Privacy notice

1. Who I am

Albek Marketing Ltd is the data controller for everything described on this page. In plain terms: it is my decision what data is held and what is done with it, so it is my responsibility.

There is no data protection officer, because a business this size is not required to appoint one. Everything comes to the address above.

2. The short version

I send business-to-business email to UK businesses about rebuilding their websites. The contact details I use are ones the business already publishes. There is no tracking of any kind I have chosen to add: no pixels, no open tracking, no click tracking, no cookies and no analytics on this website. The web server does keep ordinary access logs, as every web server does — section 12 says exactly what is in them. If you tell me to stop, I stop, and the only thing I keep afterwards is the minimum needed to make sure you are not contacted again by mistake.

3. What I hold about business contacts

For a business that has not replied to me, the record is small and is almost entirely about the business rather than about a person:

• Business name, trading address and postcode
• The business telephone number and email address as published
• The website address
• Business listing details such as category, rating and number of reviews, as published on a public listing
• Where the business is a registered company: the company number, registered name and registered office, taken from the Companies House register
• Technical measurements of the public website — whether it uses HTTPS, whether it declares a mobile viewport, how wide it renders at a 360 pixel screen width, what size the text renders at, and what software built it
• Text taken from the public pages of the website, used to build a rough example page
• A record of whether I emailed the business, when, and what was said in reply

Much of that is information about a company, which is not personal data at all. But an email address like firstname@thebusiness.co.uk does identify a person, and once one field in a record identifies someone the whole record is treated as personal data. So I apply this notice to the lot rather than trying to sort it into two piles.

I do not hold, and do not want, any special category data: nothing about health, beliefs, politics, ethnicity or anything similar. I do not hold personal financial details. Customer invoices are in the name of the business.

4. Where it came from

None of it came from you directly, which is exactly why the law requires me to tell you this. The sources are:

• Your own website. The contact details, services and wording published on your public pages.
• Public business listings — principally Google business listings — including details that businesses publish there themselves.
• A commercial supplier of business listing data, which compiles the above from those public sources and sells it as a file. This is where the initial list came from.
• The Companies House register, which is a free public register maintained by the UK government, used to confirm whether a business is a registered company.

I do not guess email addresses. If an address was not published, the business is not contacted — I do not try info@ and hope, because a bounced guess is both rude and damaging to the sending domain.

5. Why I am allowed to hold and use it

The lawful basis is legitimate interests, under Article 6(1)(f) of the UK GDPR. The legitimate interest is straightforward: telling a business about a service that is directly relevant to a measurable problem with its own website.

That basis requires me to weigh my interest against your rights, so here is that reasoning honestly set out:

• The data is business data, published by the business. Nothing was scraped from a personal account or bought from a consumer list.
• The message is relevant, not scattergun. A business is only contacted if its public website actually fails one of the measurements in section 7. If the site is fine, no email is sent.
• The intrusion is low. One plain-text email to a published business address, with no attachments, no images and no tracking of any kind.
• You can end it instantly and permanently, at no cost and without explaining yourself — see section 9.
• Nothing is done that a reasonable business would find surprising. The email says what was measured, how to check it, and who sent it.

Where you become a customer, the basis for holding your details shifts to performance of a contract (Article 6(1)(b)) for the work itself, and legal obligation (Article 6(1)(c)) for keeping accounting records.

6. Marketing email: the PECR rules I apply

Marketing email in the UK is also governed by the Privacy and Electronic Communications Regulations, which draw a line between two kinds of recipient.

• Corporate subscribers — limited companies, limited liability partnerships, and other incorporated bodies — may be sent marketing email without prior consent, provided the sender identifies itself and provides a way to opt out. These are the only businesses I email.
• Individual subscribers — sole traders and ordinary partnerships — have the same protection as private individuals and may not be sent marketing email without consent. I do not email them.

Which side of that line a business falls on is decided before anything is sent, by checking the business name and, where necessary, the Companies House register. Where it is not clear, the business is left alone. Every email I send identifies Albek Marketing Ltd by name, gives the company number and registered office, and can be replied to in order to opt out.

7. Automated checks on public websites

Deciding who to contact is done by software, and it is fairer to say so than to imply a person read every site.

The software requests the public pages of a business website, identifying itself honestly as AlbekBot with a link to a page explaining what it is, at a rate that will not trouble anyone's server. It then measures four things: whether the site is served over HTTPS with a valid certificate, whether it declares a mobile viewport, whether the page is wider than the screen at 360 pixels, and what size the body text renders at. A site that fails one of those may be contacted. A site that passes is not.

