Privacy Policy

1. Who We Are

Grantops Consulting Ltd (company number SC834128) is a web development and cloud infrastructure company registered in Scotland. Our registered office is at Clyde Offices, 48 West George Street, Glasgow, G2 1BP.

For any privacy-related queries, contact us at grant@grantopsconsulting.com or call 07459 934592.

2. What Data We Collect

We collect personal data when you provide it to us and, for limited business-to-business prospect research, from public business sources. This includes:

• Contact form submissions: Your name, email address, subject, and message content when you use our contact form.
• Project brief submissions: Your name, email address, business name, and project details when you submit a project brief via our Start Project page.
• Checkout and intake details: Your selected package, Stripe checkout session reference, contact details, business name, and project notes when you reserve a build slot and submit the post-payment intake form. If you enter your email on the checkout page before continuing to payment, we keep it so we can follow up if you don't complete. Payment card details are handled by Stripe and are not stored by us.
• Free mockup requests: Your name, business name, email, an optional phone/WhatsApp number, and any link to your current website or social media page, when you ask for a free mockup.
• Business prospect information: A business name, company number and status, business contact details, the name or role of a business contact where publicly listed, website and public business-profile links, publicly visible trading activity, and limited notes needed to verify the business, assess whether our services may be relevant, avoid duplicate contact, and record the outcome of any outreach.
• Analytics and advertising measurement data: Browsing data collected via Google Analytics (through Google Tag Manager), Microsoft Clarity and Meta Pixel, including pages visited, time on site, referral source, device type, approximate location (city-level), ad interactions and — for Clarity — anonymised session recordings and heatmaps. These tools only run if you accept analytics and marketing cookies in our consent banner.
• Cookie preferences: Your cookie consent choice, stored locally on your device.

Public sources used for prospect research may include Companies House, a business's own website, Google Business Profile, public business pages on social media, booking or trade directories, search results, and public news sources. We use only information relevant to a person's business role and our one-to-one business outreach.

3. How We Use Your Data

We use the data we collect for the following purposes:

• To respond to enquiries and paid reservations: When you submit a contact form, project brief, checkout deposit, or intake form, we use your details to reply and discuss your project.
• To improve our website and advertising: Analytics and advertising measurement data helps us understand how visitors use our site, measure campaign performance and improve content.
• To provide services: If you become a client, we retain your contact details to manage the ongoing relationship and deliver our services.
• To respond to and follow up on enquiries: If you request a free mockup, reserve a build slot, or enquire about our services, we may reply by email, phone or WhatsApp about that enquiry and our website services. You can opt out of these follow-ups at any time — just reply “stop” or tell us.
• For limited business outreach: We research and verify potentially relevant businesses, send a tailored first-touch message where the law permits and at most one follow-up to it, record any response, and prevent duplicate or unwanted contact. We cap cold outreach at those two messages, and we do not use automated follow-up sequences.

For cold email and other stored electronic messages, we target verified corporate subscribers as defined by the Privacy and Electronic Communications Regulations (PECR), such as limited companies and limited liability partnerships. We do not knowingly send cold electronic marketing to sole traders or unincorporated partnerships that PECR treats as individual subscribers unless they have consented or the soft opt-in applies. If the subscriber type is unclear, we treat it as an individual subscriber and do not send.

Our cold outreach identifies Grantops Consulting Ltd, links to this notice, and provides a valid reply-based opt-out. You can object at any time by replying to the message or contacting us. We will stop direct marketing and add only the details needed to our suppression list so that we do not contact you again.

We do not sell or rent your personal data. We share limited data only with the service providers and advertising partners listed in section 5 where needed to run our website, communicate with you, take payment, deliver services, support approved business research and drafting, or measure advertising. We do not share it with unrelated third parties for their own marketing. For example, contact details used for Meta ad measurement are pseudonymised by hashing before they are sent.

4. Legal Basis for Processing

Under the UK General Data Protection Regulation (UK GDPR), we process your data on the following legal bases:

• Consent: For analytics cookies, advertising measurement cookies and marketing communications where consent is required.
• Legitimate interests: For responding to enquiries, improving our website, researching relevant business prospects, sending proportionate business-to-business outreach to corporate subscribers, maintaining outreach records, and keeping a suppression list. Before relying on this basis for outreach, we consider whether our interests are necessary and balanced against the person's rights and reasonable expectations.
• Contract and steps before a contract: For processing data needed to discuss, set up and deliver services you have requested or purchased.

