Privacy Policy

Last updated: 17 July 2026

Introduction and Scope

This Privacy Policy describes how SIGNALMD LTD ("we", "us", "our"), a company registered in England and Wales with its registered office at 124-128 City Road, London, EC1V 2NX, United Kingdom, collects, uses, stores, shares, and protects personal data when you visit our website at https://signalmd.pro, use our services, or otherwise interact with us. We are committed to protecting your privacy and processing personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and all other applicable data protection legislation.

As a provider of e-commerce platforms, cloud hosting, data processing solutions, and managed IT services, we process personal data in multiple contexts including website operations, client service delivery, employment, and business administration. This policy applies to all personal data processing activities undertaken by SIGNALMD LTD unless a separate privacy notice applies to a specific service or processing activity.

We encourage you to read this Privacy Policy carefully to understand our practices regarding your personal data. By using our website or services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our data processing practices, please do not use our website or services.

Data Controller Information

SIGNALMD LTD is the data controller responsible for personal data collected through our website and for personal data processed in connection with our direct client relationships. Our contact details are: SIGNALMD LTD, 124-128 City Road, London, EC1V 2NX, United Kingdom, United Kingdom. Email: office@signalmd.pro. Phone: +44 7700 900077.

For personal data processed on behalf of our clients through our cloud hosting, data processing, and managed IT services, we act as a data processor and process data in accordance with our clients' instructions and applicable data processing agreements.

If you have questions about this Privacy Policy or wish to exercise your data protection rights, please contact us using the details above. We have appointed internal data protection responsibilities and maintain procedures for handling data subject requests and supervisory authority communications.

Categories of Personal Data We Collect

We collect and process the following categories of personal data depending on your relationship with us and the services you use:

Identity and contact data including name, job title, company name, email address, telephone number, postal address, and billing address. This data is collected when you submit contact forms, request services, enter into contracts, or communicate with us.

Technical data including IP address, browser type and version, operating system, device identifiers, time zone setting, browser plug-in types and versions, and other technology on the devices you use to access our website. This data is collected automatically through cookies and similar technologies.

Usage data including information about how you use our website and services, pages visited, time spent on pages, navigation paths, click patterns, and interaction with website features.

Communication data including records of correspondence when you contact us by email, phone, contact form, or other channels, including the content of your messages and our responses.

Transaction data including details of services purchased, payment information processed through third-party payment providers, invoicing records, and contract details.

Professional data including business requirements, technical specifications, project documentation, and service configuration details provided during client engagements.

How We Collect Personal Data

We collect personal data through direct interactions when you complete forms on our website, correspond with us, request quotations, enter into service agreements, attend meetings, or participate in consultations.

We collect data automatically through cookies, server logs, analytics tools, and similar technologies when you browse our website. Please refer to our Cookie Policy for detailed information about the cookies we use.

We may receive personal data from third parties including business partners, referral sources, publicly available registers, credit reference agencies where applicable, and service providers who assist in delivering our services.

When providing managed IT services, cloud hosting, or data processing solutions, we may process personal data contained within client systems in accordance with our data processing agreements and client instructions.

Purposes and Legal Bases for Processing

We process personal data for the following purposes and on the following legal bases under UK GDPR:

Service delivery and contract performance: Processing necessary to perform contracts with our clients, provide e-commerce platforms, cloud hosting, data processing, managed IT services, and IT consulting, manage accounts, and deliver requested services. Legal basis: Article 6(1)(b) — performance of a contract.

Website operation and improvement: Processing to operate, maintain, secure, and improve our website, analyse usage patterns, and enhance user experience. Legal basis: Article 6(1)(f) — legitimate interests in operating an effective business website.

Communication and customer support: Processing to respond to inquiries, provide technical support, send service-related communications, and manage client relationships. Legal basis: Article 6(1)(b) for contractual communications; Article 6(1)(f) for general business communications.

Marketing: Processing to send information about our services where you have opted in or where we have a legitimate interest and you have not opted out. Legal basis: Article 6(1)(a) — consent; or Article 6(1)(f) — legitimate interests.

Legal and regulatory compliance: Processing necessary to comply with legal obligations including tax, accounting, anti-money laundering, and regulatory reporting requirements. Legal basis: Article 6(1)(c) — legal obligation.

Security and fraud prevention: Processing to protect our systems, networks, services, and users from security threats, unauthorised access, and fraudulent activity. Legal basis: Article 6(1)(f) — legitimate interests in maintaining security.

Data Sharing and Disclosure

SIGNALMD LTD does not sell personal data to third parties. We share personal data only in the following circumstances:

Service providers and processors who assist in delivering our services, including cloud infrastructure providers, payment processors, email service providers, analytics providers, and professional advisers. All processors are bound by data processing agreements requiring appropriate security measures.

Business partners where necessary to deliver integrated services requested by clients, subject to appropriate confidentiality and data protection arrangements.

Professional advisers including lawyers, accountants, auditors, and insurers where necessary for legitimate business purposes.

Regulatory authorities, law enforcement, courts, and government bodies where required by law or to protect our legal rights.

In connection with corporate transactions such as mergers, acquisitions, or asset sales, where personal data may be transferred to the acquiring entity subject to equivalent data protection commitments.

