As of 5th May 2025
MGT Web Solutions Ltd (“MGT Web Solutions”, “we”, “us” or “our”) is committed to protecting your privacy. This Privacy Policy describes how we collect, use, store, and share your personal data when you use our services or visit our websites. It is intended to comply with applicable data protection laws internationally, including the EU General Data Protection Regulation (GDPR), the UK GDPR, and the Swiss Federal Data Protection Act (FADP). This policy applies to all websites operated by MGT Web Solutions through our domain extensions: mgt-solutions.co.uk, mgt-solutions.com, mgt-solutions.ch, mgt-solutions.fr, mgt-solutions.de, mgt-solutions.it, mgt-solutions.es, and mgt-solutions.pl (collectively, our “Websites”). By using our Websites or services, you agree to the practices described in this Privacy Policy.
We only collect personal data that is necessary for the purposes described in this policy. The types of information we may collect include:
Contact Information: When you interact with us (for example, by filling out a form or contacting us), we may collect personal identifiers such as your name and email address. This allows us to respond to inquiries and provide our services.
Payment Information: If you make a purchase or payment through our services, you will provide payment details (e.g. credit or debit card information). We do not store full payment card details on our systems. Payment transactions are securely processed by our third-party payment provider Stripe, which handles your card information and stores it securely in compliance with industry standards (e.g. PCI-DSS). Stripe is responsible for storing and protecting your payment data on our behalf. We only receive limited information necessary to confirm payment (such as a transaction ID or payment confirmation).
Cookies and Usage Data: When you visit our Websites, we use cookies and similar tracking technologies to collect data about your device and how you use our site. This may include your IP address, browser type, browser language, browsing behavior (such as pages visited, time spent on pages, click streams), and cookie identifiers. We also use analytics services (for example, Google Analytics) to gather statistical information about site usage. These tools may set their own cookies to collect information about how visitors navigate our site. All usage data collected via cookies and analytics is typically aggregated and does not directly identify you by name. For more details, see the Cookies and Tracking section below.
Other Information You Provide: If you communicate with us by email or by other means, or if you voluntarily submit information to us (such as by responding to surveys or providing feedback), we will collect any information you choose to share. This could include additional contact details, professional information, or the contents of your communications.
We do not knowingly collect any special categories of personal data (such as sensitive personal information about health, race, religion, etc.) in the ordinary course of our business. We also do not knowingly collect information from children under 18 (see Children’s Privacy below).
We will use your personal data only for legitimate business purposes, for the purposes for which it was collected, and in accordance with applicable law. The purposes for which MGT Web Solutions processes personal data include:
Providing and Improving Services: We use contact and payment information to set up and fulfill our services or contracts with you. This includes processing orders or subscriptions, managing user accounts, providing customer support, and responding to your inquiries. For example, we need your name and email to communicate with you about the services you request, and we need payment information to process transactions you have authorized. We may also use your data to operate, maintain, and improve our Websites and services (for instance, analysing how users navigate our site in order to improve design and content).
Communication: We may use your email address or other contact details to send you important notices or updates about your use of our services (for example, confirmations of transactions, responses to support requests, or changes to our terms or policies). These service-related communications are necessary for us to perform our contract with you or to meet our legitimate interests in keeping you informed. If you have opted in to receive marketing communications (such as newsletters or promotions), we will use your contact information to send those, but you can unsubscribe at any time.
Payments and Fraud Prevention: We use payment information to process your payments for our services and to keep appropriate records of those transactions. Payment data is handled via Stripe as noted, and we may also use transaction records to detect and prevent fraud or abuse of our services. This processing is necessary to perform the contract (fulfilling your order) and to meet our legal obligations related to financial reporting and fraud prevention.
Analytics and Personalisation: We use data collected through cookies and analytics (e.g. information about how you use our site) to understand user behavior and preferences. This helps us improve our Websites’ functionality, performance, and user experience. For example, analytics data may inform us which pages are most visited or if users encounter errors on certain pages, so we can fix issues. We may also use cookies to remember your preferences (like language selection) to personalise your experience. Where required by law, we will obtain your consent before using non-essential cookies or analytics tools on your device.
