### Privacy Policy ### DDCAP LIMITED, DD&CO LIMITED AND DDGI LIMITED DATA PROTECTION AND PRIVACY POLICY DDCAP Limited, DD&Co Limited and DDGI Limited (collectively referred to hereinafter as “DDCAP”, “we” or “us”) understand that your privacy is important to you and that you care about how your personal data is used. We respect and value your privacy and will only collect and use your personal data in ways that are described here, and in a manner that is consistent with our obligations and your rights under data protection laws. We place a high importance on the correct, lawful and fair handling of all personal data and respecting the legal rights, privacy, and trust of all individuals with whom we deal. This Website Privacy Policy (“Privacy Policy”) sets out how DDCAP will process personal data relating to visitors to our website, [www.ddcap.com](http://www.ddcap.com) (“Website”) and their rights in respect of their personal data under the Data Protection Act 2018 (DPA 2018), and the UK General Data Protection Regulation (UK GDPR) (“UK GDPR”). We are providing the information set out in this Privacy Policy as the data controllers of the personal data collected through the Website. Please read this Privacy Policy carefully and ensure that you understand it. We may amend this Privacy Policy from time to time. We will notify you of any material changes, but would advise you to review it periodically to ensure that you have an up-to-date understanding of how we will process your personal data and your rights. ### INFORMATION ABOUT DDCAP DDCAP Limited is a private limited company incorporated and registered in England under company number 05493658, whose registered address is 36 Shad Thames, Core 1A – Butler’s Wharf Building, London, SE1 2YE and whose registration reference with the ICO is ZB437897. DD&Co Limited is a private limited company incorporated and registered in England under company number 00228785, whose registered address is 36 Shad Thames, Core 1A – Butler’s Wharf Building, London, SE1 2YE and whose registration reference with the ICO is Z9055278. DDGI Limited is a private limited company incorporated and registered in England under company number 03393586, whose registered address is 36 Shad Thames, Core 1A – Butler’s Wharf Building, London, SE1 2YE and whose registration reference with the ICO is ZB437897. ### CONTACTING US You can contact us with any questions regarding your personal data or this Privacy Policy using the details set out in section 13 below. ### CONTENTS Personal data is any information relating to an identified or identifiable natural person (a data subject). This means any data which directly identifies you or allows you to be identified from it (either alone or in combination with other data) and can include a name, address, job title, email address, an identification number, location data or an online identifier such as an IP address. This Privacy Policy explains what we do with your personal data, whether you are simply visiting our Website or where we send you our newsletter, if you have signed-up to our mailing list. It describes how we collect, use, and process your personal data, and how, in doing so, we comply with data protection laws. Please note that this Privacy Policy only applies to your use of our Website. Our Website may contain links to other websites. Please be aware that we have no control over how your data is collected, stored, or used by other websites and we advise you to check the privacy policies of any such websites before providing any data to them. We collect a limited amount of data from visitors to our Website, which we use to help us to improve your experience when using the Website and to help us manage the services we provide. This includes information such as how you use our Website, the frequency with which you access our Website, your IP address, your browser type, the time you view our website, the location you view our Website from, how you browse our Website's content and the times that our Website is most popular. If you contact us via the Website, for example by completing a contact form or asking to be added to our mailing list, we will collect any information that you provide to us and use it for the purpose provided. Our website also uses cookies to collect and store information about our Website users. See section 12 (Cookies) below for further details. **Personal data that you give to us.** Where you contact us through the website, by phone, email, using our website contact form or signing up to our mailing list. **Personal data we collect automatically** In addition, as set out in section 3 above, where you visit our Website there is certain information that we may automatically collect about how you use our Website, in order to improve it and to manage our services. We will use your personal data to understand how our Website is used in order to improve it and to manage our services, to respond to your communications raised using our contact form and to send you our newsletter, if you have signed-up to our mailing list. Our use of your personal data will always have a lawful basis, for example, because you have consented to our use of your personal data (e.g., by subscribing to our mailing list) or because it is in our legitimate interests that are not overridden by your rights or freedoms (e.g., to improve our website, and manage our services and to deal with communications, including queries and complaints). In some circumstances, we may anonymise your personal data so that it can no longer be associated with you, in which case it is no longer your ‘personal data’ for the purposes of UK GDPR so that our obligations and restrictions under data protection laws will not apply. Data security is very important to us and we have taken suitable measures to safeguard and secure data collected directly from you or through our Website. Steps we take to secure and protect your data include (but are not limited to): - firewalls; - user authentication protection; and - Restricted Access and password protection for certain categories of data; We will periodically review our security policies and implement changes from time to time. However, the Internet is not a risk-free place for communication and for that reason, we cannot and do not guarantee complete security, as it does not exist on the Internet. It is your responsibility to ensure that you have adequate and up-to-date anti-virus software and firewalls installed on your device. We only keep your personal data for as long as we need to in order to use it as described above and/or for as long as we need it for legal and/or regulatory purposes. To determine the appropriate retention period for your personal data, we consider the amount, nature, and sensitivity of the personal information, the potential risk of harm from unauthorised use or disclosure of it, the purposes for which we process your personal data and whether we can achieve those purposes through other means. We also take into account legal and regulatory