal information should be directed to our privacy contact using the details above.

2. Scope of this Privacy Policy

This Privacy Policy primarily applies when Ambos acts as a data controller, including when we process information concerning:

• website visitors;
• prospective customers;
• customers and their representatives;
• suppliers and subcontractors;
• business partners and professional contacts;
• job applicants; and
• people who communicate with us.

When we host, maintain, develop or support a website, application, database or other system for a customer, we may process personal information on that customer’s behalf.

In those circumstances, the customer will normally be the data controller and Ambos will act as its data processor. The customer’s privacy notice should explain how that customer uses the personal information. Our processing on its behalf is governed by our contract with that customer, including the applicable data-processing provisions.

3. Data protection law

We process personal information in accordance with applicable UK data protection and privacy legislation, including:

• the UK General Data Protection Regulation;
• the Data Protection Act 2018;
• the Privacy and Electronic Communications Regulations 2003;
• the Data (Use and Access) Act 2025; and
• other applicable legislation that amends, supplements or replaces those laws.

4. Personal information we collect

The personal information we collect depends on your relationship with us and how you interact with Ambos.

4.1 Identity and contact information

This may include:

• your name;
• job title;
• employer or organisation;
• business or postal address;
• email address;
• telephone number;
• professional profile information; and
• communication preferences.

4.2 Enquiry and communication information

This may include:

• information submitted through our contact forms;
• email and written correspondence;
• telephone and video-call notes;
• project enquiries and requirements;
• support requests;
• feedback and survey responses; and
• records of meetings and decisions.

4.3 Customer and project information

This may include:

• project briefs and specifications;
• proposals, quotations and contracts;
• project plans and schedules;
• approvals and instructions;
• website content and documents;
• account, platform and system information;
• training and support records;
• service history; and
• other information needed to deliver our services.

4.4 Account and access information

Where needed to provide our services, this may include:

• usernames;
• account identifiers;
• administrative access details;
• domain and hosting information;
• software and platform account information;
• permissions and user roles; and
• security and authentication information.

Passwords and other sensitive access credentials should be provided using the secure method requested by Ambos wherever possible.

4.5 Billing and transaction information

This may include:

• billing name and address;
• purchase orders;
• invoice information;
• payment status and transaction references;
• bank account information where required for payments or refunds;
• tax and accounting information; and
• records relating to overdue accounts and debt recovery.

We do not generally store complete payment-card details. Card payments are normally handled by the relevant payment provider under its own privacy and security arrangements.

4.6 Technical and website usage information

When you access our website or online services, we may collect:

• your IP address;
• browser type and version;
• device type and operating system;
• screen size and device settings;
• pages visited;
• dates, times and duration of visits;
• referring pages and websites;
• links and features used;
• approximate geographic information derived from an IP address;
• cookie identifiers;
• server, security and diagnostic logs; and
• information about errors, attempted attacks and suspicious activity.

4.7 Marketing information

This may include:

• whether you wish to receive marketing communications;
• the types of services that may be relevant to you;
• your responses to previous communications;
• records of marketing emails sent;
• email engagement information, where permitted; and
• opt-out and suppression records.

4.8 Supplier and professional contact information

Where you supply services to Ambos or work with us professionally, we may process:

• your contact and organisation information;
• professional qualifications and experience;
• contracts and work instructions;
• insurance and compliance information;
• billing and payment details; and
• records of work completed.

4.9 Recruitment information

If you apply to work with Ambos, we may process:

• your CV and covering letter;
• employment and education history;
• skills, experience and qualifications;
• portfolio information;
• interview notes;
• references;
• salary expectations and availability; and
• information needed to assess your suitability for a role.

4.10 Information contained in customer systems

When providing website development, hosting, maintenance, integration or support services, our authorised personnel may have access to personal information contained in a customer’s website, application, database, CRM system, ecommerce platform, email system or other service.

We only access and use this information to the extent reasonably necessary to provide the services, investigate an issue, protect a system or comply with the customer’s lawful instructions.

In these circumstances, Ambos will normally act as a processor on behalf of the customer rather than as the controller of that information.

