Privacy & Data Processing Policy

1. Our roles under data protection law

Depending on the circumstances, 44-Media may act as either a Data Controller or a Data Processor.

We act as a Data Controller when we determine why and how personal information is used, for example when somebody contacts 44-Media, becomes a client, visits our website or receives marketing directly from us.

We generally act as a Data Processor when we handle personal information on behalf of one of our clients through services such as websites, forms, CRM systems, client communications, lead management, review systems and marketing automation.

In those circumstances, our client remains the Data Controller and determines the purposes for which the information is processed. This reflects the distinction between controllers and processors described by the ICO.

2. Information we may collect

Where 44-Media acts as Data Controller, we may collect information including:

• Name and business name
• Email address and telephone number
• Business and billing information
• Communications with us
• Information submitted through our website, forms or booking systems
• Information relating to the services we provide
• Technical information relating to use of our website and systems

Where we act as a Data Processor, the information processed is determined by our client and may include:

• Names and contact information
• Enquiry and lead information
• Communications and correspondence
• Appointment information
• CRM records
• Marketing preferences and consent records
• Information submitted through website forms
• Other information our client lawfully instructs us to process

Clients are responsible for determining what information they collect and ensuring they have an appropriate lawful basis for doing so.

3. How and why we use personal information

Where 44-Media acts as Data Controller, we may process information to:

• Provide and manage our services
• Respond to enquiries
• Communicate with clients and prospective clients
• Process and administer client accounts
• Manage appointments
• Improve our services
• Send marketing communications where legally permitted
• Maintain security and prevent misuse
• Meet our legal, regulatory and accounting obligations

Depending on the circumstances, our lawful basis may include performance of a contract, legitimate interests, consent or compliance with a legal obligation.

Where we rely upon legitimate interests, those interests may include operating and improving our business, communicating with existing or prospective business customers and protecting our systems.

Where consent is relied upon, it may be withdrawn at any time.

4. Processing personal data for our clients

Where 44-Media processes personal data on behalf of a client, the client is normally the Data Controller and 44-Media acts as the Data Processor.

We will:

• Process personal data only as necessary to provide the agreed services and in accordance with the client’s documented instructions;
• Ensure people authorised to access client data are subject to appropriate confidentiality obligations;
• Maintain appropriate technical and organisational security measures;
• Restrict access to authorised personnel who require access to provide the service;
• Assist clients, where reasonably required, with data-subject requests and applicable data-protection obligations;
• Inform the client without undue delay if we become aware of a personal data breach affecting data processed on their behalf;
• Use sub-processors only where necessary to provide the services and subject to appropriate data-protection arrangements;
• Provide reasonable information necessary to demonstrate our compliance with our processor obligations; and
• Return, export or delete personal data at the end of the service as described below.

The nature and purpose of this processing is the provision of 44-Media’s website, CRM, communication, marketing, automation and associated services. Processing continues for the duration of the client’s service with 44-Media unless otherwise required by law.

These provisions, together with our Terms of Business and the Client’s applicable order or service agreement, form part of our contractual data-processing terms where Article 28 UK GDPR applies.

5. Our technology and sub-processors

44-Media primarily provides its website, CRM, forms, communication and automation services using HighLevel / LeadConnector.

HighLevel acts as an underlying processor/sub-processor and uses third-party infrastructure and service providers to deliver its platform.

Our primary technology providers may include:

• HighLevel / LeadConnector — CRM, websites, forms, workflow automation, communication and related platform services.
• Amazon Web Services (AWS) — Cloud infrastructure and data storage used by HighLevel.
• Google Cloud — Cloud infrastructure and data storage used by HighLevel.
• Twilio — Communication services, where applicable.

Additional HighLevel sub-processors may be involved depending on the particular platform functionality used.

HighLevel maintains and publishes its current list of sub-processors, including the location and purpose of processing.

View HighLevel’s current sub-processor list

We do not routinely export client customer databases to separate systems or maintain separate copies outside the systems required to provide our services.

6. International data transfers

Some of our technology providers process or store information outside the United Kingdom, including in the United States.

For example, HighLevel’s published sub-processor information identifies Google Cloud and AWS data storage in the United States, along with US-based communication services including Twilio and LeadConnector.

Where personal data is transferred internationally, appropriate safeguards must be used in accordance with applicable data-protection law.

