Last updated: 28 October 2026 · Version: 1.4
This policy explains how Agovenzi Limited collects and uses your personal data when you visit markupworks.com, open an account, order a Review or contact us. We comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (as amended by the Data (Use and Access) Act 2025), the Privacy and Electronic Communications Regulations (PECR) and, for people in the European Union, the EU General Data Protection Regulation (EU GDPR).
1. Who we are
Controller: Agovenzi Limited, registered in England and Wales, company number 17062749, registered office 124 City Road, London EC1V 2NX, United Kingdom.
Privacy contact: info@markupworks.com
We are not required to appoint a Data Protection Officer. Privacy questions are handled by our director, Mesuthan Yilmaz.
2. The personal data we collect
| Category | Data |
|---|---|
| Account | First name, last name, email address, password (stored only as an encrypted hash), account creation date |
| Billing | Full name, billing address (street, city, postcode, country), currency |
| Order | Order number, Review ordered, price, tax, order and delivery dates, the channels you chose, the links you sent, your goal and audience, any notes |
| Your content | Files you upload (images, videos, captions, screenshots) and the content visible at the links you send |
| Checkout confirmations | The boxes you ticked (age, terms, start of service, content rights), with the exact wording, date, time, IP address and browser |
| Payment | Payment method, payment status and transaction reference. Card: card brand and last four digits only. Pay by bank: the account holder’s name, the bank, and the account details your bank shares with the payment, used to confirm the payment and to send any refund back to the same account. We never receive or store your full card number, expiry date or security code, or your online banking login details. |
| Delivery records | When we sent your Report, and each time it was downloaded (date, time, IP address, browser) |
| Communications | Messages you send us and our replies |
| Technical | IP address, browser and version, operating system, device type, pages visited, referring site, date and time |
| Cookies | See our Cookie Policy |
| Business contacts | Name, business email address, job title, company and public profile links, collected from public business sources for business-to-business marketing |
We don’t ask for special category data (such as health, religion or ethnicity). Please don’t include it in your content or messages.
How we collect it:
- From you: when you open an account, order, upload files, tick boxes at checkout or contact us.
- Automatically: from your browser and device when you use the site (technical data and, with your consent, cookies), and from our systems when we deliver your Report.
- From our payment service provider: payment status, transaction reference and fraud-screening results.
- From public sources: the public accounts and pages you ask us to review, and public business sources for business contacts.
When we look at your public accounts: we view only the accounts, posts, stories and pages you send us, and only to prepare your Report. We don’t log in to your accounts, follow them, interact with your content or contact your followers. Other people may appear in the content we review; we use what we see only for your Report and don’t build profiles of them.
3. Why we use it and our legal basis
| Purpose | Legal basis |
|---|---|
| Open and manage your account | Contract |
| Take payment, prevent fraud, check age and location (sanctions) | Contract; legal obligation; legitimate interests (preventing fraud) |
| Prepare and deliver your Report | Contract |
| Keep evidence of your order, confirmations and delivery, and handle disputes and chargebacks | Legitimate interests (defending legal claims and payment disputes) |
| Keep accounting and tax records | Legal obligation |
| Answer your messages and provide support | Contract; legitimate interests |
| Send business-to-business marketing emails to company addresses | Legitimate interests (you can object at any time); consent where PECR requires it |
| Analytics and advertising cookies (Google, Meta) | Consent |
| Keep the site secure and working | Legitimate interests |
4. Payments and card security
Payments are processed by our regulated payment service provider on its own secure, PCI DSS compliant payment page. Card payments use 3-D Secure authentication where your bank supports it. Card details go directly to the provider and never pass through or are stored on our systems.
With Pay by bank (open banking), you approve the payment in your own banking app or online banking. Your banking login details stay with your bank and never reach us or our payment service provider.
5. Who we share your data with
We share only what each provider needs, under contracts that require them to protect it:
| Recipient | Purpose | Location |
|---|---|---|
| Hostinger (UAB Hostinger) | Website hosting, data storage and email | EU (Lithuania) |
| Cloudflare, Inc. | Security, bot protection, content delivery | Global |
| Our payment service provider | Processing payments, fraud screening | UK, EU or other countries (see section 6) |
| CookieYes Ltd | Recording your cookie choices | UK |
| Google Ireland Ltd / Google LLC | Analytics and advertising measurement (only with consent) | EU / USA |
| Meta Platforms Ireland Ltd | Advertising measurement (only with consent) | EU / USA |
| Technology and data-processing service providers | Software we use to organise, store and analyse the content you submit so our specialists can prepare your Report | UK, EU or USA (see section 6) |
| Professional advisers, our bank and authorities | Legal, accounting, fraud prevention, or where the law requires it | UK |
We never sell your personal data and we don’t share it for other companies’ marketing.
6. International transfers
Some providers process data outside the UK and EU, for example in the USA. Where they do, we rely on an adequacy decision (including the UK–US Data Bridge and the EU–US Data Privacy Framework for certified companies) or on the UK International Data Transfer Agreement or EU Standard Contractual Clauses with the UK Addendum, with additional safeguards where needed.
7. How long we keep it
| Data | Retention |
|---|---|
| Files you upload | Deleted 90 days after your Report is delivered |
| Your Reports | Deleted 12 months after delivery |
| Order, payment, confirmation and delivery records | 6 years after the end of the financial year (UK tax law and legal claims) |
| Account data | Until you close your account, then 30 days (order records are kept as above) |
| Support messages | 2 years after the last message |
| Business contact data | Deleted after 2 years with no engagement; suppression list kept |
| Cookie consent records | 12 months |
| Server and security logs | 90 days |
8. Automated decisions
We don’t make decisions about you based solely on automated processing that have legal or similarly significant effects. Our payment provider may screen payments for fraud automatically; you can ask for a person to review a decision.
9. Your rights
You have the right to: access your data; correct it; delete it; restrict or object to its use, including direct marketing at any time; data portability (receive your data in a machine-readable format); and withdraw consent at any time.
How to use them:
- Correct your details: My account › Account details.
- Get a copy of your data, or delete your account and data: email info@markupworks.com. We delete your data except records we must keep by law (section 7).
- Stop marketing: select Unsubscribe in any email, or email us.
We reply within one month and may ask you to confirm your identity.
10. Complaints
Please contact us first at info@markupworks.com. We acknowledge data protection complaints within 30 days and tell you the outcome without undue delay. You can also complain to the UK Information Commissioner’s Office (ico.org.uk, 0303 123 1113) or, in the EU, to your local data protection authority.
11. Children
Our services are only for people aged 18 and over. We don’t knowingly collect data from children.
12. Security
We use encryption in transit (HTTPS), two-factor authentication and individual accounts for administrators, regular updates and backups, private storage for your files, and we limit access to personal data to the people who need it.
If there is a data breach: we report it to the Information Commissioner’s Office within 72 hours of becoming aware of it where the law requires, and we tell you without undue delay if it is likely to result in a high risk to your rights and freedoms, explaining what happened and what you can do.
13. Changes
We will post any changes here and, if they are significant, tell you by email.