This is automated processing, but it is not the kind of automated decision-making that produces legal effects or similarly significant effects on a person — the outcome is whether or not an email gets sent. If you would like to know exactly what was measured on your site, ask and I will tell you.

8. Example pages built from your content

Before contacting a business I may build a rough single-page example of its website, using wording, service lists and contact details taken from its own public pages. It is a demonstration rather than a finished site, and nothing is sold on the strength of it — but it is still your business's information sitting on a server of mine, so it needs saying plainly:

• The example lives on a web address that I own, on a subdomain that is not linked from anywhere public.
• It carries instructions telling search engines not to index or follow it, and the server sends the same instruction in its headers, so it will not appear in search results or compete with your existing site.
• Everything on it traces back to your own published pages. Nothing about your business is invented, and no accreditation, qualification or date appears unless it appears on your own site first.
• It is deleted on request, immediately and without argument. It is also deleted if you tell me you are not interested, or if you simply do not reply.

If you would rather it did not exist at all, say so and it will not.

9. How to make it stop

Reply to my email, or write to the address in section 1. “Remove” on its own is a complete and sufficient message. You do not need to give a reason, and there is nothing to log into.

Then, within five working days:

• The record is removed from the sending list.
• Any example page built for your business is deleted.
• Your email address and business name are added to a suppression list.

That last one is the only piece I deliberately keep, and it is worth explaining. A suppression list is a short list of details that must never be contacted. If I deleted your details outright, a future batch of publicly listed businesses would simply pick them up again and you would hear from me a second time. Keeping the minimum needed to prevent that is both permitted and, from your point of view, the whole point. It is never used for anything else.

10. How long I keep things

• Business contact records where there was no reply: deleted within 12 months of the last contact.
• Records where you asked me to stop: the record is deleted; the suppression entry (business name and email address) is kept indefinitely, because that is the only way to guarantee you are not contacted again.
• Example pages: deleted on request, and otherwise removed within 90 days if the offer is not taken up.
• Customer records: kept while I am working for you, and afterwards for six years from the end of the relevant financial year, because HMRC and the Companies Act require business records to be retained for that period.
• Ordinary email correspondence: kept in the mailbox while it is useful, and cleared out at least annually.
• Web server access logs: kept for up to 30 days and then deleted. They are used to keep the server running and to spot abuse, never to build a profile of a visitor.

11. Who else can see it

I do not sell data, do not share it with other marketers, and do not pass it to anyone for their own purposes. The only third parties involved are the ordinary services needed to run a business:

• The email provider that hosts the mailbox, which necessarily stores the messages.
• The hosting company whose servers the websites and example pages run on.
• An accountant, and HMRC, in relation to invoices and accounts.

Each of those acts on instructions and under a contract. Where a provider stores data outside the UK, it is on terms that provide the protection UK law requires. If you want to know exactly which providers are involved at the time you ask, email me and I will tell you — that is a fair question and it has a short answer.

12. This website: cookies and analytics

This website sets no cookies, runs no analytics, contains no tracking scripts, no advertising tags and no social media buttons, and makes no requests to any other company's servers. The fonts and images are served from this site itself. That is why there is no cookie banner: there is nothing to consent to.

The web server keeps ordinary access logs — the sort every web server keeps — recording the IP address the request came from, the time, the page requested and the browser's user-agent string. These are used to keep the server running and to spot abuse, are never used to build any profile of a visitor, and are deleted after 30 days.

There is no contact form on this site, for the same reason: a form would have to send itself somewhere, and that would mean putting another company between you and me.

13. Your rights

Where the data is personal data, you have the following rights. All of them are free to use, and I will respond within one month.

• To object to direct marketing. This one is absolute — there is no balancing test and I cannot refuse it. See section 9.
• To be told what is held about you, and to receive a copy of it.
• To have it corrected if it is wrong. Given the source data is often years out of date, this happens routinely and is welcome.
• To have it erased. Subject only to the suppression entry explained in section 9, and to records I am legally required to keep.
• To restrict processing while a dispute about accuracy or legitimate interests is sorted out.
• To object to processing carried out on the basis of legitimate interests, on grounds relating to your particular situation.
• To portability of data you provided under a contract, in a machine-readable form.

To use any of them, email the address in section 1 and say which one. I may need to check that you are who you say you are, but for a request coming from the business email address in question that is usually obvious.

14. Complaining to the ICO

If you think I have handled your data badly, please tell me first — it is usually quicker to fix than to escalate. But you do not have to, and you can complain directly to the UK supervisory authority at any time:

Complaining to the ICO costs nothing and does not affect any other right you have.

15. Changes to this notice

If this notice changes in a way that affects how your data is used, the date at the top changes with it. Old versions are not kept online; if you need to know what it said on a particular date, ask.