5. Third-Party Services

We use the following third-party services that may process your data:

• Google Analytics (via Google Tag Manager): Web analytics service provided by Google LLC. Data is processed in accordance with Google's Privacy Policy. We have IP anonymisation enabled. Only loaded after you accept analytics cookies.
• Microsoft Clarity: Behavioural analytics service provided by Microsoft Corporation. Captures anonymised session recordings and heatmaps to help us understand how visitors interact with the site. Data is processed in accordance with the Microsoft Privacy Statement. Only loaded after you accept analytics cookies.
• Meta Pixel and Conversions API: Advertising measurement services provided by Meta Platforms Ireland Limited. The Meta Pixel runs in your browser to measure visits and enquiries from Facebook and Instagram ads. In addition, when you complete a purchase, our server may send a matching conversion event to Meta directly (the Conversions API) so that measurement is accurate even if your browser blocks the pixel. Where such an event includes contact details like your email address, they are cryptographically hashed (pseudonymised) before being sent, and Meta uses them to match the event to an ad interaction and for its own advertising-measurement purposes as described in its policy. Both the browser pixel and any server-side event run only if you accept analytics and marketing cookies — we send nothing for visitors who decline. For these purposes Meta acts as an independent controller; data is processed in accordance with Meta's Privacy Policy.
• Google Fonts: Font delivery service provided by Google LLC. When you visit our site, your browser requests font files from Google's servers, which may log your IP address.
• Cloudflare: CDN and security service that processes request data (IP addresses, headers) to deliver and protect our website.
• Amazon Web Services (AWS): Our hosting infrastructure provider. Contact form submissions are processed via AWS Lambda, and business outreach records are stored in our secured AWS environment.
• Zoho Mail: Our business email provider, used to send and receive enquiry, client and approved outreach messages. See Zoho's Privacy Policy.
• Stripe: Our payment processor. Stripe handles payment and card details when you reserve a build slot; we receive transaction references and status information but do not store your full card details. See Stripe's Privacy Policy.
• AI-assisted research and drafting: We may use tools provided by OpenAI and Anthropic to help review limited, publicly available business information and prepare draft outreach messages. A person reviews the evidence and every message before it is sent; these tools are not authorised to send prospect outreach. See the OpenAI Privacy Policy and Anthropic Privacy Policy.

Some of these providers may process data outside the UK. Where UK data-protection law requires a transfer safeguard, we use the provider's applicable UK adequacy route, International Data Transfer Agreement, or UK Addendum to the EU Standard Contractual Clauses, as appropriate. Contact us if you would like details of the safeguard used for a particular provider.

6. Data Retention

We retain your data for the following periods:

• Contact form data: Retained for as long as necessary to respond to your enquiry and for up to 2 years thereafter for business records.
• Client data: Retained for the duration of our business relationship and for 6 years after the end of the contract (in line with HMRC requirements).
• Business prospect data: Retained only while we assess whether the business is relevant, manage an outreach conversation, or need the record to prevent duplicate contact. When the full research record is no longer needed, it is deleted or reduced to the minimum collision or suppression information required.
• Suppression records: If you object or opt out, we retain a minimal record of the business or contact route and the objection for as long as reasonably necessary to make sure we honour it. We use that record only to prevent further marketing.
• Analytics and advertising measurement data: Google Analytics data is retained for 14 months. Microsoft Clarity data is retained for 13 months. Meta Pixel event data is retained according to Meta's own retention settings and policies.
• Cookie consent: Your preference is stored for 1 year.

7. Your Rights

Under the UK GDPR, you have the following rights:

• Right of access: You can request a copy of the personal data we hold about you.
• Right to rectification: You can ask us to correct inaccurate data.
• Right to erasure: You can ask us to delete your personal data (subject to legal obligations).
• Right to restrict processing: You can ask us to limit how we use your data.
• Right to data portability: You can request your data in a structured, machine-readable format.
• Right to object: You can object to processing based on legitimate interests. Your right to object to the use of your personal data for direct marketing is absolute, and we will stop using it for that purpose.

To exercise any of these rights, reply to an outreach message, contact us at grant@grantopsconsulting.com, or call 07459 934592. We will respond without undue delay and normally within one month. If you ask us not to contact you again, we may keep a minimal suppression record rather than erase every identifier, solely so that we can honour your request.

8. Cookies

For detailed information about the cookies we use, please see our Cookie Policy.

9. Changes to This Policy

We may update this privacy policy from time to time. Any changes will be posted on this page with an updated revision date. We encourage you to review this page periodically.

10. Complaints

If you are unhappy with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Helpline: 0303 123 1113