Privacy Policy
GWContent Ltd is committed to protecting your personal data in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. If you have concerns about how your data is handled, you have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint, or by calling 0303 123 1113.
01
Who We Are
GWContent Ltd is an SEO and AEO content consultancy registered in England and Wales. The company is directed by Graeme Whiles and is the data controller responsible for personal data collected through www.gwcontent.com and any associated services.
Data Controller:
GWContent Ltd
Director: Graeme Whiles
Registered address: 159 Broadgate Lane, Horsforth, Leeds, LS18 5BS
United Kingdom
Company No: 14724975
Email: graeme@gwcontent.com
Website: www.gwcontent.com
As a small company, GWContent Ltd is not required to appoint a Data Protection Officer (DPO). All data-related queries should be directed to Graeme Whiles at the contact details above.
02
Data We Collect
We collect personal data in the following circumstances:
Data you provide directly
| Data type | When collected | Examples |
|---|---|---|
| Contact details | Enquiry or contact form submission | Name, email address, company name |
| Communication content | Email or message exchange | Project requirements, questions, briefs |
| Payment information | Purchase of a service or product | Billing name, address (payment card data is processed by Shopify Payments / Stripe — we do not store card details) |
| Newsletter subscription | Email signup via Klaviyo opt-in form | Email address, optional first name |
| Professional information | Client onboarding | Business website, current SEO metrics, campaign goals |
Data collected automatically
| Data type | Source | Purpose |
|---|---|---|
| Browser & device info | Site visits | Analytics, security, performance |
| IP address | Server logs / analytics | Approximate geolocation, fraud prevention |
| Referring URL / source | Google Analytics / Shopify | Understanding how visitors find the site |
| Page views & session data | Google Analytics 4 | Site performance and content improvement |
| Cookie identifiers | Browser cookies | Session management, analytics, preferences |
We do not knowingly collect special category data (health, ethnicity, political opinions, etc.) and ask that you do not share such data via our website or contact forms.
03
How We Use Your Data
We use personal data only for the purposes it was collected and for compatible purposes. Specifically:
| Purpose | Data used |
|---|---|
| Responding to enquiries and proposals | Name, email, message content |
| Delivering contracted consultancy services | Contact details, business information, project briefs |
| Processing payments and issuing invoices | Name, billing address, email |
| Sending the GWContent newsletter (with consent) | Email address, first name (optional) |
| Analysing site usage to improve content and UX | Anonymised analytics data |
| Complying with legal and regulatory obligations | As required by law |
| Fraud prevention and site security | IP address, device/browser data |
We will not use your data for automated decision-making or profiling that produces legal or similarly significant effects.
04
Legal Basis for Processing
Under UK GDPR Article 6, we rely on the following lawful bases:
| Activity | Legal basis |
|---|---|
| Enquiry response and pre-contract communication | Legitimate interests (Art. 6(1)(f)) — responding to genuine business enquiries |
| Service delivery and invoicing | Contract performance (Art. 6(1)(b)) |
| Email newsletter | Consent (Art. 6(1)(a)) — obtained at point of subscription; withdrawable at any time |
| Analytics and site improvement | Legitimate interests (Art. 6(1)(f)) — improving site quality for visitors |
| Legal and financial record-keeping | Legal obligation (Art. 6(1)(c)) — e.g., HMRC record-keeping requirements |
| Fraud prevention | Legitimate interests (Art. 6(1)(f)) — protecting the business and its clients |
Legitimate interests: Where we rely on legitimate interests, we have assessed that our interests do not override your rights and freedoms. You have the right to object to processing based on legitimate interests — see Section 9.
05
Cookies & Tracking
This site uses cookies and similar tracking technologies. Our Cookie Policy provides full details. A summary:
| Cookie type | Provider | Purpose | Consent required? |
|---|---|---|---|
| Strictly necessary | Shopify | Session management, checkout, security | No (essential) |
| Analytics | Google Analytics 4 | Anonymised usage data | Yes |
| Marketing / email | Klaviyo | Newsletter tracking, form interactions | Yes |
| Preferences | Shopify | Currency, region, basket contents | No (functional) |
You can manage or withdraw cookie consent at any time via your browser settings or via the cookie preference centre on this site. Withdrawing consent will not affect the lawfulness of processing carried out before withdrawal.
