Privacy Policy

‍Last reviewed: 29 June 2026

Next scheduled review: June 2027

1. Introduction

redk is committed to protecting personal data and ensuring compliance with applicable data protection laws, including the UK General Data Protection Regulation (UK GDPR) and the EU General Data Protection Regulation (EU GDPR), together with applicable national implementing legislation.

This Privacy Policy explains how redk collects, uses, shares, and protects personal data in connection with its website, business activities, and services. It applies to current, past and prospective employees, customers, website users and visitors, newsletter subscribers, and other stakeholders.

redk may update this Privacy Policy from time to time. The latest version will always be available on this page. We recommend reviewing it periodically. This policy supersedes all previous versions.

2. redk as a group

redk operates through two legal entities, each acting as an independent data controller in relation to personal data processed within its own business activities:

redk CRM Solutions Ltd (United Kingdom) — Company Registration number: 9762485,
167–169 Great Portland Street, 5th Floor, London W1W 5PF
redk Ingeniería del Software S.L. (Spain) — Company Registration number: B91416867,
Gran Vía 4, Madrid 28013, Spain

‍

This Privacy Policy applies across both entities where they act as independent data controllers. redk operates using shared systems, infrastructure, and staff. As a result, personal data may be accessed and processed across both entities strictly for operational, administrative, and service delivery purposes. This includes shared IT systems and cloud environments, centralised HR and IT support, and cross-team collaboration in delivering services to clients.

Where redk processes personal data on behalf of its clients (for example, when providing CRM support services), redk acts as a data processor. In those circumstances, the relevant client remains the data controller and is responsible for providing appropriate privacy information to their own data subjects.

3. How we collect your personal data

We collect personal data in the following ways:

When you visit our website, including through cookies and similar technologies (see Section 7)
When you contact us or submit an enquiry via our website contact form or by email
When you engage with redk as a business contact, prospective customer, or client
When you apply for a role at redk
When you subscribe to our newsletters or marketing communications

‍

4. Categories of personal data we collect

redk collects and processes the following categories of personal data:

Contact and business enquiries

When you contact redk or submit a form, we collect: name, company name, job title, email address, telephone number, and the details of your enquiry or communication.

Website usage data

When you use our website, we collect: IP address, browser type and version, device information, pages visited, time spent on pages, and interaction data. This data is collected via cookies and analytics tools including Google Analytics (see Section 7).

Contract and service delivery data

When delivering services under contract, we process: name, contact details, project correspondence, and billing information.

Employment and recruitment data

For job applicants and employees, we process: name, contact details, CV and employment history, qualifications, and other information provided in the course of the application or employment relationship.

5. Why we process your data, our legal basis, and how long we keep it

The table below sets out each processing activity, the categories of personal data involved, the applicable legal basis under Article 6 of the UK GDPR and EU GDPR, and the retention period. Each processing activity is supported by a specific and documented lawful basis.

Purposes for processing personal data
Purpose of processing	Categories of personal data	Legal basis	Retention period
Responding to website enquiries and contact form submissions	Name, email, phone, company, job title, enquiry content	Legitimate interests (Art. 6.1(f) UK GDPR / EU GDPR)	2 years from last contact
Managing ongoing communications with customers and business contacts	Name, email, phone, company, job title	Performance of a contract (Art. 6.1(b))	Duration of relationship + 6 years
Delivering CRM consultancy, implementation and customer support services	Name, email, contact details, project correspondence	Performance of a contract (Art. 6.1(b))	6 years from end of contract
Sending marketing communications and newsletters	Name, email, marketing preferences	Consent (Art. 6.1(a)) / Legitimate interests where soft opt-in applies	Until consent withdrawn or opt-out received
Website analytics and performance monitoring	IP address, browser/device information, pages visited, interaction data	Consent (Art. 6.1(a))	Anonymised after 26 months (Google Analytics default)
Security monitoring and fraud prevention	IP address, access logs, system events	Legitimate interests (Art. 6.1(f))	Minimum of 1 year for logs and key event alerts; longer where required for investigation or forensic purposes
Compliance with legal and regulatory obligations	As required by applicable law, such as tax or employment information	Legal obligation (Art. 6.1(c))	As required by law, typically 6–7 years
Job applications	Name, contact details, CV, employment history, qualifications	Legitimate interests (Art. 6.1(f))	Unsuccessful applications: 6 months. Successful applications: duration of employment + 6 years

Where we rely on consent as the lawful basis, you have the right to withdraw that consent at any time by contacting us at gdpr@redk.net. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

Where we rely on legitimate interests, we have assessed that our interests are not overridden by your rights and freedoms. You may request details of this assessment at any time.

At the end of the applicable retention period, personal data is securely deleted or anonymised.

6. Special category personal data

redk does not collect special category personal data (such as health data, racial or ethnic origin, religious beliefs, biometric data, or data concerning sexual orientation) through its website or general business activities.

Where the nature of specific activities — such as employment — requires the processing of special category data, this is handled in accordance with applicable data protection law and with appropriate safeguards, including an explicit condition under Article 9 UK GDPR or EU GDPR as applicable. We will inform you separately at the point of collection if this applies.

7. Cookies and tracking technologies

Like many websites, redk.net uses cookies and similar tracking technologies to improve your browsing experience, analyse site traffic, and support our marketing activities. Cookies are small text files placed on your device when you visit our website.

We use the following categories of cookies:

Strictly necessary cookies – essential for the website to function correctly. These do not require your consent.
Analytics cookies – help us understand how visitors use the site. We use Google Analytics for this purpose, which may set cookies on your device and collect data about your interaction with the website.
Marketing and preference cookies – used to deliver relevant advertising and track campaign performance. These are only set with your consent.