Legal Compliance and Enforcement: We may process and retain personal data as necessary to comply with our legal obligations. For example, we keep transaction records to meet tax and accounting requirements, and we may disclose information in response to lawful requests by public authorities or to comply with law enforcement or court orders. Additionally, if needed, we will use personal data to enforce our Terms of Service or to establish or defend legal claims.
We will not use your personal data for purposes that are incompatible with the ones outlined above without informing you and obtaining your consent if required. We do not engage in any automated decision-making or profiling that produces legal or similarly significant effects on you; all processing of your information involves some form of human review or is only used in aggregate form. If in the future we implement automated decision-making processes, we will update this policy to inform you and ensure such processing is carried out in accordance with the law.
Under applicable data protection laws (such as the GDPR and FADP), we must have a valid legal basis to process your personal data. Depending on the context, MGT Web Solutions relies on the following legal grounds:
Contractual Necessity: When we process personal data to provide you with our services or products, the legal basis is usually that the processing is necessary for the performance of a contract with you or to take steps at your request prior to entering into a contract. For example, we need to process your name, contact details, and payment information when you purchase a service, so that we can fulfill your order and provide the service you expect.
Consent: In certain cases, we rely on your consent to process personal data. For instance, we will seek your consent before setting non-essential cookies or using analytics that are not strictly necessary. Likewise, if we ever want to use your personal data for a new purpose not originally identified or to send you marketing emails, we will first obtain your explicit consent. Where processing is based on consent, you have the right to withdraw your consent at any time, and we will stop the processing in question. Withdrawing consent will not affect the lawfulness of any processing we already performed before you withdrew.
Legitimate Interests: We process certain personal data as necessary for our legitimate business interests, provided that those interests are not overridden by your data protection rights. For example, it is in our legitimate interest to understand how our customers use our website (through analytics) so we can improve our services, and to secure our Websites and prevent fraud or abuse. We also have a legitimate interest in communicating with you to answer your inquiries and provide customer support. When relying on this basis, we always consider your rights and ensure we do not infringe on your privacy in a way that is undue or unexpected.
Legal Obligation: Some processing is necessary for us to comply with a legal obligation. This includes retaining certain transaction records for tax, financial reporting, and audit purposes, or disclosing information to authorities if we are legally required to do so (for example, under a court order).
Other Bases: In rare cases, we might process data to protect someone’s vital interests (i.e., in life-threatening situations) or to perform a task in the public interest, but such cases are not typical in our day-to-day business. If they arise, we will only process personal data to the extent permitted or required by law.
We will clearly indicate at the point of data collection which legal basis applies if required. If you have questions about the legal basis for any specific processing of your personal data, feel free to contact us at the email addresses provided in the Contact section.
Requirement to Provide Data: You are not obligated to provide us with personal data. However, note that if you choose not to provide certain information, we may not be able to provide the related service. For example, if you do not provide a valid payment method, we cannot process a transaction; if you do not provide an email address, we cannot respond to your inquiry. We will inform you when personal data is necessary to perform a contract or comply with a legal requirement, and the consequences of failing to provide that data (typically, the inability for us to render the requested service).
Our Websites use cookies and similar technologies to distinguish you from other users and to improve your experience. A cookie is a small text file that is stored on your browser or device when you visit a website. We use the following categories of cookies:
Strictly Necessary Cookies: These cookies are essential for the website to function correctly and securely. They enable core functionality such as security, network management, and accessibility. For example, if our site has a login feature or remembers your language or region selection, necessary cookies would handle that. We do not require your consent for strictly necessary cookies, but we still want you to be aware of them. You can disable these cookies via your browser settings, but some parts of the site may not function properly without them.
Analytics/Performance Cookies: We use these cookies to collect information about how visitors use our Websites, in order to improve our services. For instance, we use Google Analytics which places cookies to gather anonymised statistics (such as number of visitors, pages visited, time spent on site). The information collected through analytics cookies is aggregated and does not directly identify you. It helps us understand user interactions and improve website performance. We will ask for your consent before setting analytics cookies, in compliance with applicable law on cookies and tracking. If you consent, these cookies will be activated; if you decline, we will not set them and your experience will not be tracked in this way.