06
Third Parties & Data Processors
We share data with third-party service providers (data processors) only where necessary to operate this site and deliver services. All processors are contractually obligated to handle data in compliance with UK GDPR.
| Processor | Purpose | Data shared | Location |
|---|---|---|---|
| Shopify Inc. | E-commerce platform, checkout, order processing | Name, email, billing address, order details | USA (SCCs in place) |
| Shopify Payments / Stripe | Payment processing | Billing details (card data handled by Stripe) | USA (SCCs in place) |
| Google LLC (Analytics 4) | Website analytics | Anonymised usage data, IP (truncated) | USA (SCCs in place) |
| Klaviyo Inc. | Email marketing platform | Email address, first name (if provided), engagement data | USA (SCCs in place) |
| Xero / accounting provider | Invoicing and financial records | Name, email, billing address | UK/EEA |
We do not sell, rent, or trade your personal data to any third party for their own marketing purposes.
07
International Transfers
Some of our third-party processors (including Shopify, Google, Klaviyo, and Stripe) are based in the United States, meaning your data may be transferred outside the UK.
All such transfers are protected by appropriate safeguards under UK GDPR, specifically:
— Standard Contractual Clauses (SCCs) approved by the ICO and/or the European Commission (where UK adequacy decisions have not been issued), and
— reliance on the processor's participation in relevant certification frameworks where applicable.
You can obtain more information about these safeguards by contacting us at graeme@gwcontent.com.
08
Retention Periods
We retain personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by law.
| Data type | Retention period | Reason |
|---|---|---|
| Client project data & correspondence | 6 years from end of engagement | Limitation Act 1980 (contract claims) |
| Financial records & invoices | 6 years from end of tax year | HMRC / Companies Act obligation |
| Enquiry / contact form data (no engagement) | 12 months | Legitimate interest; deleted if no further contact |
| Email marketing (newsletter subscribers) | Until unsubscribe or withdrawal of consent | Consent-based; removed promptly on request |
| Analytics data (GA4) | 14 months (Google's default retention) | Site improvement; aggregated / anonymised |
| Shopify order data | As set by Shopify's data retention policies | Platform requirement; up to 5 years |
When data is no longer needed, it is securely deleted or anonymised.
09
Your Rights
Under UK GDPR, you have the following rights regarding your personal data. We will respond to all valid requests within one calendar month, free of charge.
Access
Request a copy of the personal data we hold about you (Subject Access Request).
Rectification
Ask us to correct inaccurate or incomplete personal data.
Erasure
Request deletion of your data where there is no compelling reason to continue processing it.
Restriction
Ask us to restrict processing while a dispute is resolved or an objection considered.
Portability
Receive data you provided to us in a structured, machine-readable format.
Objection
Object to processing based on legitimate interests or for direct marketing purposes.
Withdraw Consent
Where processing is based on consent, withdraw it at any time (e.g., unsubscribing from the newsletter).
Complain
Lodge a complaint with the ICO at ico.org.uk if you believe we have mishandled your data.
To exercise any of these rights, contact us at graeme@gwcontent.com with your name, contact details, and a clear description of your request. We may need to verify your identity before processing the request.
Right to object to direct marketing
If you are subscribed to the GWContent newsletter, you can unsubscribe at any time via the unsubscribe link in any email. Requests will be actioned within 10 business days. Unsubscribing from marketing does not affect essential transactional communications relating to an active service engagement.
10
Children's Privacy
GWContent Ltd is a professional B2B service. This website and its services are directed at adults and businesses only. We do not knowingly collect personal data from individuals under the age of 18. If we become aware that we have inadvertently collected data from a minor, we will delete it promptly. If you believe a minor has submitted data to us, please contact graeme@gwcontent.com immediately.
11
Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our services, legal requirements, or data processing practices. Material changes will be communicated via a notice on this page, updated effective date, and — where appropriate — by email to active subscribers or clients.
The date at the top of this page indicates when this policy was last updated. Previous versions can be requested by emailing graeme@gwcontent.com.
Continued use of the site following an update constitutes acceptance of the revised policy, where such acceptance is legally valid.
12
Contact & Complaints
If you have any questions about this Privacy Policy, wish to exercise your rights, or have concerns about how your data is handled, please contact us directly:
Data Controller
GWContent Ltd
Director: Graeme Whiles
159 Broadgate Lane
Horsforth, Leeds
LS18 5BS, United Kingdom
Contact
Email: graeme@gwcontent.com
Website: www.gwcontent.com/pages/get-in-touch
Supervisory Authority
Information Commissioner's Office (ICO)
Wycliffe House, Water Lane
Wilmslow, Cheshire, SK9 5AF
ico.org.uk/make-a-complaint
Tel: 0303 123 1113
We aim to resolve any concerns informally in the first instance. You are entitled to contact the ICO at any time, but we would appreciate the opportunity to address any issue directly before a formal complaint is submitted.