‍

You can manage or withdraw your consent to non-essential cookies at any time via our cookie settings banner or your browser settings. Note that disabling certain cookies may affect website functionality.

For full details of the cookies we use, how long they last, and how to manage them, please see our Cookie Policy: https://www.redk.net/cookie-policy

8. How we share your data and international transfers

We do not sell your personal data to third parties. The table below sets out all recipients with whom we may share personal data, the purpose of each disclosure, and the country in which the recipient is located or hosts data.

‍

Recipients and categories with whom personal data may be shared
Recipient / category	Purpose of sharing	Country
Microsoft (Azure / M365)	Cloud infrastructure, email, collaboration tools	UK, EEA (Ireland, Netherlands); some data may transit US data centres
Google Analytics	Website analytics and performance monitoring	USA
Website hosting provider	Hosting of redk.net	UK / EEA
IT support providers	Technical support and system maintenance	UK / EEA
Billing and accounting software	Invoice and financial record management	EEA
Newsletter / email marketing platform	Marketing and newsletter communications	USA
Backup services	Data resilience and disaster recovery	UK / EEA
Event organisation platforms	Webinars, conferences and events	UK / EEA / USA
Professional advisers (lawyers, auditors, insurers)	Legal, financial and regulatory compliance	UK / EEA
Regulatory and law enforcement authorities	Where required by applicable law	UK / EEA

Transfers of personal data between the redk group entities (UK and Spain) take place as part of our shared operational infrastructure. Transfers from the UK entity to the Spanish entity are covered by the UK’s adequacy regulations in respect of EEA countries. Transfers from the Spanish entity to the UK entity are covered by the European Commission’s adequacy decision in respect of the UK.

Some of our service providers may process personal data outside the United Kingdom or the European Economic Area (EEA), including in countries that do not benefit from an adequacy decision.

Where personal data is transferred internationally, redk ensures that appropriate safeguards are in place in accordance with applicable data protection laws. Depending on the circumstances, these safeguards may include:

an adequacy decision issued by the UK Government or the European Commission;
the UK International Data Transfer Agreement (IDTA);
the UK Addendum to the EU Standard Contractual Clauses; or
the EU Standard Contractual Clauses (SCCs).

You may request further information about the safeguards we rely upon, including a copy of the relevant transfer mechanism where applicable, by contacting us at gdpr@redk.net.

All third-party processors are bound by data processing agreements in accordance with Article 28 UK GDPR and EU GDPR. They may only use your data for the purposes we specify, must keep it secure, and must delete or return it when our relationship ends.

9. How we protect your personal data

redk implements appropriate technical and organisational measures to protect personal data against accidental loss, unauthorised access, disclosure, alteration, or destruction. Our security measures include:

Role-based access controls limiting data access to authorised personnel only
Secure Microsoft cloud environment (Azure / M365)
Monitoring and logging of system access
Internal data protection and information security policies, reviewed at least annually
Data protection impact assessments (DPIAs) for new or significantly changed systems

Please note that the transmission of information over the internet is not completely secure. Whilst we make every effort to protect your data in transit and at rest, any transmission is at your own risk.

10. Your rights

Under UK GDPR and EU GDPR, you have the following rights regarding your personal data, including:

The right to access your personal data
Right to rectification of your personal data
Right to erasure
Right to object
Right to restrict processing
Right to withdraw consent at any time
Right to data portability
Right not to be subject to automated decision making
Right to complain to the data controller

To exercise any of these rights, please contact us using the details in Section 12. We may ask you to verify your identity before acting on a request.

Where a request is manifestly unfounded or excessive (including repetitive requests), we reserve the right to charge a reasonable administrative fee or decline to act, in accordance with Article 12(5) UK GDPR / EU GDPR. We will notify you if this is the case.

11. Supervisory authorities and complaints

You have the right to lodge a complaint with the relevant data protection supervisory authority if you believe redk has not handled your personal data in accordance with applicable law. We would welcome the opportunity to address your concerns directly in the first instance — please contact us at gdpr@redk.net before escalating. You also have the right to complain to the relevant supervisory authority if you believe your data has been used unfairly.

United Kingdom – Information Commissioner’s Office (ICO)

Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

Tel: 0303 123 1113

Website: www.ico.org.uk

redk CRM Solutions Ltd is registered with the ICO under data protection registration number ZB598398.

Spain – Agencia Española de Protección de Datos (AEPD)

C/ Jorge Juan, 6, 28001 Madrid, Spain

Tel: +34 912 663 517

Website: www.aepd.es

12. Data Protection Officer and contact details

redk has appointed an external Data Protection Officer (DPO). If you have any questions about this Privacy Policy, wish to exercise your rights, or have concerns about how we handle your personal data, you may contact our DPO directly:

‍

Data Protection People Limited

The Tannery, 91 Kirkstall Road, Leeds LS3 1HS

Email: info@dataprotectionpeople.com

Tel: 0113 869 1290

‍

You may also contact the redk privacy team directly:

‍

redk CRM Solutions, Ltd

167–169 Great Portland Street, 5th Floor, London W1W 5PF

Email: gdpr@redk.net

Tel: +44 2035 877 753

Website: www.redk.net

13. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal obligations, or operational requirements. Any changes will be posted on this page with an updated “Last reviewed” date. Material changes will be communicated to affected individuals where possible.

This policy is reviewed at least annually. The next scheduled review is June 2027.

‍