Functionality Cookies: If applicable, these cookies allow our site to remember choices you make (such as your username, language, or region) and provide enhanced features. They may be set by us or by third-party providers whose services we have added to our pages. For example, if we integrate a chat support widget or social media plugin, those services might set a cookie to function. We will inform you and obtain consent if any such cookie is not strictly necessary.
Targeting/Advertising Cookies: MGT Web Solutions does not currently use advertising cookies or engage in targeted advertising on our Websites. We do not allow third-party advertisers to collect data about your browsing for advertising purposes. If this changes in the future, we will update our policy and obtain any necessary consents.
Cookie Consent: When you first visit our Websites from a region where cookie consent is legally required (such as the EU, UK, and Switzerland), you will see a cookie notice or banner. This banner will explain what cookies we use and will give you the option to accept or reject non-essential cookies. You can always manage your cookie preferences through this banner or through your browser settings. Most web browsers also allow you to delete cookies or prevent them from being placed. Please note that disabling all cookies (including necessary cookies) via your browser may affect the functionality of our site.
For more detailed information on the specific cookies we use, you can refer to our Cookies Notice (if available) or contact us. By continuing to use our Websites with cookies enabled in your browser, you consent to our use of cookies as described in this section.
We value your privacy. We do not sell your personal data to any third parties for their own commercial use. We also do not share your information with unrelated third parties for their independent marketing or other purposes. We will only disclose personal data in the following circumstances:
Service Providers (Processors): We may share personal data with trusted third-party service providers who perform services on our behalf, only to the extent necessary for those services. These third parties act under our instructions and are bound by contracts to protect your data and use it only for the agreed purpose. The key service providers we use include:
Stripe: As noted, Stripe processes payments for us. When you enter your payment details, that information is transmitted securely to Stripe. Stripe will process your payment and may store your payment data (e.g., card number, billing address) for purposes such as fraud prevention and payment authentication. Stripe is contractually obligated to handle your data securely and in compliance with applicable data protection laws. Please refer to Stripe’s own privacy policy for more information on how they handle personal data.
Google Services: We use Google LLC (and its affiliated entities) for multiple services, including data storage, business email, document management (Google Workspace), and website analytics (Google Analytics). This means personal data (such as emails you send to us, documents we create that contain your information, or analytics data about your site usage) may be stored or processed on Google’s servers. Google acts as our data processor for these services, and we have agreements in place (including the standard contractual clauses where applicable) to ensure your data is protected. Google will only access or use our data as necessary to provide the services and as permitted by data protection law.
We may also use other IT or cloud infrastructure providers, analytics tools, or email service providers in the normal course of business. For example, if we use an email newsletter service or customer support ticketing system, those providers might process some of your personal data (like your email or name) on our behalf. Any such providers are carefully vetted for security and privacy practices and are bound by data processing agreements.
Within Our Corporate Group: If MGT Web Solutions Ltd has affiliates, parent, or subsidiary companies (for example, if we operate through branch offices in different countries), we may share personal data within our corporate group on a need-to-know basis. All of our group entities are required to follow the privacy protections set forth in this policy and to comply with applicable data protection laws.
Legal Requirements and Protection: We may disclose personal data to third parties if we are legally required to do so, or if we believe in good faith that such action is necessary to (a) comply with a legal obligation (for example, to respond to subpoenas, warrants or court orders); (b) meet requests from competent authorities (such as law enforcement or regulatory agencies); (c) protect and defend our rights or property, or the rights, property or safety of our customers or others; or (d) investigate fraud or security issues. Any such disclosure will be limited to what is lawfully required.
Business Transfers: In the event that MGT Web Solutions is involved in a merger, acquisition, sale of assets, bankruptcy, or other business transaction, personal data may be transferred to a successor or affiliate as part of that transaction. We will ensure that any recipient of your personal data in such context is bound to respect your personal data in a manner consistent with this Privacy Policy and applicable law. If required by law, we will notify you and give you an opportunity to object to such transfer.
Importantly, aside from the situations described above, we will not share, rent, or trade your personal information with third parties. We do not allow third parties to collect personal data from our site for their own purposes, except as strictly necessary to provide their services to us (such as the Google Analytics example, where Google collects information through our site for analytics on our behalf). In all cases where third parties receive personal data, we remain responsible for the handling of your data and ensure that appropriate safeguards and contractual arrangements are in place.