5. Special-category and sensitive information

Our website and ordinary business services are not intended to collect special-category personal information, such as information concerning:

• health;
• racial or ethnic origin;
• religious or philosophical beliefs;
• political opinions;
• trade-union membership;
• genetic or biometric identifiers;
• sexual orientation.

Please do not send this type of information through a general enquiry form unless it is necessary and we have specifically asked you to provide it.

We may encounter special-category information when providing services to customers in sectors such as healthcare, education, charities or support services. In those circumstances, we will normally process the information solely on behalf of the relevant customer and under its instructions.

Where Ambos processes special-category information for its own purposes, we will only do so where an appropriate lawful basis and additional legal condition apply.

6. How we collect personal information

6.1 Information you provide directly

We may collect personal information when you:

• submit a website form;
• email or telephone us;
• request a quotation;
• enter into a contract with us;
• attend a meeting or event;
• provide project information or content;
• request technical support;
• subscribe to communications;
• respond to a survey; or
• apply for a role.

6.2 Information provided by your organisation

We may receive your information from your employer, colleague, client or another representative where they identify you as:

• a project contact;
• an authorised decision-maker;
• a billing contact;
• a technical contact;
• a user of our services; or
• another relevant professional contact.

6.3 Information from customers

Customers may provide or make personal information available to us when we work on their websites, platforms, applications, databases and integrations.

The customer is responsible for ensuring that it has a lawful basis for sharing this information with us and for providing any required privacy information to the affected individuals.

6.4 Information collected automatically

We may collect technical and usage information automatically through:

• server logs;
• security systems;
• cookies and similar technologies;
• analytics services;
• content-delivery networks;
• website forms; and
• hosting and infrastructure platforms.

6.5 Public and professional sources

We may obtain business contact information from publicly available or professional sources, including:

• company websites;
• Companies House;
• professional directories;
• business-networking organisations;
• LinkedIn and similar professional platforms;
• event attendance lists where lawful; and
• referrals from customers and professional contacts.

6.6 Service providers and partners

We may receive information from suppliers and platforms used to operate our business, including:

• email and communications providers;
• accounting and payment providers;
• analytics and security providers;
• hosting providers;
• CRM and project-management platforms;
• domain registrars; and
• professional advisers.

7. Why we use personal information

We only process personal information where we have a valid legal reason to do so.

The lawful bases we most commonly rely upon are:

• Contract: processing is necessary to enter into or perform a contract with you.
• Legitimate interests: processing is necessary for our legitimate business interests or those of another organisation, provided those interests are not overridden by your rights and interests.
• Legal obligation: processing is necessary for us to comply with the law.
• Consent: you have given clear consent to a particular use of your information.
• Legal claims: in limited circumstances, processing may be necessary to establish, exercise or defend legal claims.

8. Our legitimate interests

Where we rely on legitimate interests, those interests may include:

• responding to business enquiries;
• developing and maintaining business relationships;
• delivering, administering and improving our services;
• managing projects and communicating with customers;
• protecting websites, accounts, infrastructure and data;
• detecting fraud, misuse and security threats;
• maintaining accurate business and financial records;
• recovering overdue payments;
• promoting relevant services to business contacts;
• improving our website and business operations;
• managing suppliers and subcontractors;
• protecting our legal rights; and
• planning, operating and developing our business.

Before relying on legitimate interests, we consider whether the processing is necessary and balance our interests against the rights, expectations and potential impact on the individual.

You have the right to object to processing based on legitimate interests. Your right to object to direct marketing is absolute, and we will stop using your information for that purpose when you ask us to do so.

9. When information must be provided

Some personal information must be provided so that we can:

• respond properly to an enquiry;
• prepare a quotation or proposal;
• enter into and administer a contract;
• provide hosting or technical support;
• verify your authority to access a system;
• issue invoices and process payments;
• meet tax, accounting or regulatory obligations; or
• protect our systems and customers.

Where required information is not provided, we may be unable to provide a quotation, enter into a contract, supply the requested service, provide support or continue the business relationship.

10. Marketing communications

10.1 Business marketing

We may use business contact information to tell customers, former customers, prospective customers and professional contacts about services, insights or events that we reasonably believe may be relevant to them.

