Last updated: 11 October 2026
This privacy policy applies to this website and to Siteyard, the trading name of Paul Pratt, a sole trader based in Midlothian, Scotland, who builds and runs websites, booking and follow-up for service businesses. Siteyard is the data controller for the personal information described in this policy and is responsible for how it is collected, used and protected. We recommend reviewing it from time to time, as it may change.
What information we collect and store
The sections below list each type of personal information we collect, the specific pieces involved, our lawful basis for processing it under the UK GDPR and the Data Protection Act 2018, how we use it, what happens if we do not have it, and who it may be shared with.
Name
Specific pieces of information: Your first and last name.
Legal basis for processing: Steps you ask us to take before a contract, and the contract itself once you become a client (Article 6(1)(b) UK GDPR), and our legitimate interests in responding to enquiries and running the business (Article 6(1)(f)).
How we use this information: To reply to your enquiry, arrange your free chat, prepare a proposal, set up and run your service, and keep records of the work we do for you.
What happens if we do not have it: We cannot respond to you personally or provide a service.
Who it may be shared with: Our CRM provider (HighLevel), our email provider (Google Workspace) and, if you become a client, our payment provider (Stripe).
Business details
Specific pieces of information: Your business name, what your business does, your current website, and what you would like help with.
Legal basis for processing: Steps you ask us to take before a contract, and the contract itself (Article 6(1)(b)), and our legitimate interests (Article 6(1)(f)).
How we use this information: To understand your business, prepare an accurate proposal and set up your service.
What happens if we do not have it: We cannot tailor a proposal or a service to your business.
Who it may be shared with: Our CRM provider (HighLevel) and our email provider (Google Workspace).
Phone number
Specific pieces of information: Your mobile or landline number.
Legal basis for processing: Steps you ask us to take before a contract, and the contract itself (Article 6(1)(b)), and our legitimate interests (Article 6(1)(f)).
How we use this information: To call, text or WhatsApp you about your enquiry, your free chat and your service. If you contact us by WhatsApp, your number is processed through WhatsApp.
What happens if we do not have it: We cannot call or message you, and will rely on email instead.
Who it may be shared with: Our CRM provider (HighLevel), which runs our calls, texts and WhatsApp. WhatsApp (Meta) processes messages you send us there under its own privacy policy.
Email address
Specific pieces of information: Your email address.
Legal basis for processing: Steps you ask us to take before a contract, and the contract itself (Article 6(1)(b)), and our legitimate interests (Article 6(1)(f)).
How we use this information: To reply to your enquiry, send proposals and invoices, and correspond about your service.
What happens if we do not have it: We cannot reply or send you anything in writing.
Who it may be shared with: Our email provider (Google Workspace), our CRM provider (HighLevel) and, for receipts, our payment provider (Stripe).
Messages, chats and calls
Specific pieces of information: What you tell us in messages, website chat, texts, WhatsApp, Facebook Messenger, emails and phone calls, and when.
Legal basis for processing: Our legitimate interests in answering and following up enquiries accurately (Article 6(1)(f)), and the contract once you become a client (Article 6(1)(b)).
How we use this information: To reply, follow up on what you have asked, and keep a record of what we have agreed.
What happens if we do not have it: We cannot follow up on what you have told us.
Who it may be shared with: Our CRM provider (HighLevel), which runs our chat, text, WhatsApp and call handling, and the AI providers HighLevel uses to read and reply to messages and calls, such as OpenAI and Anthropic. Meta processes messages you send through WhatsApp or Messenger under its own privacy policy.
Billing details
Specific pieces of information: If you become a client: your billing name and address, and your payment card or account details, which go straight to Stripe. We do not store full card details.
Legal basis for processing: The contract (Article 6(1)(b)) and our legal obligation to keep financial records (Article 6(1)(c)).
How we use this information: To bill you each month in advance, process any refund, and keep the records the law requires.
What happens if we do not have it: We cannot provide a paid service.
Who it may be shared with: Our payment provider (Stripe), our accountant, and HMRC where the law requires it.
IP address
Specific pieces of information: The IP address your device uses when visiting this website.
Legal basis for processing: Our legitimate interests (Article 6(1)(f)) in keeping the website secure, and your consent (Article 6(1)(a)) for analytics cookies.
How we use this information: To protect the website against spam, bots and attacks, and, in anonymised form, to measure how the site is used.
What happens if we do not have it: Core security functions may not work and some site features may be unavailable.