International Data Transfers

Some of our service providers and infrastructure partners may process personal data outside the United Kingdom. Where we transfer personal data internationally, we ensure appropriate safeguards are in place including UK International Data Transfer Agreements, Standard Contractual Clauses, adequacy decisions, or other mechanisms approved under UK data protection law.

We maintain records of international transfers and review transfer mechanisms regularly to ensure continued compliance with evolving regulatory requirements.

Data Security

SIGNALMD LTD implements appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, destruction, and loss. These measures include encryption of data in transit and at rest where appropriate, access controls and authentication mechanisms, network security monitoring, regular security assessments, employee training, and incident response procedures.

While we implement industry-standard security measures, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security but commit to maintaining and improving our security practices.

Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, comply with legal obligations, resolve disputes, and enforce agreements. Retention periods vary depending on the category of data and applicable requirements.

Contact form submissions are retained for twenty-four months unless a business relationship develops. Client data is retained for the duration of the contract plus seven years for accounting and legal purposes. Website analytics data is retained for twenty-six months. Marketing consent records are retained for the duration of consent plus three years.

Your Rights

Under UK GDPR, you have the following rights regarding your personal data:

Right of access: Request confirmation of whether we process your personal data and obtain a copy.

Right to rectification: Request correction of inaccurate or incomplete personal data.

Right to erasure: Request deletion of personal data in certain circumstances.

Right to restrict processing: Request limitation of processing in certain circumstances.

Right to data portability: Receive personal data in a structured, commonly used, machine-readable format where processing is based on consent or contract and carried out by automated means.

Right to object: Object to processing based on legitimate interests or for direct marketing purposes.

Rights related to automated decision-making: Not be subject to decisions based solely on automated processing that produce legal or similarly significant effects.

To exercise any of these rights, contact us at office@signalmd.pro. We respond within one month. You also have the right to lodge a complaint with the Information Commissioner's Office at ico.org.uk.

Changes to This Policy

We may update this Privacy Policy periodically to reflect changes in our practices, services, or legal requirements. Updated versions will be posted on this page with a revised date. We encourage you to review this policy regularly.

For material changes affecting how we process your personal data, we will provide additional notice where appropriate, such as through email notification or a prominent notice on our website.

Contact Us

If you have questions about this Privacy Policy or our data processing practices, contact SIGNALMD LTD at office@signalmd.pro, +44 7700 900077, or 124-128 City Road, London, EC1V 2NX, United Kingdom.

Data Retention Schedules

SIGNALMD LTD maintains documented retention schedules for all categories of personal data processed through our services. Retention periods are determined by the nature of the data, the purpose for which it was collected, applicable legal requirements, and contractual obligations to our clients. When retention periods expire, data is securely deleted or anonymised using industry-standard methods verified through our internal audit processes.

These practices apply uniformly across all SIGNALMD LTD operations including e-commerce platform development, cloud hosting services, data processing solutions, managed IT services, and IT consulting engagements delivered from our London office at 124-128 City Road, London, EC1V 2NX, United Kingdom.

Cross-Border Data Transfers

Where personal data is transferred outside the United Kingdom, SIGNALMD LTD ensures appropriate safeguards are in place as required by UK data protection legislation. These safeguards may include Standard Contractual Clauses approved by the Information Commissioner's Office, adequacy decisions, binding corporate rules, or explicit consent from the data subject where applicable.

Children's Privacy

Our services are designed for business clients and are not directed at individuals under the age of eighteen. SIGNALMD LTD does not knowingly collect personal data from children. If we become aware that we have collected personal data from a child without appropriate parental consent, we will take steps to delete that information promptly.

Automated Decision Making

SIGNALMD LTD may use automated processing in certain service delivery contexts, such as infrastructure monitoring, threat detection, and performance optimisation. Where automated decision-making produces legal or similarly significant effects on individuals, we provide meaningful information about the logic involved and enable data subjects to request human intervention.

Third-Party Processors

We engage carefully selected third-party processors to assist in delivering our services. All processors are bound by written data processing agreements that require them to implement appropriate technical and organisational measures, process data only on our documented instructions, and assist us in fulfilling our obligations to data subjects and supervisory authorities.

Security Incident Response

In the event of a personal data breach, SIGNALMD LTD follows a documented incident response procedure that includes containment, assessment, notification to supervisory authorities within seventy-two hours where required, communication to affected data subjects without undue delay where the breach poses a high risk, and post-incident review to prevent recurrence.

Data Subject Rights Procedures

Data subjects may exercise their rights under UK GDPR by contacting us at office@signalmd.pro. We respond to valid requests within one month, extendable by two further months where requests are complex or numerous. Identity verification may be required before processing requests. We provide information about request outcomes and explain any refusal with reference to applicable legal grounds.

Privacy by Design

SIGNALMD LTD integrates privacy considerations into the design and development of our services from the outset. We conduct data protection impact assessments for processing activities likely to result in high risk to individuals, implement data minimisation principles, and ensure default privacy settings provide the highest level of protection practicable.

Record Keeping

We maintain records of processing activities as required by Article 30 of UK GDPR. These records document the purposes of processing, categories of data subjects and personal data, recipients of data, retention periods, security measures, and details of cross-border transfers where applicable.

Supervisory Authority

The Information Commissioner's Office (ICO) is the supervisory authority for data protection matters in the United Kingdom. Data subjects have the right to lodge a complaint with the ICO if they believe their personal data has been processed in violation of applicable legislation. Contact details for the ICO are available at ico.org.uk.