Privacy & Cookies

Policies aren't the most exciting read, but they matter. This page explains, in plain English, what personal information we collect, why, who we share it with and what your rights are.

 

Version 2.0, October 2026

1. Who we are

Build A Brand Ltd ("Build A Brand", "we", "us") is registered in England and Wales, company number 12662152. Our address is Unit 1 Bamber's Leisure, Lynn Road, Walton Highway, Wisbech, PE14 7DA.

 

We're the data controller for the personal information described in this policy. We're registered with the Information Commissioner's Office (ICO), registration number ZB267245.

 

Any questions about your data? Contact our Privacy Manager, Gemma Chapman, at gemma@buildabrand.org.uk or call 01945 232302.

2. What we collect

We only collect what we need. Depending on how you deal with us, that might include:

• Contact details: your name, email address, phone number, business name and website address.

• Enquiry details: anything you tell us through our forms, emails, phone calls, WhatsApp or social media (for example your marketing challenges or the services you're interested in).

• Order and billing details: what you've bought, your billing address and your order history. Card payments are handled by our payment providers. We never see or store your full card details.

• Project information: the content, images, logos, logins and access you share with us so we can deliver your service.

• Website and marketing data: how you use our website (pages visited, device, rough location, how you found us), collected through cookies and analytics, plus whether you open or click our emails.

• Account details: if you create an account on our website, your login details and subscription status.

 

Our services are for businesses and adults, so we don't knowingly collect information from anyone under 18. We don't collect special category data (such as health information) unless you choose to share it with us.

 

Where we get it from. Mostly from you directly. Sometimes we receive it from other places, such as a person who recommends us to you, publicly available business information (like your website, Google Business Profile or social media pages), event and competition entries, or a client's website when we're working on it for them (see section 4).

 

Do you have to give it to us? No, but if you don't, we may not be able to reply to your enquiry, deliver what you've bought or meet our legal obligations (for example, we need billing details to issue invoices).

3. Why we use it, and our legal basis

• Replying to your enquiries and following up, so we can help you and talk about working together. Legal basis: legitimate interests.

• Delivering the services and products you buy, including subscriptions like Website Care. Legal basis: contract.

• Sending order confirmations, onboarding forms, reports and service updates, as part of delivering your service. Legal basis: contract.

• Sending our newsletter, The Feed, and marketing emails with tips, news and offers. Legal basis: consent, or for existing customers, similar products and services you can opt out of at any time.

• Sending a reminder if you leave something in your basket, to help you finish your order. Legal basis: legitimate interests (you can opt out at any time).

• Keeping invoices and financial records, because the law requires it (for example HMRC). Legal basis: legal obligation.

• Understanding how our website is used, so we can improve our website and marketing. Legal basis: consent for non-essential cookies, otherwise legitimate interests.

• Showing your project in our portfolio, to showcase our work. Legal basis: legitimate interests (just ask and we won't).

 

You can unsubscribe from marketing emails at any time using the link in every email, or by contacting us.

4. Website Care and client websites

When you give us collaborator access to your website (for example for Website Care, an audit or a build), we may be able to see personal information about your customers or contacts. In that case you're the data controller and we act as your data processor. We'll only access or use that information to carry out the work you've asked for, keep it confidential and never use it for our own purposes. You can remove our access at any time. The details of how we handle that data are set out in the data processing terms within our Terms of Sale.

5. Who we share it with

We never sell your data. We only share it when we need to, with trusted providers who help us run our business, including:

• Wix & Shopify and on occasions - WordPress and WooCommerce (our website, online store, forms, email automations and subscriptions)

• Payment providers such as Wix Payments, and PayPal (to take payments securely)

• ClickUp (where we manage leads, projects and client work, including its built-in AI assistant)

• Google (email, calendar, analytics, Search Console and Google Ads)

• Meta (Facebook and Instagram, if you contact us there or we manage your accounts)

• Canva (designing your branding and marketing materials)

• SE Ranking (SEO research and website audits)

• Our accountants, IT support, solicitors and trusted freelancers or contractors, when needed, all bound by confidentiality

• HMRC and other authorities, where the law requires it

 

Each of these providers only gets the information they need, and must keep it safe. Where they handle data on our behalf, they do so under a data processing agreement.

 

AI tools. Some of the software we use (such as ClickUp and Canva) includes AI features, which we may use to help draft reports, content and summaries. A member of our team always reviews the output, we don't use AI to make decisions about you, and we review each provider's terms on how they handle your data.

6. International transfers

Some of our providers (like Wix, Google, Meta, Canva and ClickUp) store data outside the UK, including in the USA, Israel and the EU. Where that happens, we make sure appropriate protections are in place, such as UK adequacy regulations (which cover the EU and Israel), the UK-US Data Bridge or the ICO's approved contract clauses. Contact us if you'd like more details of the protections in place.

7. How long we keep it

• Enquiries that don't lead to work: 1 year after our last contact.

• Quotes and project information: for the length of the project, plus 7 years after our last contact.

• Invoices and financial records: 6 years after the end of the tax year they relate to.

• Marketing lists: until you unsubscribe. We then keep a minimal record so we don't email you again.

• Website accounts and subscriptions: while your account or subscription is active, then 1 year after it ends (billing records are kept as above).

• Logins and access to your accounts or website: only for as long as we need them for your project or subscription. We delete them when the work ends, and we recommend you change your passwords or remove our access at that point.

• Website analytics: up to 14 months.

 

When we no longer need it, we securely delete it or anonymise it, within 3 months of the end of the period above.

8. Keeping it safe

We use secure, password-protected systems with two-factor authentication, and access is limited to the team members who need it. Any logins you share with us are stored in a secure password manager, never in emails or documents. We expect the same of everyone we share data with. No system is 100% secure, but we take sensible steps to protect your information. If a breach ever happens, we'll report it to the ICO and let you know where the law requires us to.

9. Cookies

Our website uses cookies. Some are essential to make the site and checkout work. Others help us understand how the site is used or show you relevant ads, and we only use those with your permission. You can accept, decline or change your choices at any time using the cookie banner, or through your browser settings.

10. Your rights

Under UK data protection law, you have the right to:

• Be informed about how we use your data (that's this policy)

• Access the personal data we hold about you

• Correct anything that's wrong or out of date

• Ask us to delete your data, where we no longer have a good reason to keep it

• Restrict how we use it in certain situations

• Get a copy of the data you've given us, in a format you can reuse

• Object to us using it, including for marketing (we'll always stop marketing if you ask)

• Withdraw consent at any time, where we're relying on consent

 

We don't make decisions about you using fully automated processes.

 

To use any of these rights, email gemma@buildabrand.org.uk. We may need to check your ID first, and we'll reply within one month (or let you know if a complex request needs up to two months more). It's free, unless a request is clearly unfounded or excessive.

11. Complaints

If you're unhappy with how we've handled your data, please email gemma@buildabrand.org.uk first. We'll acknowledge your complaint within 30 days, look into it properly and let you know the outcome without undue delay. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

12. Changes to this policy

We'll update this policy when the way we use data changes. The latest version will always be on this page, with the date at the top.