Privacy Policy

Business Name: JM MEDIA GROUP LTD Trades as: JM Digital

Contact Email: hello@jordan-martins.com

1. Introduction

This Data Protection Policy outlines how Jordan Martins ("I", "me", "my") collects, processes, and protects data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. As a sole trader providing web design and development services, I am committed to ensuring the security and privacy of my clients' data.

2. My Role Under UK GDPR

Depending on the context, I act in two capacities:

Data Controller: When collecting and storing your business contact information for the purposes of communication, invoicing, and contract management.

Data Processor: When interacting with data or systems on your behalf to build, design, or maintain your website (e.g., handling your website assets, migrating content, or setting up hosting).

3. Data I Collect and Process

To deliver web design and development services, I may process the following types of B2B data:

Identity & Contact Data: Names, business email addresses, phone numbers, and business addresses of clients and their representatives.

Technical & Access Data: Login credentials, API keys, and server access details necessary to build and deploy your website.

Website Content Data: Text, images, and other digital assets provided by you for inclusion on the website.

4. Special Category (Sensitive) Data

As a web developer, I do not intentionally collect or process Special Category Data (including patient medical records, health data, or personal biometric data). Any forms or data-capture mechanisms built into the client's website (e.g., patient inquiry forms) route directly to the client's secure email or internal systems. I do not store or intercept this data.

5. How I Protect Your Data

I implement strict security measures to protect client data against unauthorized access, loss, or alteration:

Access Control: I operate as a sole trader; therefore, I am the only individual with access to your project files and credentials.

Credential Security: All client passwords and access tokens are stored in a secure, encrypted password manager.

Device Security: All work is conducted on password-protected, encrypted devices using up-to-date antivirus software.

Sub-Processors: I use industry-standard, GDPR-compliant third-party services to deliver my work (e.g., Framer for website hosting and development). I ensure these platforms maintain robust data protection standards.

6. Data Retention

I retain personal and project data only for as long as necessary to fulfill the purposes outlined in this policy:

Access Credentials: Securely deleted immediately upon handover of the website or termination of the maintenance contract.

Project Assets: Kept for up to [e.g., 60 days] post-launch to ensure a smooth transition, after which local copies are securely deleted.

Financial & B2B Records: Invoices and basic business correspondence are retained for 7 years to comply with HMRC tax requirements.

7. Data Sharing

I do not sell, rent, or trade your data to third parties. Data is only shared with compliant third-party platforms (such as hosting providers like Framer or email providers like Google Workspace) strictly for the purpose of executing the agreed-upon services.

8. Your Data Protection Rights

Under UK GDPR, you have the following rights regarding your data:

The right to access: You can request a copy of the data I hold about you.

The right to rectification: You can request that I correct any inaccurate data.

The right to erasure: You can request that I delete your data (subject to legal/tax retention requirements).

The right to restrict processing: You can request that I limit the processing of your data.

To exercise any of these rights, please contact me at [Your Email Address]. I will respond to all requests within 30 days.