Depending on the circumstances, we may rely on legitimate interests, consent or another basis permitted by applicable electronic-marketing law.

10.2 Individual subscribers

Where consent is required, we will ask for it before sending electronic marketing.

You may withdraw your consent at any time.

10.3 Opting out

You can stop receiving marketing communications by:

• using the unsubscribe option in the communication;
• emailing hello@ambos.uk; or
• contacting us using the details in this Privacy Policy.

Opting out of marketing will not prevent us from sending essential service, project, billing, security or contractual communications.

10.4 Suppression records

When you opt out, we may retain limited information on a suppression list so that we can record and respect your preference. This does not mean that we will continue sending marketing.

10.5 Third-party marketing

We do not sell your personal information to third parties for their own marketing.

We will not share your information with an unrelated organisation for its own direct marketing without an appropriate legal basis.

11. Cookies and similar technologies

11.1 What cookies are

Cookies are small data files placed on your device when you visit a website. Similar technologies may include local storage, pixels, tags and scripts.

11.2 How we use cookies

Our website may use cookies and similar technologies to:

• operate essential website functions;
• protect forms and prevent spam or malicious activity;
• remember consent and preference choices;
• maintain security;
• understand how visitors use the website;
• measure website performance; and
• identify technical errors.

11.3 Strictly necessary technologies

Some cookies and technologies are necessary for the website to operate, remain secure or provide a feature you have requested. These may be used without consent where permitted by law.

11.4 Analytics and other non-essential technologies

Where our website uses analytics or another non-essential technology that requires consent, it should not be activated until you have made an appropriate consent choice.

You may accept, reject or manage non-essential cookies through the options provided by our cookie banner or preference tool.

11.5 Changing cookie preferences

You can change or withdraw your cookie choices at any time using the cookie settings option made available on the website.

You can also control cookies through your browser settings. Blocking some cookies may affect how parts of the website function.

11.6 Further cookie information

Details of the cookies currently used, their providers, purposes and durations should be available through our cookie settings tool or separate cookie information page.

12. Who we share personal information with

We may share personal information with carefully selected third parties where reasonably necessary for the purposes described in this Privacy Policy.

12.1 Service providers

These may include providers of:

• website and application hosting;
• cloud infrastructure;
• content-delivery and website-security services;
• email and business communications;
• customer relationship management systems;
• project-management and support systems;
• file storage and collaboration tools;
• analytics and website monitoring;
• accounting and bookkeeping systems;
• payment processing and banking;
• domain registration and DNS services;
• data backup and disaster recovery;
• spam prevention and cybersecurity; and
• document signing and contract administration.

12.2 Subcontractors and professional collaborators

We may share information with designers, developers, content specialists, consultants and other subcontractors where needed to deliver a project or service.

They will only receive information reasonably necessary for their role and will be subject to appropriate contractual or confidentiality obligations.

12.3 Professional advisers

We may share relevant information with:

• accountants;
• auditors;
• solicitors;
• insurers;
• tax advisers;
• IT and security advisers; and
• debt-recovery providers.

12.4 Authorities and legal recipients

We may disclose information to:

• courts and tribunals;
• law-enforcement authorities;
• regulators;
• tax authorities;
• government bodies; and
• other parties where disclosure is required or permitted by law.

12.5 Corporate transactions

If Ambos is involved in a proposed or completed merger, investment, restructuring, acquisition or sale of assets or business, relevant information may be disclosed to potential purchasers, investors, funders and their professional advisers.

Any recipient will be expected to handle the information confidentially and in accordance with applicable data protection law.

12.6 Customer-authorised disclosure

We may share information with another provider, platform or professional adviser where a customer asks or authorises us to do so.

13. International transfers

Some of the organisations that support our business or provide infrastructure may store or process personal information outside the United Kingdom.

Where personal information is transferred to a country that is not covered by UK adequacy regulations, we will use an appropriate legal safeguard where required.

These safeguards may include:

• the UK International Data Transfer Agreement;
• the UK Addendum to the European Commission’s Standard Contractual Clauses;
• contractual provisions approved under UK data protection law;
• binding corporate rules;
• a legally recognised certification or transfer framework; or
• another lawful transfer mechanism.

