Privacy Policy

1. Who we are

Agency Consent is operated by Imedia8 Ltd, a United Kingdom technology company that builds secure digital platforms for international organisations. In this policy, "we" and "us" mean Imedia8 Ltd. For any privacy enquiry, contact us and mark your message for the attention of the privacy team.

2. Data we collect

We handle three distinct kinds of personal data:

Website visitors. Our marketing site uses self-hosted analytics; no data is shared with third-party advertising or tracking networks. If you submit the contact form, we receive the name, email address, organisation, role and message you provide.
Platform accounts. For staff of customer organisations we hold account details: name, email address, role, organisation, and two-factor authentication settings.
Consent records. On behalf of customer organisations, the platform stores the consent records their teams capture: the subject's name, date of birth, signature or alternative consent media, the consent statement and scope agreed, the language used, and — where the organisation enables them — optional details such as nationality, email address, identity reference and capture location.

3. Why we process it (lawful bases)

Website and contact-form data is processed on the basis of our legitimate interest in operating the site and responding to enquiries. Platform account data is processed to perform our contract with the customer organisation. Consent-record data belongs to a different arrangement: the customer organisation decides why and how it is collected and is the data controller; Imedia8 processes it strictly on that organisation's documented instructions as a processor. See our data processing page for detail.

4. Retention

Contact-form enquiries are kept for as long as needed to handle the enquiry and maintain the business relationship. Platform accounts exist for the life of the organisation's subscription. Consent records are retained according to each organisation's own configured retention policy. When a subject withdraws consent, the withdrawal is recorded against the original record — with a full audit trail — rather than erasing the history the record exists to prove.

5. Your rights

Under UK and EU data protection law you may have the right to access, rectify, erase or restrict personal data about you, to object to processing, to data portability, and to withdraw consent you have given. If your data sits in a consent record, the organisation that collected it is the controller — contact that organisation to exercise your rights, and we will support it in responding. For anything we control directly, contact us. You also have the right to complain to a supervisory authority — in the UK, the Information Commissioner's Office.

6. Security

Personal-data fields in consent records are encrypted at rest. Signatures and consent media are stored on private storage and served with restrictive, download-only headers. Back-office access is role-based, with two-factor authentication supported on every back-office account. Consent records are immutable once captured, changes to them are written to an audit trail, and each organisation's data is isolated from every other organisation's.

7. Contact