In short: we collect only what we need to reply to you and to deliver our services. We don't ask for your financial records. We use marketing data, such as website traffic and social media statistics, to measure our work, and name you as a client only with written permission. We never sell data. This website uses no cookies and no tracking.
1. Who we are
This policy explains how [Registered company name], trading as Lodestar Marketing ("Lodestar", "we", "us"), handles personal data. We are the data controller for the personal data described here.
Registered address: [address]
Company number: [number]
Privacy contact:
2. What we collect
When you contact us
When you send our contact form, we receive your name, business name, email address, phone number (if given), the type of business and anything you write. The form passes this through our hosting provider and delivers it to our email inbox (Google Gmail). We use it only to reply to you. We don't add you to any mailing list.
When you visit this website
Our hosting provider automatically records basic technical information to keep the site running and secure, such as your IP address, browser type, the page requested and the time. We don't use analytics, advertising tags or cookies. Fonts are served from our own website, not from third parties.
When you become a client
- Contact and billing details for you and your staff who work with us.
- Marketing performance data from accounts you give us access to, such as website analytics, search statistics, Google Business Profile insights and social media statistics. We don't ask for your financial records.
- Account access to platforms we manage for you, such as your website hosting, ad accounts and business listings.
- Records of our work, including emails, reports and invoices.
We don't need, and ask you not to send, personal data about your own customers unless our written agreement specifically requires it (see section 11).
3. How we use it, and our legal basis
| Purpose | Legal basis |
|---|---|
| Replying to your enquiry and discussing a possible engagement | Steps taken at your request before a contract; our legitimate interest in responding to enquiries |
| Delivering our services and managing your accounts | Performance of our contract with you |
| Measuring the impact of our work using your marketing data | Performance of our contract with you |
| Publishing anonymised or aggregated results | Our legitimate interest in demonstrating our results, as agreed in our contract |
| Publishing results that name your business | Your consent, which you can withdraw at any time |
| Invoicing, accounting and tax records | Legal obligation |
| Keeping this website secure | Our legitimate interest in protecting our systems |
We don't make decisions about you using solely automated processing, and we don't use your data for marketing unrelated to our services.
4. Client results data
Measuring results is central to how we work, so here is exactly what we do with your marketing data:
- We use them to measure and report on the impact of our work for you.
- We may publish charts, percentages or summaries only in a form that doesn't identify your business, for example "a café in a mid-sized town", and only when we reasonably believe it can't be traced back to you.
- We will name your business, use your logo or quote you only with your separate written permission. You can withdraw that permission at any time, and we'll stop using it in new material and remove it from our website within [30] days.
- We never sell your data or share raw data with third parties, except the service providers listed below.
Marketing statistics about a company are usually not personal data. They can be, for example if you're a sole trader, so we protect them the same way as personal data.
5. Who we share it with
We only share data with service providers who help us run our business, under contracts requiring them to protect it:
- Website hosting: [e.g. Vercel Inc.]
- Email and document storage: [e.g. Google Workspace / Microsoft 365]
- Accounting and invoicing: [provider]
When we manage advertising or listings for you, we work within your accounts on platforms such as Google or Meta, under those platforms' own terms and privacy policies. We may also disclose data if required by law, or to protect our legal rights.
6. International transfers
Some of our service providers may process data outside [the UK / the EEA]. Where they do, we rely on adequacy decisions or standard contractual clauses (or the UK equivalent) to make sure your data stays protected.
7. How long we keep it
- Enquiries that don't lead to an engagement: up to 12 months.
- Client contact details and work records: for the engagement plus [6] years, to meet accounting and legal requirements.
- Raw business performance data: for the engagement plus 24 months, then deleted or fully anonymised.
- Anonymised results no longer identify anyone and may be kept indefinitely.
- Account access: we return or remove our access when the engagement ends.
- Hosting logs are kept for the period set by our hosting provider.
8. Security
We use reasonable technical and organisational measures to protect data, including strong unique passwords, two-factor authentication, access limited to people who need it, and delegated or user-level access to your platforms rather than shared passwords wherever possible. No system is completely secure, but if a breach affects your data, we'll tell you and the relevant authority when the law requires it.
9. Your rights
Depending on where you live, you may have the right to:
- access the personal data we hold about you
- have inaccurate data corrected
- have your data deleted
- restrict or object to how we use it
- receive your data in a portable format
- withdraw consent at any time, without affecting what we did before
To use any of these rights, email . We'll respond within one month. You also have the right to complain to your data protection authority: [e.g. the Information Commissioner's Office (ico.org.uk) in the UK]. We'd appreciate the chance to resolve your concern first.
10. Cookies
This website doesn't set cookies or use similar tracking technologies, so there is no cookie banner. If that changes, we'll update this policy and ask for your consent where required.
11. Your customers' data
Some of our work may involve personal data belonging to your customers, for example enquiries submitted through a website we build, or audiences in your ad accounts. For that data, you are the controller and we act as your processor. We'll process it only on your documented instructions, under the data processing terms in our Terms of Service. You're responsible for having a privacy notice on your own website and a lawful basis for that processing.
12. Changes to this policy
We may update this policy from time to time. The date at the top shows when it last changed. If we make significant changes that affect clients, we'll tell you directly.