MGT Web Solutions operates globally, and as a result, your personal data may be transferred to and stored in countries outside of your own. In particular, we anticipate that user data may be stored or processed in the United States, because some of our service providers (like Google and Stripe) are based in or have servers in the US. We may also leverage cloud or IT services that are globally distributed, meaning data could be processed in various data centers around the world.
When transferring personal data across international borders, we take steps to ensure that adequate protections are in place in compliance with applicable data protection laws. If you are located in the United Kingdom, Switzerland, or the European Union/EEA, we will ensure that any transfer of your personal data to a country outside the UK/Switzerland/EEA (a “third country,” such as the US) is done lawfully. This may involve one or more of the following safeguards:
Adequacy Decisions: Where the relevant authorities (the European Commission, UK Secretary of State, or Swiss Federal Council/FDPIC) have determined that a non-EU/EEA country provides an “adequate” level of data protection, personal data may be transferred to that country as if it were within the EU/UK/CH. (For example, at the time of this policy, the EU has recognized certain countries as adequate, and has adopted an EU–US Data Privacy Framework that deems specified US organisations with certification to provide adequate protection. Similarly, the UK and Switzerland may adopt their own adequacy arrangements or extensions.) We will take advantage of adequacy decisions where available. This means if our service provider or partner in a third country is certified or covered under an approved framework that grants adequacy (such as the EU-US Data Privacy Framework or the Swiss-U.S. framework, once in effect), we may rely on that for transfer compliance.
Standard Contractual Clauses (SCCs): In the absence of an adequacy decision, we will use the European Commission’s Standard Contractual Clauses (and the UK’s International Data Transfer Addendum, as applicable, or Swiss-approved clauses) in our contracts with the recipient of the data. These are legally-approved contract terms that impose data protection obligations on the receiver of the data, to ensure your personal information enjoys a level of protection essentially equivalent to that in the EU/UK/Switzerland. For example, our agreements with Google and Stripe incorporate Standard Contractual Clauses to cover transfers of personal data to the US (if and when such transfers occur).
Other Safeguards: We may also rely on other permitted transfer mechanisms or derogations under data protection law, such as obtaining your explicit consent for certain cross-border transfers, or transferring as necessary for the performance of a contract with you (e.g., if you are internationally using our service). However, these alternatives are only used in limited circumstances. Our primary approach is to ensure either an adequacy framework applies or to use SCCs for routine international data flows.
You can request a copy of the relevant data transfer safeguards (such as SCCs) we have in place by contacting us. We also continuously monitor the legal and regulatory landscape regarding international data transfers. For Swiss personal data in particular, we note that while the EU-U.S. adequacy decision (Data Privacy Framework) does not directly apply to Switzerland, the Swiss authorities are aware of these developments. Until there is an official Swiss-U.S. arrangement, we will continue to use contractual and technical measures to protect Swiss data transferred to the US or any other country lacking an adequacy decision.
Please be aware that personal data transferred to another country may be subject to lawful access by courts, law enforcement, or other authorities in that country, under its local laws. In all cases, we will only transfer the minimum data necessary, and we will take appropriate measures to ensure that your personal information remains protected in line with this Privacy Policy.
We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, as outlined in this Policy, and as required or permitted by law. In general, this means:
Account and Contact Data: If you have an account with us or have communicated with us, we will retain your basic contact information for as long as your account is active or as needed to provide you with services. If you delete your account or it becomes inactive, or if you withdraw your consent (in cases where consent is the basis), we will delete or anonymise your personal data upon request, unless we need to keep it for legal reasons.
Transaction Data: We retain records of payments and transactions for a period necessary to satisfy legal and accounting obligations. For example, financial records may be kept for a number of years required by tax law or financial regulation (commonly 6–7 years, depending on jurisdiction), and any requests for erasure may not override such legal retention requirements.
Analytics Data: Data collected via Google Analytics and similar tools is typically retained for a shorter period (for instance, Google Analytics allows setting retention periods, often 14 months by default for user-level data). We do not maintain personally identifiable analytics data indefinitely. It is either aggregated or deleted after a reasonable period once we have used it for legitimate analysis.
Legal Holds: If we are involved in litigation or an official investigation, we may need to retain relevant data until those matters are resolved, even if it goes beyond the normal retention schedules.