HighLevel’s Data Processing Agreement includes provisions covering UK GDPR and restricted international transfers, including applicable contractual transfer safeguards.

View HighLevel’s Data Processing Agreement

7. Security

44-Media takes reasonable technical and organisational measures to protect personal information against unauthorised access, loss, alteration, disclosure or misuse.

Our measures include, where appropriate:

• Two-factor authentication;
• Individual user accounts;
• No sharing of user credentials;
• Role-based and limited staff access;
• Access limited to personnel who require it to perform their responsibilities;
• Use of established cloud and CRM infrastructure; and
• Appropriate procedures for responding to suspected security incidents.

No online service can guarantee absolute security, but we regularly consider the safeguards appropriate to the information we process.

8. Personal data breaches

If 44-Media becomes aware of a suspected personal data breach, we will take reasonable steps to:

• Investigate and contain the incident;
• Assess the nature and potential impact of the breach;
• Take appropriate steps to mitigate further risk;
• Notify the relevant client without undue delay where client-controlled personal data may be affected;
• Provide reasonably available information to assist the client in assessing its notification obligations; and
• Cooperate with reasonable remedial or regulatory requirements.

Where 44-Media is itself the Data Controller, we will assess whether notification to affected individuals and/or the Information Commissioner’s Office is required under applicable law.

We will maintain appropriate records of personal data breaches where required.

9. Data retention and what happens when a client leaves

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, to provide our services, or to comply with legal, regulatory, tax or accounting obligations.

Where 44-Media acts as a Data Processor, client data is normally retained for the duration of the service.

When a Client’s service ends, we will, on request, provide a reasonable opportunity for relevant Client-owned data to be returned or exported in a reasonably available format before the 44-Media-managed account is deleted.

Following completion of the service and any agreed handover, the 44-Media-managed client account will be deleted and 44-Media will not intentionally retain separate copies of the client’s customer database, except where retention is required by law or reasonably necessary to establish, exercise or defend legal claims.

Information may remain temporarily within secure backups or logs maintained by underlying technology providers and will be subject to those providers’ applicable retention and deletion procedures.

10. Ownership of client data

Our clients retain ownership and control of their business and customer data.

Using 44-Media does not transfer ownership of a client’s:

• Customer or prospect database;
• Domain name;
• Business branding;
• Google Business Profile;
• Google Analytics or Search Console accounts; or
• Other client-owned information or accounts.

Ownership and transfer of websites, 44-Media software, automation frameworks, templates and other intellectual property are governed separately by our Terms of Business.

11. Data subject rights

Depending on the circumstances and applicable law, individuals may have rights including:

• Access to their personal information;
• Correction of inaccurate information;
• Erasure of their information;
• Restriction of processing;
• Data portability;
• Objection to certain processing; and
• Withdrawal of consent where processing is based upon consent.

The exact rights available depend upon the circumstances and lawful basis for processing. The ICO requires privacy information to explain the applicable rights and retention arrangements.

Where 44-Media processes information solely on behalf of one of our clients, requests concerning that information should normally be directed to that client as the Data Controller. We will reasonably assist our client in responding where required.

To exercise rights relating to information for which 44-Media is the Data Controller, contact team@44mediamarketing.com.

12. Marketing communications

We may send relevant marketing communications where we have an appropriate lawful basis to do so.

Recipients may unsubscribe from marketing communications at any time using the unsubscribe mechanism provided or by contacting us.

Opting out of marketing does not prevent us from sending service-related or administrative communications where necessary.

Where 44-Media sends communications on behalf of a client, the client remains responsible for determining the appropriate lawful basis and ensuring its contact data and instructions comply with applicable data-protection and electronic-marketing laws.

13. Third-party websites and services

Our websites and communications may contain links to third-party websites or services.

44-Media is not responsible for the privacy practices of independent third parties. Individuals should review the relevant provider’s privacy information where appropriate.

14. Complaints

If you have concerns about how 44-Media handles personal information, please contact us first at:

team@44mediamarketing.com

You also have the right to complain to the UK’s data-protection regulator, the Information Commissioner’s Office (ICO).

Information Commissioner’s Office

15. Changes to this policy

We may update this Privacy & Data Processing Policy periodically to reflect changes to our services, technology, legal obligations or data-processing arrangements.

The latest version will be published on this page together with the date it was last updated.