Privacy & Cookie Policy

16 Interactive Ltd — Effective: April 2025 — ICO Registration: Z2429286

Introduction

16 Interactive Ltd (“16i”, “we”, “us”, or “our”) is committed to protecting your personal data and respecting your privacy. This Privacy and Cookie Policy explains what personal data we collect, how we use it, your rights, and how we comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This policy applies to all visitors, clients, and contacts who interact with our website (www.16i.co.uk), our products, and our services. By using our website or services you acknowledge this policy.

Who We Are (Data Controller)

16 Interactive Ltd is the data controller responsible for your personal data.

• Company name: 16 Interactive Ltd

• Company number: 05432278

• VAT number: GB 991 173 109

• Registered address: 6 Rockfield Business Park, Old Station Drive, Cheltenham, Gloucestershire, GL53 0AN

• ICO registration reference: Z2429286

• Data protection contact: privacy@16i.co.uk

Personal Data We Collect

Data you provide directly

• Contact information: name, email address, telephone number, postal address, job title.

• Account details: usernames and credentials for any client portal or system we operate.

• Communications: content of emails, enquiry forms, or feedback you send us.

• Transactional data: records of services purchased and payment references. We do not store full card numbers.

Data collected automatically

• Technical data: IP address, browser type and version, operating system, device identifiers.

• Usage data: pages viewed, time on page, referring URLs, click paths.

• Cookie data: as described in the Cookie Policy section below.

Data from third parties

• Business contact data from publicly available sources (e.g. LinkedIn, company websites) for B2B marketing purposes.

• Analytics and advertising data from platforms such as Google Analytics and Google Ads, subject to their own privacy terms.

How We Use Your Personal Data

We process your personal data for the following purposes, each tied to a lawful basis under UK GDPR:

• Provide and administer our website and services — Contract; Legitimate interests

• Respond to enquiries and contact form submissions — Legitimate interests

• Process orders and manage client accounts — Contract; Legal obligation

• Send service updates, invoices, and operational communications — Contract

• Send marketing communications — Consent; Legitimate interests

• Analyse website usage and improve our services — Legitimate interests; Consent (analytics cookies)

• Personalise content and advertising — Consent

• Comply with legal and regulatory obligations — Legal obligation

• Detect and prevent fraud and maintain security — Legitimate interests; Legal obligation

Where we rely on legitimate interests, we have carried out a balancing test to ensure our interests do not override your rights and freedoms. You may request details of this test by contacting us.

Sharing Your Personal Data

We do not sell, rent, or trade your personal data. We may share it with:

• Service providers acting as data processors on our behalf (e.g. cloud hosting, analytics, email delivery, payment processors). All processors are bound by data processing agreements.

• Professional advisers such as solicitors, accountants, and insurers where necessary.

• Regulatory bodies and law enforcement where required by law or court order.

• Prospective acquirers or investors in the event of a business sale or restructuring, subject to confidentiality obligations.

International Data Transfers

Some of our third-party service providers may process your data outside the UK or EEA. Where such transfers occur we ensure appropriate safeguards are in place, including UK International Data Transfer Agreements (IDTAs), UK Addenda to EU Standard Contractual Clauses (SCCs), or transfers only to countries with a UK adequacy decision.

Data Retention

• Client and contract records: 7 years from end of contract (tax and accounting obligations).

• Enquiry and contact form data: 2 years from last contact unless a business relationship develops.

• Marketing consent records: 3 years from last engagement or until consent is withdrawn.

• Website analytics data: up to 26 months (in line with Google Analytics defaults).

• Cookies: as specified in the Cookie Policy section below.

When data is no longer required it is securely deleted or anonymised.

Cookie Policy

Our website uses cookies and similar technologies. Cookies are small text files placed on your device that help us operate the site, understand how it is used, and deliver relevant content and advertising.

