3.1. Where we rely on legitimate interests, we have balanced them against your rights and interests. You can object at any time (see section 10).

3.2. We don't make decisions about you based solely on automated processing that have legal or similarly significant effects on you.

4. Marketing communications

4.1. Companies and LLPs: we may send marketing emails to limited companies, LLPs and other corporate bodies ("corporate subscribers") without prior consent, as the Privacy and Electronic Communications Regulations 2003 (PECR) allow, on the basis of our legitimate interest in promoting relevant services to businesses. We only use work contact details, and only about services relevant to the business.

4.2. Sole traders, partnerships and individuals: PECR treats sole traders and partnerships in the same way as private individuals. We only send them marketing emails or texts:

1.       with their consent, for example through an opt-in checkbox on our website; or

2.       if they're an existing client, about our own similar services, provided we gave them a simple chance to opt out when we collected their details and in every message we send (the "soft opt-in").

Before emailing a prospective client for the first time, we take reasonable steps to check whether they're a corporate subscriber.

4.3. Phone calls: before making any unsolicited marketing call, we check whether the number is registered with the Telephone Preference Service (TPS) or Corporate Telephone Preference Service (CTPS), and don't call if it is, unless you've told us you're happy to be called.

4.4. Every message identifies us as the sender and gives you a free and simple way to opt out.

4.5. Stopping marketing: you can ask us to stop at any time by using the unsubscribe link in an email, replying "STOP" to a text, telling us on a call, or contacting us using the details in section 1.4. We'll stop, and keep a record so that we don't contact you again.

4.6. We will never sell your personal data to third parties for their own marketing.

5. Cookies

5.1. Our website uses cookies and similar technologies. Some are strictly necessary for the site to work. Others, such as analytics, are only used with your consent, which you can change at any time. Full details of the cookies we use, their purpose and how to manage your preferences are in our [Cookie Policy].

6. Who we share your data with

6.1. We share personal data only as needed to run our business and deliver the Services:

•         HighLevel: our CRM and automation platform, which we use to manage client relationships and send emails, calls and texts.

•         Twilio: provides our phone numbers and text messaging (through HighLevel), and verifies the business using each UK number.

•         Stripe: processes subscription payments. Stripe also uses some payment data as an independent controller, for example to prevent fraud, under its own privacy policy.

•         Google: when we manage your Google Business Profile, your business information is held by Google under its own terms.

•         Professional advisers and insurers, such as our accountant, where needed for legal, tax, accounting or insurance purposes.

•         Law enforcement and regulators, where the law requires us to.

•         A buyer of our business, if we sell or transfer all or part of it, who would continue to use your data in line with this Policy.

6.2. We do not sell your personal data.

7. If you've received a text from us on behalf of a business

7.1. We send check-in texts, review requests and reminders on behalf of local businesses we work with ("our clients"). The business you dealt with gave us your name, mobile number and details of your job so that we could send these texts.

7.2. That business is the controller of your data, and we act as its processor under a written agreement, following its instructions. Its own privacy notice explains how it uses your details.

7.3. We use your details only to send these texts, record your replies and any opt-out, and let the business know if you tell us something wasn't right with your job.

7.4. To stop the texts, reply "STOP". We won't text you again on behalf of that business.

7.5. To exercise your data rights, please contact the business directly. If you contact us instead, we'll pass your request to the business and help it respond.

7.6. If you leave a Google review, we may reply to it on the business's behalf. Our replies never include personal details beyond what you've already made public.

7.7. We keep your details only while we provide services to that business, and delete them within 30 days after our agreement with it ends, unless the business asks us to return them first.

8. International transfers

8.1. Some of the providers in section 6 store or process personal data outside the UK, including in the United States.

8.2. HighLevel and Twilio are certified to the UK Extension to the EU-US Data Privacy Framework, so transfers to them rely on the UK's adequacy regulations for that framework (the UK-US data bridge).

8.3. For other transfers outside the UK, we rely on UK adequacy regulations or appropriate safeguards, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

8.4. Contact us if you'd like more information about the safeguards we use.

9. How long we keep your data

9.1. We keep personal data only for as long as we need it for the purposes it was collected for, including legal, accounting and reporting requirements:

•         Enquiries and leads that don't lead to a contract: up to 24 months, then deleted unless you've agreed to receive marketing.

•         Client account and billing data: for the length of the contract and 6 years after it ends, to meet UK tax and accounting rules.

•         Identity details for number approval: our copies of photo ID and date of birth are deleted within 7 days of approval, or within 30 days if approval doesn't go ahead.

•         Call recordings: 12 months, unless we need them longer to deal with a complaint or legal claim.

•         Marketing consents and opt-outs: consent records until you withdraw consent, plus a reasonable period to show we respected it. We keep a minimal record of opt-outs so that we don't contact you again.

•         Our clients' customers' data: see section 7.7.

•         Cookies: as set out in our [Cookie Policy].

10. Your rights

10.1. Under UK data protection law, you have the right to:

•         access the personal data we hold about you;

•         have inaccurate personal data corrected;

•         have your personal data erased, in certain circumstances;

•         restrict or object to our use of your personal data, in certain circumstances;

•         object to direct marketing at any time, in which case we'll stop;

•         receive a copy of your personal data in a portable format; and

•         withdraw your consent at any time, where we rely on consent. This doesn't affect anything we did before you withdrew it.

10.2. To exercise any of these rights, contact us at [email protected]. We'll respond within one month. If your request is complex or you've made several, we may extend this by up to two further months, and we'll tell you if we do.

10.3. Complaints: if you're unhappy with how we've handled your personal data, please contact us first so we can try to put things right. We'll acknowledge your complaint within 30 days and respond without undue delay. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.

11. Children

11.1. Our website and Services are aimed at businesses and are not intended for children. We do not knowingly collect personal data from children.

12. Security

12.1. We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss or misuse. These include limiting access to the people who need it, using two-factor authentication on the accounts we use to access personal data, encrypting data in transit, and relying on reputable providers (such as our CRM platform and payment processor) that maintain their own security standards.

13. Changes to this Policy

13.1. We may update this Privacy Policy from time to time. The "last updated" date at the top shows when it was last revised. We'll tell clients by email about any material changes.

14. Contact us

14.1. If you have any questions, concerns or requests about this Privacy Policy or your personal data, contact us at [email protected].