This policy explains how we handle personal data. It covers two different situations:
When you deal with us directly — visiting our website, enquiring about our services, or becoming a client. Here we are the data controller.
When we handle data on behalf of a client — for example, sending review requests to a client's customers. Here we are the data processor, and our client is the controller.
Section 8 deals with the second situation.
1. Information we collect
When you contact us or use our website:
Name, email address, phone number, business name
Any information you include in a message or form
Website usage data — pages visited, referring site, approximate location, device and browser type
When you become a client:
Billing details (payments are processed by Stripe; we do not store card numbers)
Business information needed to deliver the service
Records of our correspondence with you
We do not knowingly collect special category data — health, ethnicity, religious belief, sexual orientation, biometric or criminal offence data. Please do not send us this information.
2. How we use your information
Purpose Lawful basis Responding to enquiries Legitimate interests Providing our services Contract Taking payment and keeping accounts Contract and legal obligation Sending service updates to clients Contract Sending marketing emails Consent, or soft opt-in where you are an existing client Improving our website and services Legitimate interests Meeting legal and tax obligations Legal obligation
Where we rely on legitimate interests, our interest is in operating and improving our business. We have considered whether this overrides your rights and interests, and we believe it does not. You can object at any time — see section 6.
Where we rely on consent, you may withdraw it at any time.
3. Marketing
If you subscribe to our emails, or if you are a client, we may send you occasional marketing about our services.
Every marketing email includes an unsubscribe link. You can also email [email protected] and we will remove you.
We do not sell or rent your details to anyone for marketing.
4. Who we share information with
We use third-party services to run our business. Each acts as a processor on our behalf:
Provider Purpose GoHighLevel (HighLevel Inc.) CRM, email and SMS delivery, website hosting Stripe Payment processing Fastmail Business email Twilio Telephone and SMS services Cloudflare DNS and website security Google Business profile, analytics
We may also share information with our accountant, and with authorities where we are legally required to do so.
We do not sell your personal data.
5. International transfers
Some of our providers are based outside the UK, primarily in the United States. Where personal data is transferred outside the UK, we rely on the safeguards set out in our providers' data processing terms, which include the UK International Data Transfer Addendum or equivalent approved transfer mechanisms.
You may request further information about these safeguards by emailing [email protected].
6. Your rights
Under UK data protection law you have the right to:
Access the personal data we hold about you
Rectify inaccurate or incomplete data
Erase your data in certain circumstances
Restrict how we process your data
Object to processing based on legitimate interests, and to direct marketing at any time
Data portability — receive your data in a portable format
Withdraw consent where we rely on it
To exercise any of these, email [email protected]. We will respond within one month.
If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk, by calling 0303 123 1113, or by writing to Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
7. How long we keep information
Data Retention Enquiries that do not become clients 12 months Client records Duration of the contract plus 6 years (tax and legal requirements) Marketing subscribers Until you unsubscribe, then a suppression record so we do not contact you again Website analytics 26 months
8. Data we process for our clients
When we deliver services to a business client, we process personal data belonging to that client's customers — typically names, email addresses, phone numbers, and details of the service they received.
In this situation:
Our client is the data controller. They decide what data is collected and why.
We are the data processor. We act only on their documented instructions.
We enter into a written data processing agreement with every client.
We do not use client customer data for our own purposes, and we do not market to it.
We delete or return this data when our contract with the client ends.
If you have received a message from us on behalf of a business and want your data removed, email [email protected]. We will action it and inform the business concerned.
9. Security
We protect personal data using access controls, encrypted connections, two-factor authentication on business systems, and reputable providers with their own security measures.
No system is completely secure. If a breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and inform you where required.
10. Cookies
Our website uses cookies for essential functionality and for analytics. Analytics cookies help us understand how the site is used.
You can control cookies through your browser settings. Blocking essential cookies may affect how the site works.
11. Children
Our services are for businesses. We do not knowingly collect data from anyone under 18.
12. Changes
We may update this policy. The date at the top shows when it was last revised. Significant changes will be notified to clients directly.