Categories of cookies we use

Category	Purpose & examples	Duration	Consent required?
Strictly Necessary	Essential for the site to function. Session management, security tokens, cookie consent preferences.	Session or up to 1 year	No
Analytical / Performance	Help us understand visitor behaviour. Google Analytics 4 (_ga, _gid, _gat).	Up to 2 years	Yes
Functional / Personalisation	Remember your preferences, e.g. language or region settings.	Up to 1 year	Yes
Marketing / Targeting	Deliver relevant ads and measure campaign performance. Google Ads (_gcl_*), LinkedIn Insight Tag, Meta Pixel.	Up to 2 years	Yes

Managing your preferences

When you first visit our website you will be shown a cookie consent banner where you can accept all cookies, accept only strictly necessary cookies, or customise your preferences by category. You can update your choices at any time via the cookie settings link in our footer.

You can also manage or delete cookies through your browser settings, though disabling certain cookies may affect site functionality. To opt out of interest-based advertising visit the IAB’s Your Online Choices tool.

Google Analytics

We use Google Analytics 4 with IP anonymisation enabled. You can opt out at any time by installing the Google Analytics Opt-out Browser Add-on. See Google’s Privacy Policy for more information.

Your Rights Under UK GDPR

As a data subject you have the following rights. We will respond to all valid requests within one calendar month (extendable by two further months for complex requests, with prior notice given):

• Right of access — request a copy of the personal data we hold about you.

• Right to rectification — request correction of inaccurate or incomplete data.

• Right to erasure — request deletion of your data where there is no compelling reason to continue processing it.

• Right to restrict processing — ask us to pause processing your data in certain circumstances.

• Right to data portability — receive your data in a structured, machine-readable format.

• Right to object — object to processing based on legitimate interests or for direct marketing (an absolute right for marketing).

• Rights related to automated decisions — not be subject to solely automated decisions that produce legal or significant effects.

• Right to withdraw consent — withdraw consent at any time where we rely on it, without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at privacy@16i.co.uk. We may need to verify your identity. There is no charge unless requests are manifestly unfounded or excessive.

Complaints & the ICO

If you have concerns about how we handle your personal data, please contact us first. You also have the right to lodge a complaint with the UK’s supervisory authority:

• Information Commissioner’s Office (ICO)

• Website: ico.org.uk

• Telephone: 0303 123 1113

• Post: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Security

We implement appropriate technical and organisational measures to protect your personal data, including encryption in transit (TLS/HTTPS) and at rest, role-based access controls, multi-factor authentication, regular security assessments, staff training, and Cyber Essentials certification.

In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and, where required, notify affected individuals without undue delay.

Children’s Privacy

Our website and services are not directed at children under the age of 13. We do not knowingly collect personal data from children under 13. If you believe a child has provided us with personal data without appropriate parental consent, please contact us and we will promptly delete it.

Third-Party Websites

Our website may contain links to third-party websites which operate under their own privacy policies. We are not responsible for those sites and encourage you to review their privacy policies before providing any personal information.

Direct Marketing

Where you have given consent, or where we have a legitimate interest in doing so (for example as an existing client), we may contact you about our products, services, and events. You may opt out at any time by clicking “unsubscribe” in any marketing email or by emailing privacy@16i.co.uk. Opting out does not affect transactional or service communications necessary to fulfil a contract with you.

Automated Decision-Making & Profiling

We do not make decisions about you using solely automated means that produce legal or similarly significant effects. If this changes we will update this policy and notify you.

Updates to This Policy

We review this policy regularly and will publish the latest version on our website. Where changes are material we will notify you by email or by displaying a prominent notice on our website. The effective date shown above indicates when this policy was last reviewed.

Contact Us

For any questions, requests, or concerns regarding this policy or our data processing activities:

• Email: privacy@16i.co.uk

• Telephone: +44 (0)1242 654 000

• Post: 16 Interactive Ltd, 6 Rockfield Business Park, Old Station Drive, Cheltenham, GL53 0AN

This policy is governed by the laws of England and Wales.