requirements which require the retention of personal information for a minimum period of time and limitation periods for taking legal action. DDCAP Limited, DD&Co Limited and DDGI Limited may share your personal data for the purposes described above. In addition, for the purposes described above, we may transfer your personal data to an affiliate of DDCAP or a third party outside the UK and in a jurisdiction not being subject to an adequacy decision of the UK Government. We will always ensure that there is a legal basis and a relevant safeguard for such data transfer so that your personal data is treated in a manner that is consistent with, and respects the UK GDPR. For example, by putting in place appropriate contractual agreements, such as standard contractual clauses or the ICO’s international data transfer agreement or by relying on the UK bridge of the EU-U.S. Data Privacy Framework. You can request more information or a copy of these by getting in touch with us using the contact details at the end of this Privacy Policy. We may sometimes contract with third parties to supply services to us or to you on our behalf. These may include search engine facilities, analytics, advertising, and marketing. In some cases, the third parties may require access to some or all of your personal data. Where any of your data is required for such a purpose, we will take all reasonable steps to ensure that your data will be handled safely, securely, and in accordance with your rights, our obligations, and the obligations of the third party under the law. There may be other circumstances in which we may share your data with third parties, including: - with our IT service and cloud-based/other storage providers; - with other service providers; - with professional advisors such as lawyers, accountants and auditors; - where we need to disclose your personal data in relation to a sale, transfer or disposal of our business or assets or other transaction; - with public authorities/regulators such as law enforcement agencies, government bodies (including HMRC), courts, tribunals or the police, with opposing or related parties to proceedings and their professional advisors; and - where we are required to by law. We may compile statistics about the use of our Website. All such data will be anonymised and will not include any personally identifying data. We may from time to time share such data with third parties such as prospective investors, affiliates, partners, and advertisers. Data will only be shared and used within the bounds of the law. As a data subject, you have the following rights under the UK GDPR, which this Privacy Policy and our use of personal data are designed to uphold: - the right to be informed about our collection and use of personal data; - the right of access to the personal data we hold about you (see section 10); - the right to rectification if any personal data we hold about you is inaccurate or incomplete; - the right to be forgotten – i.e. the right to ask us to delete any personal data we hold about you in certain circumstances; - the right to restrict the processing of your personal data in certain circumstances; - the right to withdraw your consent at any time where consent is our legal basis for processing your personal data (please note that this will not affect the lawfulness of any processing carried out before you withdraw your consent); - the right to data portability (obtaining a copy of your personal data to re-use with another service or organisation); - the right to object to us using your personal data for particular purposes; and - rights with respect to automated decision making and profiling. Please note that the exercise of these rights may in some cases be subject to certain conditions. If you would like to exercise any of these rights, details of how to contact us are set out in section 13. Please note that we may keep a record of your communications to help us resolve any issues which you raise. You may raise any complaint about any aspect of our management of your data internally to , and equally take the matter to the ICO if you remain unsatisfied. We will acknowledge any such complaint within at most 30 days and will endeavour to provide you with a response to your complaint as soon as practicable, including an outline of the Company’s reasoning behind that outcome. The more detail and/or supporting information which you can provide around the specifics of your complaint, either when it is made or on our request thereafter, the faster and more focused any necessary investigation can be, and so the sooner we will be able to provide you with our response to your concerns. If our investigation is likely to be protracted, then we will keep you updated on progress as we go along. We will keep a central record of data-related complaints in order that we can identify and rectify any structural or systemic weaknesses in our data management processes. So far as practicable without undermining that purpose, we will not include the personal data of any complainant in that central record, though such data may of course be retained on the HR file of the complainant so long as there is good reason for us to do so. For further information about your rights, please contact the Information Commissioner’s Office: . You have the right to ask for a copy of any of your personal data held by us (where such data is held). Under the UK GDPR, in most cases no fee is payable and we will provide you with information in response to your request free of charge. However, we may charge a reasonable fee if your request to exercise your rights is manifestly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances. You may exercise your right to access your personal information or any of your other rights by contacting us using the details set out in section 13. We may need to verify your identity prior to actioning your requests or disclosing any personal information in order to ensure that we are not disclosing personal information to, or about, the wrong person. In addition to your rights under the UK GDPR, set out in section 9 above, we aim to give you strong controls on our use of your data for direct marketing purposes (including the ability to opt-out of receiving marketing emails from us which you may do by unsubscribing using the links provided in our emails or by emailing ). For further information about our use of cookies on our Website, please refer to our [Cookie Policy](https://ddcap.staging.lightbulbwebdesign.co.uk/privacy-and-cookies-policy). We will only set any non-essential cookies, such as analytics cookies where you have provided your consent to the setting of these on your device. If you have any questions about this Privacy Policy, the practices of this Website, or our use of Cookies, you can contact us as follows: **E-mail:** **By post, at:** Head of Corporate Governance DDCAP Limited 36 Shad Thames Core 1A – Butler’s Wharf Building London SE1 2YE United Kingdom **Telephone.:** +44 (0)20 7863 1250 Last updated: June 2026