This privacy policy explains how Suri Marketing Ltd ("we", "us", "our") collects, uses, and protects your personal data when you visit our website, enquire about our services, become a client, or subscribe to our marketing.
We are the data controller for the personal data described in this policy. If you have any questions or want to exercise any of your rights, contact us using the details above.
2. Scope of this policy
This policy covers personal data we collect and use as a data controller — meaning data about our website visitors, people who enquire about our services, our clients' points of contact, newsletter subscribers, and recipients of our outreach.
When we deliver marketing services to our clients (for example, running ads, managing their CRM, or sending email campaigns on their behalf), we act as a data processor for that client. In those cases, the client is the data controller and their own privacy policy applies to the end users. Our role as a processor is governed by the Data Processing Agreement in our client contracts.
3. The personal data we collect
Depending on how you interact with us, we may collect:
When you submit an enquiry form:
Name, email address, phone number, business name, website, city, and anything you tell us in the message field.
When you book a strategy call:
The details above, plus calendar availability. Strategy calls are recorded and transcribed by our AI notetaker (Fathom). You'll be told at the start of the call and can ask us not to record.
When you subscribe to our newsletter:
Email address.
When you become a client:
Contact details, invoicing information (business address, VAT number where applicable), and any data needed to deliver services
When you visit our website:
IP address, browser type, device information, pages visited, time on site, referring website, and cookie data (see Section 9).
When we contact you via B2B outreach:
Publicly available business contact details (name, role, business email, business phone, company name), typically sourced from LinkedIn, company websites, or business directories.
4. How we use your data and our lawful bases
Under UK GDPR we must have a lawful basis for processing your data. These are the bases we rely on:
Responding to your enquiry — Legitimate interests / steps to enter a contract
Delivering services to clients — Performance of a contract
Sending our email newsletter — Consent
Marketing similar services to existing clients — Legitimate interests (soft opt-in under PECR)
B2B outreach to corporate contacts — Legitimate interests
Website analytics — Consent (via cookie banner)
Advertising and retargeting — Consent (via cookie banner)
Meeting legal, tax, and accounting obligations — Legal obligation
Improving our services and website — Legitimate interests
You can object to processing based on legitimate interests at any time (see Section 7).
5. Who we share your data with
We do not sell your data. We share it only with the following processors who help us run our business:
SiteGround — website hosting (EU/UK)
GoHighLevel — CRM, email marketing, and appointment booking (US)
Google — Analytics, Ads, Workspace (US)
Meta — advertising and pixel tracking (US/Ireland)
TikTok — advertising and pixel tracking (Ireland/US)
Fathom — AI call recording and transcription (US)
OpenAI (ChatGPT) and Anthropic (Claude) — AI assistants used to help draft content and analyse business information
Our external accountants — for invoicing, bookkeeping, and statutory filings
Professional advisers — lawyers and insurers where needed
We may also disclose your data where required by law, court order, or to protect our rights.
All our processors are bound by contracts requiring them to protect your data and only process it on our instructions.
6. International transfers
Several of the tools above are based in the United States. When we transfer personal data outside the UK, we rely on:
The UK Extension to the EU-US Data Privacy Framework (the "UK Data Bridge") where the receiving company is certified, or
Standard Contractual Clauses combined with the UK International Data Transfer Addendum.
Either way, your data is protected to a standard essentially equivalent to UK law.
7. Your rights
Under UK GDPR you have the following rights:
Access — request a copy of the data we hold about you.
Rectification — ask us to correct inaccurate or incomplete data.
Erasure — ask us to delete your data ("right to be forgotten").
Restriction — ask us to pause processing in certain circumstances.
Portability — receive your data in a portable format or have it sent to another controller.
Object — object to processing based on legitimate interests or to direct marketing.
Withdraw consent — where we rely on consent, you can withdraw it at any time; this doesn't affect processing before withdrawal.
Complain to the ICO — you can lodge a complaint with the Information Commissioner's Office at any time (ico.org.uk, 0303 123 1113), though we'd appreciate the chance to address your concerns first.
To exercise any of these rights, email Marketing@SuriMarketing.co.uk. We'll respond within one month. We won't charge a fee unless the request is manifestly unfounded or excessive.
8. How long we keep your data
Enquiry data where you don't become a client — 2 years from last contact
Client records — 6 years after end of contract (UK tax requirement)
Newsletter subscribers — Until you unsubscribe
Call recordings and transcripts — 2 years
Website analytics data — As per Google Analytics retention settings
B2B outreach prospect data — Until you opt out, or 2 years from last contact, whichever is sooner
Data that is no longer needed is securely deleted.
9. Cookies
Our website uses cookies, which fall into three categories:
Strictly necessary — required for the site to function (e.g. security, load balancing). These don't need consent.
Analytics — help us understand how visitors use the site (Google Analytics).
Marketing — used to show you relevant ads and measure ad performance (Meta Pixel, TikTok Pixel, Google Ads).
When you first visit our site, our cookie banner lets you accept or reject analytics and marketing cookies. You can change your preferences at any time via the banner or your browser settings.
10. Marketing communications
Newsletter: You'll only receive our newsletter if you sign up via our website form. You can unsubscribe at any time using the link in any email.
Existing clients: We may occasionally email you about similar services we offer. You can opt out at any time.
B2B outreach: We sometimes contact business contacts at corporate organisations whose details are publicly available, where we believe our services are genuinely relevant. We do this in line with PECR — contacting corporate subscribers only, identifying ourselves clearly, and including opt-out instructions in every message. If you don't want to hear from us, just reply and say so.
11. Security
We take the security of your data seriously. Our measures include:
All staff sign confidentiality agreements on joining.
Access to personal data is limited to staff who need it for their role.
We use reputable processors (see Section 5) with their own strong security measures.
Data is stored on services using encryption in transit and at rest.
We keep software and systems updated.
12. Children
Our services are not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe we have, please contact us and we'll delete it.
13. Changes to this policy
We may update this policy from time to time to reflect changes in our practices or the law. The "Last updated" date at the top shows when it was last revised. Significant changes will be communicated directly where appropriate.
14. Contact us
For anything relating to your data or this policy:
