GDPR Compliance
The Demo Site is committed to protecting your personal data in full compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This page explains your rights and how we safeguard your data.
Last updated: 31 August 2026
1. Data Controller
For the purposes of the UK GDPR, the data controller is:
As the data controller, we determine the purposes and means of processing personal data collected through our website directory and guest post platform. We are responsible for ensuring that all processing complies with applicable data protection legislation.
2. Lawful Basis for Processing
Under Article 6 of the UK GDPR, we must have a valid lawful basis for every processing activity. We rely on the following bases:
Processing personal data to fulfil the guest post and directory listing services you have purchased, manage your account, deliver credits, and provide customer support related to your orders.
Data types processed:
Name, email, website URL, submission content, account data, agency credits
Processing for purposes including website analytics, fraud prevention, platform security, service improvement, and resolving technical issues. We have conducted a balancing test to ensure our interests do not override your fundamental rights and freedoms.
Data types processed:
IP address, browser data, usage patterns, device information
Processing based on your freely given, specific, and informed consent. This applies to marketing emails, non-essential cookies, and any optional data collection. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.
Data types processed:
Marketing preferences, non-essential cookie data, optional profile information
Processing necessary to comply with UK legal obligations, including tax record-keeping requirements under HMRC regulations, anti-money laundering obligations, and responding to lawful requests from regulatory authorities.
Data types processed:
Transaction records, payment history, invoices, tax data
3. Your Data Subject Rights
Under the UK GDPR, you have the following rights regarding your personal data. These rights are not absolute and may be subject to certain conditions and exceptions.
Right of Access (Article 15)
You have the right to obtain confirmation as to whether we are processing your personal data, and if so, to receive a copy of that data along with information about how and why it is being processed. We will respond to access requests within 30 days.
How to exercise this right:
Send an email to privacy@thedemosite.com with the subject line "Data Access Request". Please include your full name and the email address associated with your account so we can verify your identity.
Right to Rectification (Article 16)
You have the right to request the correction of inaccurate personal data and the completion of incomplete personal data. We will rectify your data without undue delay.
How to exercise this right:
You can update most account information directly through your dashboard. For data you cannot edit yourself, email privacy@thedemosite.com with the details that need correcting.
Right to Erasure (Article 17)
You have the right to request the deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you withdraw consent, or where there is no overriding legitimate interest for continued processing. This right does not apply where we are legally required to retain the data (e.g. for tax compliance).
How to exercise this right:
Email privacy@thedemosite.com with the subject line "Erasure Request". We will confirm deletion within 30 days, or explain any legal grounds preventing full erasure.
Right to Restrict Processing (Article 18)
You have the right to request that we limit the processing of your personal data in certain circumstances, including where you contest the accuracy of the data, where processing is unlawful but you oppose erasure, or where we no longer need the data but you require it for legal claims.
How to exercise this right:
Email privacy@thedemosite.com specifying which data you wish to restrict and the grounds for restriction. We will mark the data as restricted and cease processing it (except for storage) until the restriction is lifted.
Right to Data Portability (Article 20)
You have the right to receive your personal data in a structured, commonly used, and machine-readable format (such as JSON or CSV), and to transmit it to another data controller without hindrance from us.
How to exercise this right:
Email privacy@thedemosite.com with the subject line "Data Portability Request". Specify your preferred format (JSON or CSV). We will provide your data export within 30 days.
Right to Object (Article 21)
You have the right to object to the processing of your personal data where we rely on legitimate interests as the lawful basis, or where data is processed for direct marketing. Upon objection, we will cease processing unless we demonstrate compelling legitimate grounds.
How to exercise this right:
Email privacy@thedemosite.com with the subject line "Processing Objection". Clearly state which processing activities you object to and the grounds for your objection.
4. Response Times & Process
We are committed to responding to all data subject requests promptly and in compliance with statutory requirements:
- Standard response time: Within 30 calendar days of receiving your verified request
- Complex requests: May be extended by up to 60 additional days (90 days total) where requests are complex or numerous. We will notify you of any extension and the reasons within the initial 30-day period
- Identity verification: We may request proof of identity before processing your request to prevent unauthorised access to your personal data
- No charge: Requests are fulfilled free of charge. We may charge a reasonable fee for manifestly unfounded or excessive requests, or refuse to act on them, in accordance with Article 12(5) of the UK GDPR
5. Data Protection Contact
For all data protection enquiries, requests, or complaints, please contact our Data Protection Officer:
Our Data Protection Officer is responsible for overseeing our data protection strategy and ensuring compliance with the UK GDPR. They are the primary point of contact for all privacy-related matters and will liaise with the Information Commissioner's Office (ICO) on your behalf if required.
6. International Data Transfers
Where we transfer personal data outside the United Kingdom, we ensure that appropriate safeguards are in place in compliance with Chapter V of the UK GDPR:
- Adequacy decisions: We transfer data to countries that the UK Secretary of State has determined provide an adequate level of data protection
- Standard Contractual Clauses (SCCs): Where no adequacy decision exists, we use International Data Transfer Agreements (IDTAs) or the UK Addendum to the EU SCCs, as approved by the ICO
- Transfer Impact Assessments: We conduct assessments to evaluate the laws and practices of the destination country and implement supplementary measures where necessary
Our payment processor, Hercules Commerce, may process data in jurisdictions outside the UK. Hercules Commerce maintains appropriate safeguards and complies with applicable data protection requirements for all international transfers.
7. Data Breach Notification
In the event of a personal data breach that poses a risk to your rights and freedoms, we will:
- Notify the Information Commissioner's Office (ICO) within 72 hours of becoming aware of the breach, as required by Article 33 of the UK GDPR
- Notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms, as required by Article 34
- Document all breaches, including the facts, effects, and remedial actions taken, in our internal breach register
- Take immediate steps to contain and remediate the breach and prevent further unauthorised access
8. Data Protection Impact Assessments
We conduct Data Protection Impact Assessments (DPIAs) in accordance with Article 35 of the UK GDPR where processing is likely to result in a high risk to the rights and freedoms of individuals. This includes assessments for:
- New data processing activities or significant changes to existing processing
- Implementation of new technology or third-party services
- Large-scale processing of personal data
9. Your Right to Complain
If you are unsatisfied with how we handle your personal data or respond to your requests, you have the right to lodge a complaint with the UK supervisory authority:
Information Commissioner's Office (ICO)
Wycliffe House, Water Lane
Wilmslow, Cheshire, SK9 5AF
Website: ico.org.uk
Helpline: 0303 123 1113
Live chat: ico.org.uk/global/contact-us/live-chat
We encourage you to contact us first at privacy@thedemosite.com so we have the opportunity to resolve your concern directly. However, lodging a complaint with the ICO does not require you to contact us first, and you may do so at any time.
10. Record of Processing Activities
In accordance with Article 30 of the UK GDPR, we maintain a record of all processing activities carried out under our responsibility. This record includes:
- The purposes of processing
- Categories of data subjects and personal data
- Categories of recipients
- International transfers and safeguards
- Retention periods
- Technical and organisational security measures
This record is available to the ICO upon request and is reviewed and updated regularly.
Contact Us About GDPR
For any GDPR-related enquiries, data subject requests, or to speak with our Data Protection Officer, please contact us: