Your privacy matters to us. We're committed to being transparent about how we handle your information, and we only collect what we genuinely need. This notice explains what data we collect, why we collect it, and what your rights are. If anything isn't clear, please get in touch — we're happy to explain.
What information we collect, use, and why
We collect or use the following information to provide and improve products and services for clients:
- Names and contact details
- Addresses
- Occupation
- Payment details (including card or bank information for transfers and direct debits)
- Transaction data (including details about payments to and from you and details of products and services you have purchased)
- Usage data (including information about how you interact with and use our website, products and services)
- Information relating to compliments or complaints
- Video recordings
- Audio recordings (eg calls)
- Records of meetings and decisions
- Account access information
- Website user information
We collect or use the following personal information for the operation of client or customer accounts:
- Names and contact details
- Addresses
- Purchase or service history
- Account information, including registration details
- Marketing preferences
We collect or use the following personal information for information updates or marketing purposes:
- Names and contact details
- Addresses
- Marketing preferences
- Website and app user journey information
We collect or use the following personal information to comply with legal requirements:
- Name
- Contact information
- Client account information
We collect or use the following personal information for dealing with queries, complaints or claims:
- Names and contact details
- Addresses
- Payment details
- Call recordings
- Customer or client accounts and records
- Correspondence
Lawful bases and data protection rights
Under UK data protection law, we must have a "lawful basis" for collecting and using your personal information. Which lawful basis we rely on may affect your data protection rights, which are set out in brief below:
- Your right of access - You have the right to ask us for copies of your personal information.
- Your right to rectification - You have the right to ask us to correct or delete personal information you think is inaccurate or incomplete.
- Your right to erasure - You have the right to ask us to delete your personal information.
- Your right to restriction of processing - You have the right to ask us to limit how we can use your personal information.
- Your right to object to processing - You have the right to object to the processing of your personal data.
- Your right to data portability - You have the right to ask that we transfer the personal information you gave us to another organisation, or to you.
- Your right to withdraw consent - When we use consent as our lawful basis you have the right to withdraw your consent at any time.
If you make a request, we must respond to you without undue delay and in any event within one month.
To make a data protection rights request, please contact us using the details in the footer below.
Our lawful bases for the collection and use of your data
Our lawful bases for collecting or using personal information to provide and improve products and services for clients are:
- Consent - we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
- Contract - we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
- Legal obligation - we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.
Our lawful bases for collecting or using personal information for the operation of client or customer accounts are:
- Consent - we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
- Contract - we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
- Legal obligation - we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.
Our lawful bases for collecting or using personal information for information updates or marketing purposes are:
- Legitimate interests - we're collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:
- We collect and use limited business contact information (name, work email address, company name, and publicly available website data) to contact prospective clients a single time where we have a reasonable, good-faith belief that our services are directly relevant to their business needs. This initial outreach is limited to one communication per prospect; we do not send follow-ups unless the recipient responds or opts in to further contact. We believe this processing is both legitimate and proportionate because: (1) the data used is limited to professional contact details and publicly available business information, not sensitive or private personal data; (2) each recipient is contacted only once, minimising any intrusion; (3) recipients can object at any time, and we honour opt-outs and unsubscribe requests immediately; (4) there is a genuine and specific connection between the recipient's business and the services we offer, rather than untargeted bulk outreach; and (5) we maintain a suppression list to ensure no one is contacted again after opting out or being contacted once. The benefit to us is the opportunity to introduce relevant services to businesses that may need them. The benefit to the recipient is awareness of a service that may address a current business need. The impact on the individual is minimal given the single-contact approach and the professional context of the communication.
For more information on our use of legitimate interests as a lawful basis, please contact us using the details in the footer below.
Our lawful bases for collecting or using personal information to comply with legal requirements:
- Consent - we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
- Contract - we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
- Legal obligation - we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.
Our lawful bases for collecting or using personal information for dealing with queries, complaints or claims are:
- Consent - we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
- Contract - we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
- Legal obligation - we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.
Where we get personal information from
- Directly from you
- Publicly available sources (such as Companies House and business listing directories)
- Providers of marketing lists and other personal information
How long we keep information
We don't hold on to data longer than we need to. Here's how long we keep different types:
- Suppression records (company name, website URL) — kept for as long as we do outreach, so we can make sure we never contact anyone twice or after they've opted out.
- Prospect profiles (contact details, website analysis, correspondence) — deleted 12 months after our last contact, unless the record is kept on the suppression list.
- Client data (contract details, invoices, correspondence) — kept for the length of our working relationship, plus 6 years to meet tax and legal obligations.
If you'd like more detail, please get in touch using the details in the footer below.
Who we share information with
Data processors
We use a small number of trusted services to help us operate. They process data on our behalf and under our instructions.
Mailgun — sends emails on our behalf and retains complaint and unsubscribe data to help us comply with GDPR.
Others we share personal information with
- Publicly on our website, social media, or other marketing and information media
Sharing information outside the UK
Where necessary, we may transfer personal information outside of the UK. When we do, we make sure appropriate safeguards are in place in line with the UK GDPR.
If you'd like more information or a copy of the safeguards for any transfer listed below, please contact us using the details in the footer.
Organisation name: Notion
Category of recipient: Technology
Country the personal information is sent to: United States
How the transfer complies with UK data protection law: Addendum to the EU Standard Contractual Clauses (SCCs)
Our data processors may also transfer data outside the UK on our behalf, with the same safeguards in place:
Organisation name: Mailgun
Category of recipient: Email Provider
Country the personal information is sent to: EU
How the transfer complies with UK data protection law: Addendum to the EU Standard Contractual Clauses (SCCs)
How to complain
We'd always prefer to resolve things directly, so please reach out to us first using the details in the footer below. If you're not happy with how we've handled things, you can also complain to the ICO.