We may also apply supplementary technical, contractual or organisational measures where appropriate.

You may contact us for further information about the safeguards relevant to a particular transfer. We may provide a summary or redacted copy where necessary to protect confidential or commercially sensitive information.

14. How we protect personal information

We use reasonable technical and organisational measures designed to protect personal information against:

• unauthorised access;
• unlawful use or disclosure;
• accidental loss;
• alteration;
• destruction; and
• other forms of inappropriate processing.

Measures may include, where appropriate:

• access controls and user permissions;
• multi-factor authentication;
• encryption in transit;
• firewalls and security monitoring;
• malware and threat detection;
• software patching and updates;
• backups;
• logging and incident investigation;
• supplier due diligence;
• confidentiality obligations;
• staff awareness and security procedures; and
• business continuity and recovery measures.

No website, email service, internet transmission, application or storage system can be guaranteed to be completely secure. You should take appropriate care when sending information electronically and protect your own accounts and credentials.

15. How long we retain personal information

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, including contractual, operational, legal, accounting, security and reporting requirements.

Our usual retention periods are set out below. Individual records may be retained for a shorter or longer period where justified by the circumstances.

When determining a retention period, we consider:

• the nature and sensitivity of the information;
• the purpose for which it is used;
• the volume of information;
• the risk of harm from unauthorised use or disclosure;
• our contractual and legal obligations;
• applicable limitation periods;
• security and fraud-prevention requirements; and
• whether the purpose can be achieved using less information.

We may anonymise information so that it can no longer identify an individual. Anonymised information may be retained and used for statistical, operational or research purposes.

16. Your data protection rights

Depending on the circumstances, you may have the following rights.

16.1 Right of access

You may ask whether we process your personal information and request a copy of the personal information we hold about you, together with related information about how it is used.

16.2 Right to rectification

You may ask us to correct inaccurate personal information or complete information that is incomplete.

16.3 Right to erasure

You may ask us to delete personal information in certain circumstances.

This right does not apply where we need to retain the information for a lawful reason, such as complying with a legal obligation, performing an ongoing contract or establishing, exercising or defending legal claims.

16.4 Right to restrict processing

You may ask us to restrict how we use personal information in certain circumstances, including while the accuracy or lawfulness of the processing is being considered.

16.5 Right to object

You may object to processing based on legitimate interests.

Where you object, we will stop the relevant processing unless we have compelling legitimate grounds to continue or the processing is needed for legal claims.

You may object to direct marketing at any time. We will stop using your personal information for direct marketing when you do so.

16.6 Right to data portability

In certain circumstances, you may ask to receive personal information that you provided to us in a structured, commonly used and machine-readable format or ask us to transmit it to another organisation.

This right normally applies only to automated processing based on consent or contract.

16.7 Right to withdraw consent

Where we rely on consent, you may withdraw it at any time.

Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

16.8 Rights concerning automated decisions

You may have rights in relation to decisions made solely by automated processing that produce legal or similarly significant effects.

Ambos does not currently use personal information to make solely automated decisions that produce legal or similarly significant effects on website visitors, customers or prospective customers.

16.9 Exercising your rights

To exercise a right, contact us using:

Email: hello@ambos.uk
Telephone: 0800 774 7025

Or write to:

Privacy Contact
Ambos Digital Ltd
Unit 14, Tower Street
Brunswick Business Park
Liverpool
L3 4BJ

You do not normally need to pay a fee to exercise your rights. We may charge a reasonable fee or decline to act where permitted by law if a request is manifestly unfounded or excessive.

16.10 Verification

We may ask for information needed to verify your identity and ensure that personal information is not disclosed to an unauthorised person.

We may also ask you to clarify your request where this is reasonably necessary to locate the relevant information or understand what you require.

16.11 Response time

We will respond without undue delay and normally within one month.

The response period may be extended where permitted by law if a request is particularly complex or multiple requests have been made. We will tell you if an extension is required.

16.12 Information processed for a customer

If your request concerns information processed by Ambos solely on behalf of one of our customers, you should normally direct the request to that customer as the relevant data controller.

Where appropriate, we will forward the request to the customer or tell you how to contact it.

