Effective date: 22 September 2026
Version: 1.0
This policy explains how 21six collects, uses and protects personal data. It covers the people we deal with in running our business: visitors to our website, contacts at our clients and prospective clients, contacts at our suppliers and contractors, and people who apply to work with us.
Who we are
21six is the trading name of 21 Six Limited, a company registered in England and Wales under company number 08739174. Our registered office is The Barn, Calcot Mount Business Park, Calcot Lane, Curdridge, Hampshire, SO32 2BN. We are a creative and digital agency providing brand strategy, creative, design, marketing, digital, web development and film and video production services to business clients.
For the personal data described in this policy we are the data controller. We are registered with the Information Commissioner’s Office under registration number ZB193630.
If you have a question about this policy, or about how we handle personal data, contact privacy@21six.com or write to the Chief Operating Officer at our registered office.
What this policy covers
This policy applies to 21 Six Limited. It does not cover 21six AB in Sweden, which is an independent company, or any other separate entity.
It does not cover personal data we handle on behalf of our clients. Where we work with personal data inside a client project, the client decides how that data is used and we act on their instructions. That relationship is described under Personal data we handle for our clients below.
Our own people are covered by a separate staff privacy notice.
The personal data we collect and why
Clients, prospective clients and suppliers
When you enquire about our services, work with us or supply services to us, we hold your name, job title, employer, email address, telephone number and postal address, together with our correspondence with you, project records, meeting notes and billing information.
We use it to respond to enquiries, prepare proposals, deliver and manage projects, raise invoices and keep accounting records, manage our suppliers and contractors, and maintain the records required by our quality and information security management system.
Our lawful bases are contract, where we are entering into or performing an agreement with you or your organisation; legitimate interests, in running our business and maintaining our client and supplier relationships; and legal obligation, where we are required to keep records, in particular for tax and accounting.
Website visitors
Our website is 21six.com. It is hosted on DigitalOcean infrastructure managed through Cloudways, in London data centres.
When you complete a form on our website we collect the details you give us, normally your name, company, email address, telephone number and your message. Our lawful basis is legitimate interests, in responding to enquiries about our services.
We use Google Analytics 4 to understand how the website is used. It records information such as the pages you view, time spent on a page, approximate location derived from your IP address, device, operating system and browser. Analytics cookies are set only where you accept them through our cookie banner, so our lawful basis is consent. You can change or withdraw that consent at any time through the cookie settings on the website.
Essential cookies keep the website working and record your cookie preferences. These are set without consent because the website cannot function without them.
We also use Snitcher, a business visitor identification service, to see which organisations visit our website. The Snitcher script loads only where you accept analytics cookies through our cookie banner, so our lawful basis is consent. If you reject non-essential cookies, or make no choice, it does not run.
Where it does run, Snitcher processes your IP address to identify the organisation behind the visit and its general location, together with behavioural data such as the pages you view, how you reached the site and how long you spend on it. It sets a first-party cookie named snitcher_device_id, which lasts one year, and stores session information in your browser as snitcher_session and snitcher_user_traits.
Information collected by Snitcher stays within Snitcher. We do not copy it into our marketing or sales systems. Snitcher processes and stores it in the European Union.
Our hosting provider keeps server logs, including IP addresses, for security and troubleshooting. Our lawful basis is legitimate interests, in keeping the website secure and available.
Marketing
We send updates and other marketing by email using GoHighLevel. We send them to contacts at our clients and at organisations we already deal with. We do not send unsolicited marketing to people we have no relationship with, and we do not buy marketing lists.
Our lawful basis is legitimate interests, in marketing our services to business contacts, and consent where consent is required. Every message includes an unsubscribe link, and you can ask us to stop at any time by replying or by contacting privacy@21six.com.
Job applicants
Applications reach us by email. We hold your CV, your covering message and anything else you send us, together with our notes and correspondence about your application. Our lawful bases are legitimate interests, in assessing candidates, and taking steps at your request before entering into a contract.