After the applicable retention period has ended, or upon your legitimate request and our verification, we will either securely delete or anonymise your personal data so that it can no longer be linked to you. We may retain anonymised or aggregated information (which is not personally identifiable) indefinitely for statistical purposes without further notice, as this data ceases to be personal data.
In summary, we retain personal data for as long as it is needed for the purposes for which it was collected, or as required by legal or contractual obligations. Once personal data is no longer needed, we ensure it is safely deleted or rendered anonymous.
Under applicable data protection laws, you have certain rights regarding your personal data. These rights may vary slightly by country or region, but MGT Web Solutions aims to extend these rights to all users where feasible. Specifically, if you are located in the United Kingdom, European Union/EEA, or Switzerland, you enjoy the following rights (subject to the conditions and exceptions defined by law):
Right to Be Informed: You have the right to be given clear, transparent information about how your personal data is collected and used. We fulfill this right by providing you with this Privacy Policy and related notices.
Right of Access: You have the right to request a copy of the personal data we hold about you, as well as information about how we process it. This allows you to confirm that we are processing your data lawfully. We will provide you with a copy of the information in a commonly used electronic form, unless you request otherwise. For additional copies, we may charge a reasonable fee based on administrative costs.
Right to Rectification: If you believe that any personal data we have about you is inaccurate or incomplete, you have the right to request that we correct or update it. Upon verification, we will promptly rectify the information.
Right to Erasure: Also known as the “right to be forgotten,” you have the right to request the deletion of your personal data in certain circumstances. For example, if the data is no longer necessary for the purposes it was collected, or if you withdraw consent and no other legal basis for processing exists, or if you object to processing and we have no overriding legitimate grounds to continue, you may request erasure. Note that this right is not absolute – sometimes we must retain certain data to comply with legal obligations or to establish or defend legal claims.
Right to Restrict Processing: You have the right to request that we limit the processing of your personal data in certain situations. This could apply if you contest the accuracy of the data, for instance, and want to restrict processing while we verify it; or if you object to our processing based on legitimate interest, pending verification of that objection. When processing is restricted, we will still store your data, but not use it further until the restriction is lifted (unless for legal reasons).
Right to Data Portability: For data you have provided to us and which we process by automated means on the basis of your consent or for performance of a contract, you have the right to obtain a digital copy of such data in a structured, commonly used, machine-readable format. You also have the right to request that we transmit that data directly to another controller (for example, another service provider) where technically feasible.
Right to Object: You have the right to object to our processing of your personal data when that processing is based on legitimate interests (including profiling based on those interests). If you raise an objection, we will consider it and will no longer process the data in question unless we have compelling legitimate grounds that override your rights and interests or if we need to continue processing for the establishment, exercise, or defense of legal claims. You also have an unconditional right to object to the processing of your personal data for direct marketing purposes at any time – if we were to send you marketing emails, you can opt out and we will honor that choice.
Right to Withdraw Consent: If we rely on consent for any processing, you have the right to withdraw your consent at any time. This will not affect the lawfulness of processing based on consent before its withdrawal. Once consent is withdrawn, we will cease the related processing unless we have another legal basis to continue (we will inform you if we do).
Rights Related to Automated Decision-Making: As noted, we currently do not use automated decision-making (including profiling) that has legal or similarly significant effects. However, if that changes and we perform such processing, you have the right to be informed about it and the right to request human intervention or to challenge any decision made solely by automation.
Right to Complain: If you believe that we have infringed your data protection rights or handled your personal data in violation of applicable law, you have the right to lodge a complaint with a supervisory authority. You may do so in the EU member state or UK jurisdiction where you reside, where you work, or where the alleged infringement occurred. For Swiss individuals, you can contact the Swiss Federal Data Protection and Information Commissioner (FDPIC). In the UK, the supervisory authority is the Information Commissioner’s Office (ICO). We would, however, appreciate the chance to address your concerns directly before you approach a regulator, so we encourage you to contact us first with any complaint and we will do our best to resolve it.
To exercise any of your rights, please contact us using the contact information provided below. We may need to verify your identity before fulfilling certain requests (to ensure that we do not disclose data to the wrong person). We will respond to your request within the timeframe required by law (typically within one month for GDPR/FADP, with the possibility of an extension if necessary). Exercising your rights is generally free of charge. However, if requests are manifestly unfounded or excessive (for example, repetitive), we may charge a reasonable fee or refuse to act on the request as permitted by law.