Who it may be shared with: Our hosting, content delivery and security provider (Cloudflare), and with your consent our analytics provider (Google).
Device and online identifiers
Specific pieces of information: Browser type, device type, operating system, screen size, and cookie identifiers.
Legal basis for processing: Your consent (Article 6(1)(a)) for non-essential cookies, and our legitimate interests (Article 6(1)(f)) for strictly necessary ones.
How we use this information: To make sure the website displays correctly on your device, to understand aggregate usage of the site, and, with your consent, to see whether visits come from our ads.
What happens if we do not have it: The website still works, but we cannot tailor it to your device or measure how it is used.
Who it may be shared with: Cloudflare, and with your consent Google (Analytics) and Meta (the Meta Pixel).
Website interaction information
Specific pieces of information: Pages viewed, time on page, how you arrived at the site, and links clicked.
Legal basis for processing: Your consent (Article 6(1)(a)).
How we use this information: To understand which pages and services are of interest so we can improve the website and our services.
What happens if we do not have it: Nothing changes for you. We simply have less information with which to improve the site.
Who it may be shared with: Our analytics provider (Google) and, for ad measurement, Meta.
With whom we share your personal information
We do not sell personal information, and we do not share it with third parties for their own marketing. We share personal information only with the providers below, each of which receives only what it needs:
- Cloudflare, which hosts the website, keeps it running and secure, and checks forms for spam
- HighLevel (LeadConnector), our CRM, which stores enquiries and runs our chat, email, text, WhatsApp and call handling
- AI providers used by HighLevel, such as OpenAI and Anthropic, which process the content of chats, messages and calls so our assistant can understand and reply
- Google Workspace, our email provider
- Google, for Analytics and Tag Manager, only with your consent
- Meta, for the Meta Pixel, only with your consent, and for WhatsApp and Messenger when you message us there
- Stripe, which takes client payments
- Professional advisers, such as our accountant, where necessary
- Public authorities, such as HMRC, where the law requires it
How we manage enquiries
When you contact us, your enquiry and contact details are stored in LeadConnector, the customer relationship management (CRM) platform we use to keep track of enquiries, proposals and clients. LeadConnector processes this information on our behalf and under our instructions, and does not use it for its own purposes.
Alongside what you type, we record the consent you gave and when, the country your connection comes from, the page you sent the form from, the website you arrived from and any campaign tags in the page address (and, if you accepted cookies, the first page of your visit), so we can route your enquiry to the right person and see how you found us. Our website forms are protected by Cloudflare Turnstile, which checks that a person, not a bot, is sending them.
LeadConnector is operated by HighLevel Inc., which processes data in the United States. Transfers are protected by the safeguards described in the Location of data processing section below.
Calls and website chat
Our phone line and website chat may be answered first by an automated assistant, run through HighLevel. It replies straight away, takes your details and what you need, and passes the conversation to Paul, who follows up himself. We keep a record of the conversation so we can follow up accurately.
To do this, HighLevel uses large language models from AI providers such as OpenAI (ChatGPT) and Anthropic (Claude). They process what you say in the chat or call as HighLevel's sub-processors, to understand it and write a reply.
SMS and WhatsApp messages
If you give us your mobile number, we may text or WhatsApp you about your enquiry, your free chat and your service. We only send marketing messages with your prior opt-in consent. Message frequency varies and standard network rates may apply. You can opt out of marketing texts at any time by replying STOP, and you can ask us to stop service messages by contacting us. Our messages are sent through LeadConnector, our CRM provider.
Cookies
This website uses cookies: small text files stored on your device. Some are strictly necessary for the site to function, and others measure how the site is used. Non-essential cookies are only set with your consent, and you can withdraw that consent at any time. For the full list of cookies and your choices, see the cookie policy.
Children’s privacy
Our services and this website are aimed at businesses and adults, and we do not knowingly collect personal information from anyone under 18. If you believe a child has provided us with personal information, contact us and we will delete it.
Analytics programs
We use analytics tools to understand how visitors use this website, based on anonymised or pseudonymised data such as pages visited and time on site. Google Analytics only runs if you accept analytics cookies, and Google acts as our processor. You can opt out of Google Analytics across all websites with Google's opt-out browser add-on, or by declining analytics cookies on this site.
Advertising and remarketing
We advertise on Facebook and Instagram. With your consent, the Meta Pixel sets cookies that measure whether visits and enquiries come from our ads. You can decline these cookies in the cookie banner and manage your ad preferences in your Facebook settings. Details of the specific cookies involved are listed in the cookie policy.
