Last updated 28 October 2026
This policy explains how CASTELO DAVID LTD, trading as Modular (“Modular”, “we”, “us”), collects and uses personal information when you visit themodular.co.uk, contact us, complete our Client Onboarding Checklist, or work with us as a client. CASTELO DAVID LTD is the controller of this information. It is registered in England with company number 12126753, and its registered office is 27 Myrtle Street, Crewe, England, CW2 7HY.
1. What we collect
- Enquiries and newsletter: your name, email address, phone number and message. The newsletter form also records your IP address.
- Client Onboarding Checklist:
- business details: name, industry, website, products or services, ideal customers, target locations;
- campaign details: goal, advertising service, monthly budget, previous use of Meta Ads or Google Ads;
- online presence: links to your Facebook Page, Instagram account and Google Business Profile;
- materials, offers, reviews and any required ad wording;
- contacts: the main contact’s name, email and phone, and the name of the person who approves your adverts.
We also record a reference number and the submission time. Please do not include sensitive information or card details in your answers. If you name another person, such as an approver, please let them know.
- Payments: payments are taken by Stripe on its own secure page. We do not receive your full card details. Stripe tells us about the payment, for example the amount, its status, the details entered at checkout and your checklist reference number.
- Technical information: our providers process your IP address and browser and device information to deliver our pages and protect them from spam and abuse (see section 3).
2. How we use it, and our legal bases
| Use | Legal basis |
|---|---|
| Reviewing your checklist and providing our advertising services | Contract, if you are a sole trader or a partner and the agreement with us is with you personally: we need the information to take the steps you ask for before a contract (reviewing your checklist) and then to provide the services. Legitimate interests, if you complete the checklist for a company or other organisation, or you are named in it as a contact or approver: our interest, and that of the business you represent, in assessing its request, providing the services and dealing with the people it has named. |
| Billing and matching your payment to your checklist | Contract (sole traders and partners, as above). Legitimate interests (anyone acting for a company or other organisation): our interest in being paid and keeping accurate client accounts. Stripe also uses payment information for its own purposes, such as preventing fraud and meeting its legal obligations, as explained in its own privacy policy. |
| Responding to enquiries | Legitimate interests: our interest in answering the people who contact us and discussing our services with them. |
| Protecting our website and checklist from spam, abuse and fraud | Legitimate interests: our interest, and that of our clients and visitors, in keeping our website and checklist secure and free from spam, abuse and fraud. |
| Keeping financial and accounting records | Legal obligation: company and tax law require us to keep accounting records. |
| Sending our newsletter, if you sign up (we do not send newsletters at present) | Consent. We will only send newsletters to people who have asked to receive them. You can withdraw your consent at any time by emailing us (section 10) or using the unsubscribe link in any newsletter. |
| Meeting legal requirements, establishing or defending legal claims, and any sale or restructuring of our business (section 3) | Legal obligation, where the law requires us to disclose information. Otherwise legitimate interests: our interest in protecting our legal rights and in running, and if needed reorganising, our business. |
Where we rely on legitimate interests, you have the right to object (section 8). Where we rely on contract, we need the information to assess your request and work with you; without it, we cannot provide our services.
3. Who we share it with
We do not sell your personal information. We share it only with providers that help us run our business:
- Cloudflare hosts the checklist and receives your submitted answers, then passes them to our Google Workspace account.
- Cloudflare Turnstile checks that a person, not a program, is submitting the form.
- Cloudflare keeps a technical log of each submission request for up to 3 days. The log includes your IP address, browser details and approximate location, but not your answers.
- Google Workspace stores checklist answers in a spreadsheet that only authorised members of our team can access, and handles our email.
- Stripe processes payments. The only checklist information we send to Stripe is your reference number.
- Google reCAPTCHA protects the forms on our website, and Google Fonts supplies the fonts on our website and checklist. Both receive your IP address and browser information.
- HubSpot receives the details entered in our newsletter form.
- UKFast (ANS) hosts our website.
We may also share information where the law requires it, to establish or defend legal claims, or as part of a sale or restructuring of our business.
Some of our providers may process personal information outside the UK, including in the United States. Where information goes to a country covered by UK adequacy regulations, including a US company certified to the UK Extension to the EU-U.S. Data Privacy Framework (the “UK-US data bridge”), the transfer relies on those regulations. The US companies of Google, Cloudflare, Stripe and HubSpot take part in the UK Extension. Where adequacy regulations do not apply, the published data processing terms of Google Workspace, Cloudflare, Stripe and HubSpot provide for the EU standard contractual clauses with the UK International Data Transfer Addendum. You can ask us for more information about these safeguards (section 10).
4. Information stored in your browser
The checklist saves your answers in your browser as you type, so you can finish later. They are not sent to us until you submit. Your browser removes saved answers:
- when you submit;
- when you choose Clear answers; or
- if they have not been edited for 30 days, the next time the checklist is opened.
After you submit, your browser keeps a short record of your reference number and the payment link, without your answers. It is removed after 30 days, the next time the checklist is opened.
You can remove all of this at any time by clearing your browser’s site data. Please do not leave a checklist in progress on a shared device.
The checklist does not use analytics or advertising cookies, and neither does our website.
5. How long we keep it
We keep checklist answers and enquiries only for as long as we need them to provide our services, respond to you and deal with any follow-up. In particular:
- if you do not go ahead with our services, we review your information 90 days after our last relevant contact with you and delete it at the following monthly review, unless there is a justified reason to keep it;
- while you are a client, we keep the information we need to provide our services;
- when our services end, we review your information 12 months after the end of the service;
- financial records are generally kept for 6 years from the end of the relevant financial year, or for any other period the law requires.
We keep invoices and payment records for as long as UK law requires. Deleted information may remain for a limited time in backups and version history before it is fully removed.
6. Keeping it safe
We use encrypted connections, a security check on submissions and restricted access to the spreadsheet. No system is completely secure, but we work to protect your information.
7. Children
Our services are for businesses and are not intended for anyone under 18.
8. Your rights
You have the right to:
- access your information and have it corrected or erased;
- restrict or object to how we use it;
- receive it in a portable format;
- withdraw consent where we rely on consent.
Some rights apply only in certain circumstances. To make a request, email us (section 10). We may need to confirm your identity. If you are unhappy with how we have handled your information, please contact us first. You can also complain to the Information Commissioner’s Office (ICO) at ico.org.uk.
9. Changes
We may update this policy. The date at the top shows the latest version.
10. Contact
Email: info@themodular.co.uk. Post: CASTELO DAVID LTD, 27 Myrtle Street, Crewe, England, CW2 7HY.