If we ask about a disability or an adjustment for interview, we use that information only to make the adjustment and to meet our obligations under employment law.
Personal data we handle for our clients
Much of our work involves websites, systems and campaigns that hold personal data belonging to our clients, for example enquiries submitted through a website we have built. In that work our client is the controller and we act as a processor on their documented instructions.
Before that processing starts we put a data processing agreement in place covering instructions, security, subprocessors, assistance, breach notification, international transfers and return or deletion. We do not use personal data held in client systems for our own purposes.
If you have a question about personal data held in a system we built or manage for one of our clients, contact that organisation directly. We will pass on any request we receive.
Who we share personal data with
We do not sell personal data. We share it only where it is necessary, with:
• our suppliers and service providers, who handle personal data on our behalf under contract
• our professional advisers, including our accountants, auditors and solicitors
• a purchaser or successor, if our business or part of it is sold or reorganised
• law enforcement, regulators or others, where we are required to share it by law
The main service providers we use are Google Workspace for email, documents and file storage, Synergist for project and client management, Slack for internal messaging, Xero for accounting, GoHighLevel for email marketing, and DigitalOcean through Cloudways for hosting.
We also work with a small number of contractors and freelancers on client accounts. They work under our policies and under confidentiality obligations.
Sending personal data outside the UK
Hosting for 21six.com, and for the client websites we manage, is in London.
Some of our service providers are based in the United States. Where personal data is transferred to them we rely on the UK Extension to the EU-US Data Privacy Framework where the provider is certified under it, or on the International Data Transfer Agreement issued by the Information Commissioner’s Office where it is not.
One of the contractors who works on client accounts is based in the Philippines, which is not covered by UK adequacy regulations. Transfers to that contractor are made under the International Data Transfer Agreement, supported by a transfer risk assessment.
How long we keep personal data
We keep client and supplier records, including contracts, project records and correspondence, for six years after the end of our relationship with that organisation. This matches our contractual and accounting record-keeping obligations.
Enquiries that do not become projects are kept for six years.
Marketing contacts are kept until you unsubscribe or ask us to stop.
Applications from candidates we do not appoint are kept for 12 months, so that we can consider you for other roles and answer any question about the recruitment process.
Website analytics data is kept for the retention period set in Google Analytics, currently 14 months.
How we protect personal data
We operate an information security management system aligned to ISO/IEC 27001. Access to systems is limited to the people who need it, accounts are individual, and each client’s work is kept separate. We review our security arrangements and our suppliers regularly.
If a personal data breach affects your information and is likely to result in a risk to you, we will tell you, and we will report it to the Information Commissioner’s Office where the law requires us to do so.
Artificial intelligence
We use approved artificial intelligence tools in parts of our work, under our AI governance policy. We do not put personal data or confidential information into unapproved or public generative AI services. Where we use AI tools with that information, we use only services whose terms and settings exclude it from training the supplier’s general models.
Your rights
You have the right to:
• ask for a copy of the personal data we hold about you
• ask us to correct information that is wrong or incomplete
• ask us to delete personal data where there is no good reason for us to keep it
• ask us to restrict how we use it while a question about it is resolved
• object to processing we carry out on the basis of legitimate interests
• object to direct marketing at any time
• ask us to transfer information you gave us to another organisation, where that right applies
• withdraw your consent at any time, where we rely on consent
To exercise any of these rights, contact privacy@21six.com. We will respond within one month. There is no charge. We may ask you to confirm your identity before we act.
We do not make decisions about you by automated means that produce legal effects or similarly significant effects.
Complaints
If you are unhappy with how we have handled your personal data, tell us first so that we can put it right. You also have the right to complain to the Information Commissioner’s Office, the UK supervisory authority for data protection, at ico.org.uk.
Changes to this policy
We review this policy at least once a year. Where we make a material change, we will publish the updated policy on 21six.com and show the new version and effective date here.