Security and spam prevention
All traffic between your browser and this website is encrypted using TLS. The site sits behind a content delivery and security service that filters malicious traffic, and our forms include anti-spam protection. Access to personal information is limited to the people who need it. No method of transmission or storage is completely secure, but we take reasonable technical and organisational measures to protect your information.
Our forms are also protected by Cloudflare Turnstile, which checks that submissions come from a real person rather than an automated script. To do this, Cloudflare assesses signals such as your IP address, browser characteristics and how you interact with the page, acting as our processor. You can read more in the Cloudflare privacy policy.
Information retention
We keep enquiry details for as long as needed to deal with your enquiry, and delete them within 12 months if you do not become a client. If you become a client, we keep records of your service, invoices and related correspondence for up to six years after the end of the tax year they relate to, in line with our legal and accounting obligations. Analytics data is retained according to the analytics provider’s settings and is not tied to your client records. Your cookie choice is kept for six months, then we ask again.
Direct marketing
We only send marketing about our own services to people who have agreed to receive it. You can opt out at any time by replying STOP to a text, using the unsubscribe link in an email, or contacting us. Opting out of marketing does not stop us replying to an enquiry you have made, and we never share your details for anyone else's marketing.
If you are one of our clients' customers
We run websites, booking, call answering, messages and review requests for other businesses. If you are a customer of one of those businesses (for example, you called them, booked with them or received a review request from them), that business decides how your information is used and is responsible for it. We process it on their behalf, only on their instructions, under a data processing agreement. To exercise your rights, contact the business directly. If you contact us instead, we will pass your request to them.
Automated decision-making
We do not use your personal information for automated decision-making or profiling that produces legal or similarly significant effects about you. Our automated assistant answers and routes enquiries, but a person makes every decision about working with you.
The rights of United Kingdom residents
Under the UK GDPR you have the following rights in relation to your personal information:
- The right to be informed about how your information is used, which this policy provides
- The right of access: you can request a copy of the personal information we hold about you
- The right to rectification: you can ask us to correct information that is inaccurate or incomplete
- The right to erasure: you can ask us to delete your information in certain circumstances
- The right to restrict processing: you can ask us to limit how we use your information
- The right to data portability: you can receive your information in a structured, commonly used format
- The right to object: you can object to processing based on our legitimate interests or to direct marketing
- The right to withdraw consent at any time, where processing is based on consent
- Rights related to automated decision-making, although we do not carry this out
The rights of California residents
If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), gives you rights over your personal information in addition to anything described above:
- The right to know what personal information we collect, use and disclose, and to access a copy of it
- The right to ask us to delete your personal information
- The right to correct inaccurate personal information
- The right to opt out of the sale or sharing of personal information
- The right to limit the use of sensitive personal information
- The right not to be discriminated against for exercising any of these rights
We do not sell personal information. The only "sharing" for cross-context behavioural advertising is the Meta Pixel, which runs only if you accept marketing cookies; declining or switching them off in the cookie settings opts you out. To exercise any of these rights, contact us using the details below. We will verify your request and respond within the timescales the CCPA requires. You can also use an authorised agent to submit a request on your behalf.
Exercising your rights
To exercise any of these rights, contact us using the details at the end of this policy. We may need to verify your identity before acting on a request. We will respond within one month, and there is normally no fee. If a request is complex we may extend this by up to two further months, and we will tell you if so.
Complaints
If you are unhappy with how we have handled your personal information, please contact us first so we can try to put it right. You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK supervisory authority, at ico.org.uk or by calling 0303 123 1113.
Location of data processing
We are based in Scotland and your information is primarily processed in the United Kingdom. Some of our service providers, such as HighLevel and the AI providers it uses, Google, Meta, Stripe and Cloudflare, process data in the United States or the European Economic Area.
Where that happens, transfers are protected by UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework where the provider is certified), the UK International Data Transfer Agreement, or equivalent safeguards.
Third-party websites
This website links to third-party websites and services, such as Google, Facebook and WhatsApp. We are not responsible for the privacy practices of those sites, and this policy does not apply to them. We recommend reading the privacy policy of any site you visit.
Transferring data
If Siteyard is ever sold, merged or reorganised, personal information may be transferred to the new owner as part of that transaction so that services can continue. Any new owner will be bound by terms at least as protective as this policy.
Questions
If you have any questions about this policy or how we handle your personal information, contact Paul Pratt, trading as Siteyard, 123 Any Street: email hello@siteyard.co or call 07782 223959.