17. Data protection complaints

17.1 Complaining to Ambos

You may complain to us if you believe we have handled your personal information incorrectly, failed to respect your rights or otherwise failed to comply with data protection law.

Please send your complaint to:

Email: hello@ambos.uk

Or write to:

Privacy Contact
Ambos Digital Ltd
Unit 14, Tower Street
Brunswick Business Park
Liverpool
L3 4BJ

Please include:

• your name and contact details;
• a clear description of the complaint;
• the relevant dates and events;
• details of any previous correspondence; and
• the outcome you are seeking.

17.2 How we handle complaints

We will:

• acknowledge your complaint without undue delay;
• take reasonable steps to investigate it;
• keep you informed where the investigation is likely to take time;
• respond with the outcome without undue delay; and
• explain any action we have taken or why no further action is considered necessary.

We may ask you for further information where reasonably necessary to investigate the complaint.

17.3 Complaining to the Information Commissioner

You also have the right to complain to the Information Commissioner’s Office, the UK regulator for data protection.

You do not have to complain to Ambos before approaching the Information Commissioner’s Office, although we would appreciate the opportunity to investigate and resolve your concerns.

The Information Commissioner’s Office can be contacted at:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 0303 123 1113
Website: Information Commissioner’s Office

18. Personal data breaches

We maintain procedures for assessing and responding to suspected personal data breaches.

Where we determine that a breach creates a risk to individuals, we will take the action required by applicable data protection law. This may include notifying the Information Commissioner’s Office and, where the legal threshold is met, affected individuals.

Where Ambos is processing information on behalf of a customer, we will notify that customer of a confirmed personal data breach affecting the customer’s information without undue delay after becoming aware of it.

The customer, as controller, will normally be responsible for determining whether notification to the regulator or affected individuals is required.

19. Automated systems and artificial intelligence

We may use software and automated tools to support ordinary business activities, including:

• spam and malware detection;
• website security;
• email filtering;
• analytics;
• technical monitoring;
• content assistance;
• diagnostic analysis; and
• administrative efficiency.

These tools do not currently make solely automated decisions about website visitors, prospective customers or customers that produce legal or similarly significant effects.

Where an artificial-intelligence service or another external tool is used to process personal information, we will consider the purpose, necessity, security, supplier terms, confidentiality and applicable data protection requirements.

Customers should not provide unnecessary personal, confidential or special-category information for use with an artificial-intelligence system unless its use has been specifically agreed and appropriate safeguards are in place.

20. Children’s information

Our website and services are intended for businesses, organisations and professional contacts. They are not directed at children.

We do not knowingly collect personal information directly from children through this website.

If you believe that a child has provided personal information to us without appropriate authority, please contact us so that we can investigate and take appropriate action.

We may process children’s information on behalf of a customer where it is contained within a website, application or system that we host, maintain or support. In those circumstances, the customer is responsible for determining the lawful basis and providing the required privacy information.

21. Links to third-party websites

Our website may contain links to websites, applications or services operated by third parties.

We do not control those third parties and are not responsible for their privacy practices. You should read the privacy information provided by the relevant third party before providing personal information or using its service.

22. Social media and professional platforms

If you interact with Ambos through LinkedIn, Facebook, Instagram or another social or professional platform, both Ambos and the platform operator may process information relating to that interaction.

The platform operator’s use of your information is governed by its own privacy policy, account settings and terms.

Information you post publicly may be visible to other users and should not be treated as private or confidential.

23. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect:

• changes to our services;
• changes to how we process personal information;
• changes to suppliers and technologies;
• changes to legal or regulatory requirements; or
• improvements to the clarity of the policy.

The latest version will be published on this page with an updated revision date.

Where a change is material, we will take reasonable steps to bring it to the attention of affected individuals. The method used will depend on the nature of the change and our relationship with those individuals.

24. Contact us

Questions, requests and complaints concerning this Privacy Policy or our use of personal information should be directed to:

Privacy Contact
Ambos Digital Ltd
Unit 14, Tower Street
Brunswick Business Park
Liverpool
L3 4BJ

Email: hello@ambos.uk
Telephone: 0800 774 7025

Ambos Digital Ltd is registered in England and Wales under company number 07900690.