Our services and Websites are not directed to individuals under the age of 18, and we do not knowingly collect personal data from minors under 18 years old. If you are under 18, please do not use our Websites or send us any personal information. We understand the importance of protecting children’s privacy, especially in an online environment. If we become aware that we have inadvertently collected personal data from a child under 18, we will take steps to delete such information as soon as possible (unless we are legally obligated to retain it).
Parents or guardians who believe that we might have information about a child under 18 may contact us, and we will promptly investigate and address the issue. By using our services, you confirm that you are at least 18 years of age or are using the service with the consent of a parent or guardian.
MGT Web Solutions takes the security of your personal data seriously. We implement appropriate technical and organisational measures to protect the personal data we hold against unauthorised access, alteration, disclosure, or destruction. These measures include, but are not limited to:
Encryption: Sensitive data (such as payment information entered on our site) is protected via encryption in transit (Secure Sockets Layer/Transport Layer Security – SSL/TLS). This means that when you provide payment details or other sensitive information, it is encrypted before being sent to Stripe or our servers.
Access Controls: We limit access to personal data to employees and contractors who need to process that data for the purposes described above, and who are subject to strict confidentiality obligations. Access to administrative interfaces and databases is protected via strong authentication methods and is logged.
Secure Infrastructure: We rely on reputable service providers like Google Cloud/Google Workspace, which maintain robust security certifications and practices. Our servers and data storage employ firewalls, intrusion detection systems, and monitoring to guard against potential vulnerabilities and attacks. Stripe, as our payment processor, is certified to the highest industry standards for security (PCI DSS Level 1 compliant) to ensure your payment data is handled safely.
Training and Policies: Our staff are trained on data protection best practices and we have internal policies in place to handle data securely and respond quickly to any potential incidents.
Regular Testing: We periodically review and update our security measures in line with technological advancements. We may perform vulnerability assessments or engage third-party security experts to test our systems.
However, please note that no method of transmission over the Internet or method of electronic storage is 100% secure. While we strive to protect your personal data, we cannot guarantee absolute security. You should also take care with how you handle and disclose your personal data and avoid sending sensitive information via insecure means.
In the event of a data breach that poses a high risk to your rights and freedoms, we will notify you and the relevant supervisory authorities as required by law.
We may update or revise this Privacy Policy from time to time to reflect changes in our practices or for other operational, legal, or regulatory reasons. If we make material changes to how we handle your personal data, we will provide you with notice (for example, by posting a prominent notice on our Websites or, if appropriate, by contacting you directly via email). The “Last Updated” date at the top of this Policy indicates when the latest changes were made.
We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your information. Your continued use of our Websites or services after any modifications to this Policy will constitute your acknowledgment of the changes and your agreement to abide by the updated terms.
MGT Web Solutions Ltd is the data controller responsible for the processing of your personal data as described in this Policy (except where this Policy explains otherwise, such as Stripe being an independent controller for payment processing). If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us.
For your convenience and to better serve our international user base, you may reach us at the regional contact email that corresponds to your location:
United Kingdom (English): info@mgt-solutions.co.uk
Switzerland (German/French/English): info@mgt-solutions.ch
France: info@mgt-solutions.fr
Germany: info@mgt-solutions.de
Italy: info@mgt-solutions.it
Spain: info@mgt-solutions.es
Poland: info@mgt-solutions.pl
Other Regions (English): info@mgt-solutions.com
Please include in your email your name, the website or service you are contacting us about, and the nature of your inquiry or request. This will help us address your communication as efficiently as possible.
Alternatively, you may contact us by postal mail at our registered business address: MGT Web Solutions Ltd, 167-169 Great Portland Street, London W1W 5PF, United Kingdom.
We will respond to all legitimate requests or inquiries as soon as practicable and in accordance with applicable law. If you are contacting us to exercise any of your data subject rights (see Your Rights section above), please provide enough information for us to verify your identity (for example, emailing from the address we have on file for you and specifying the request).
Thank you for reading our Privacy Policy. We are dedicated to safeguarding your personal data and upholding your privacy rights.