1. Who We Are

Peat & Curtis ("we", "us", "our") is a digital marketing consultancy partnership based in Teignmouth, Devon, providing web design, SEO, paid advertising, reputation management, social media management, email marketing, and CRM solutions to local and regional businesses. Our website address is https://peatandcurtis.com/.

Cameron Curtis | 07825 510978 | [email protected]

Sam Peat | 07897 130862 | [email protected]

Address: Teignmouth, Devon, TQ14

2. Our Role as Data Controller and Data Processor

Peat & Curtis operates in two distinct capacities under UK GDPR:

Data Controller — when we collect and manage personal data through our own website (peatandcurtis.com), including enquiries, bookings, and marketing communications directed at us.

Data Processor — when we handle personal data on behalf of our clients as part of delivering our services (e.g., managing their CRM, email marketing lists, ad campaigns, or website contact forms). In this capacity, we act strictly on the instructions of our clients, who remain the Data Controllers for their own customer data.

This privacy policy covers our role as Data Controller in relation to our own website and business operations.

3. What Data We Collect

We may collect the following personal data when you interact with our website or services:

Full name

Business name

Email address

Phone number

Billing and payment information (processed securely via Stripe)

Any information you voluntarily provide through our contact or booking forms

Usage and analytics data collected automatically when you browse our website

4. How We Collect Your Data

We collect personal data through the following means:

Contact forms on our website when you submit an enquiry

Booking system when you schedule a call or meeting with us

Client onboarding through our client management platform at app.peatandcurtis.com

Email and telephone communications in the course of providing our services

Automatically via cookies, Google Analytics, and Google Search Console when you browse our website

5. Why We Collect Your Data

We use your personal data for the following purposes:

To respond to enquiries and provide information about our services

To onboard new clients and manage ongoing client relationships

To deliver our services, including web design, SEO, paid advertising, and digital marketing management

To process payments for our services

To send service updates, invoices, and relevant communications

To send marketing communications (only where you have opted in)

To analyse website usage and improve our online presence

To comply with our legal and contractual obligations

6. Legal Basis for Processing (UK GDPR)

Under UK GDPR, we process your personal data on the following legal grounds:

Consent: for marketing communications and newsletter sign-ups

Contractual necessity: for delivering our services and processing payments

Legitimate interests: for responding to enquiries, improving our website, and maintaining client relationships

Legal obligation: where required by UK law

7. Client Data — Our Role as Data Processor

As part of delivering our services, we may access and process personal data belonging to our clients' customers — for example, when managing a client's CRM system, email marketing campaigns, paid advertising, or website. In these cases:

Our clients are the Data Controllers and are responsible for ensuring their customers' data is collected lawfully

We act solely as a Data Processor, processing data only as instructed by our clients

We do not use client customer data for any purpose beyond delivering the agreed services

We take appropriate technical and organisational measures to protect any client data we handle

We do not share client customer data with any unauthorised third parties

8. Cookies & Tracking

Our website uses cookies and similar tracking technologies, including:

Google Analytics: to understand how visitors use our website, including pages visited, time on site, and traffic sources. This data is anonymised and aggregated.

Google Search Console: to monitor our website's performance in search results

Essential cookies: required for the website to function correctly

Our website displays a cookie consent banner upon your first visit. By continuing to use our website without adjusting your browser settings, you are consenting to our use of cookies as described in this policy. You may withdraw your consent at any time by adjusting your browser settings or clearing your cookies. For more information on how to manage cookies, visit www.aboutcookies.org.

9. Third-Party Services

We use the following third-party services which may process your data on our behalf:

Google Analytics & Google Search Console (Google LLC): website analytics and search performance monitoring

Stripe: secure payment processing. Stripe's privacy policy: stripe.com/gb/privacy

GoHighLevel / app.peatandcurtis.com: our client management and CRM platform, used for onboarding, communications, and service delivery

WordPress / Elementor: website platform and page builder (where applicable)

Meta (Facebook & Instagram): where paid advertising campaigns are managed on behalf of clients

Google Ads: where paid search campaigns are managed on behalf of clients

We do not sell, rent, or share your personal data with any other third parties beyond those listed above.

10. Where Your Data Is Stored

Personal data collected through our website and client management platform is stored securely within the United Kingdom. Our GoHighLevel-powered platform at app.peatandcurtis.com may process data through servers located within the UK and/or the European Economic Area (EEA). All data processing complies with UK GDPR requirements. Where data is transferred outside of the UK, we ensure appropriate safeguards are in place in accordance with UK GDPR Chapter V.

11. How Long We Keep Your Data

We retain your personal data for as long as necessary to fulfil the purpose for which it was collected, or as required by law. Specifically:

Enquiry data: retained for up to 12 months after last contact if no contract is entered into

Client data: retained for the duration of the client relationship and for up to 6 years thereafter, in line with standard UK business record-keeping requirements

Marketing data: retained until you withdraw consent or unsubscribe

If you wish to request deletion of your data, please contact us and we will action your request promptly in line with your rights under UK GDPR.

12. Cookie Consent

Our website uses a cookie consent banner which is displayed upon your first visit. By continuing to use our website without adjusting your browser settings, you are consenting to our use of cookies as described in this policy. You may withdraw your consent at any time by adjusting your browser settings or clearing your cookies. For more information on how to manage cookies, visit www.aboutcookies.org.

13. Children's Data

Our website and services are not directed at, or intended for use by, children under the age of 13. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has provided us with personal data, please contact us immediately and we will take steps to delete such information as soon as possible.

14. Data Breaches

In the unlikely event of a personal data breach, we will act in accordance with our obligations under UK GDPR. Where a breach is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office (ICO) within 72 hours of becoming aware of the breach. Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly without undue delay. We take appropriate technical and organisational measures to safeguard your personal data against unauthorised access, loss, or disclosure.

15. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

Right of access: you can request a copy of the data we hold about you

Right to rectification: you can ask us to correct any inaccurate or incomplete data

Right to erasure: you can request that we delete your personal data

Right to restrict processing: you can ask us to limit how we use your data

Right to data portability: you can request your data in a portable, machine-readable format

Right to object: you can object to us processing your data for marketing purposes or on the basis of legitimate interests

Right to withdraw consent: where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing

To exercise any of these rights, please contact us by email or telephone:

Cameron Curtis: [email protected] | 07825 510978

Sam Peat: [email protected] | 07897 130862

We will respond to all legitimate requests within one calendar month in line with UK GDPR requirements.

16. Complaints

If you believe we have not handled your personal data appropriately, you have the right to lodge a complaint with the UK's data protection authority:

Information Commissioner's Office (ICO)

Website: ico.org.uk

Helpline: 0303 123 1113

We would, however, appreciate the opportunity to address your concerns directly before you approach the ICO. Please contact us in the first instance.

17. Changes to This Policy

We may update this privacy policy from time to time to reflect changes in our services, legal obligations, or best practice. Any changes will be posted on this page with an updated date at the top. We encourage you to review this policy periodically. Where changes are significant, we will make reasonable efforts to notify active clients directly.

Legal note: This privacy policy was prepared in February 2026 and is intended to comply with UK GDPR and the Data Protection Act 2018. Peat & Curtis recommends that this policy is reviewed periodically and updated as services or data practices change. This policy does not constitute legal advice.