Privacy Policy

Scope of this Policy

* Website visitors ("Site Visitors") * Prospective clients who fill in our contact, lead‑magnet or booking forms ("Leads") * Existing clients and suppliers ("Clients")

This Policy does not cover employee data, which is governed by a separate internal notice.

What personal data we collect

Legal bases for processing (UK GDPR & DPA 2018)

Purpose

Responding to enquiries / providing quotes

Delivering contracted services

Sending downloadable lead magnet & follow‑up emails

Sending newsletter / marketing updates

Improving our website & services (analytics, heatmaps)

Fulfilling legal / tax obligations

Legal Basis

Legitimate interest (Art. 6 (1)(f))

Contract performance (Art. 6 (1)(b))

Consent (Art. 6 (1)(a)) – obtained via explicit checkbox

Consent or Soft opt‑in under PECR

Legitimate interest

Legal obligation (Art. 6 (1)(c))

How we use your data

1. To email you the requested lead‑magnet (e.g., 7‑Point Social Content Blueprint) and related tips. 2. To schedule and conduct strategy calls via Calendly or Microsoft Teams. 3. To deliver proposals, statements of work and service reports. 4. To invoice and receive payments. 5. To administer and protect our website (troubleshooting, security logging). 6. To analyse site traffic, measure campaign effectiveness and refine content.

We will never sell your data.

Cookies & similar technologies

Our site is built on the Wix platform, which places first‑party cookies necessary for site functionality and security. We also use:

Google Analytics 4 – anonymised IP, event tracking (2‑year retention)
Meta Pixel – remarketing audiences (180‑day retention)
Hotjar – heatmaps & session recordings (365‑day retention)

On your first visit we display a GDPR cookie banner allowing you to Accept All or Manage Preferences. Non‑essential cookies load only after consent.

data retention

Data type

Contact & marketing data

Contract & billing records

Analytics datasets

Retention period

24 months of last engagement, then permanently erased or anonymised

6 years (HMRC requirement)

26 months (GA4 default)

Disclosures & international transfers

We share data only with trusted processors under GDPR‑compliant contracts:

Wix.com Ltd – website hosting (servers in EU/US with SCCs)
Google LLC – analytics & cloud storage (SCCs)
Meta Platforms Ireland Ltd – advertising (SCCs)
Calendly LLC – meeting scheduling (SCCs)
Microsoft 365 – email & files (EU data boundary)
Xero Ltd – accounting

No other third parties receive your personal data unless required by law.

data security

We implement TLS 1.2 encryption, role‑based access, MFA for admin accounts and annual penetration tests. Any paper records are stored in a locked cabinet within a secure office.

your rights

Under UK GDPR you may:

Request access to your personal data (Subject Access Request)
Request correction or deletion
Object to processing or request restriction
Withdraw consent at any time (marketing unsubscribe link)
Lodge a complaint with the ICO (www.ico.org.uk)

children

Our website and services are not directed to children under 16. We do not knowingly collect data from minors. If you believe we have, please contact us so we can delete it.

change of this policy

We may update this notice periodically. Any material changes will be posted on this page and, where appropriate, notified by email.