Privacy Policy
Last updated: 5 October 2026
This notice explains what we do with personal information when you use buzzboost.co.uk or send us an enquiry through it.
Who we are
This website is operated by BUZZBOOST DIGITAL LTD, a company registered in England and Wales under company number 15960977, whose registered office is 26 Northview Drive, Westcliff-on-Sea, Essex, SS0 9NG, United Kingdom. We are the controller of the personal information described here.
We are registered with the Information Commissioner’s Office under reference ZB951525. For anything in this notice, contact support@buzzboost.co.uk or write to us at the registered office above.
What this notice covers
It covers this website. Our Client Portal at ops.buzzboost.co.uk is a separate service with its own sign-in, used by existing clients. Confirmed Bolt enquiries are saved in this website’s WordPress database and may be passed to BuzzBoost’s internal enquiry and support system, with relevant notifications to our team, so we can handle new-project enquiries and support requests. Submitting an enquiry does not create a client-portal account. If you are a client, the handling of information in the work we do for you is dealt with in your proposal, service agreement or care plan.
What we collect
When you send an enquiry
The short form used on the home page and service pages collects your name, work email address, company name, phone number and your message. The form on the contact page collects your name, work email address, company name, website address, the kind of work you are interested in, and your message.
Alongside what you type, our form software records the IP address the submission came from, which helps us identify and block spam, together with the page the form was sent from and the date and time. If you arrived through one of our campaign links, the form also records that link’s campaign labels (for example utm_source=meta), and each submission is given a random reference so we can match it to the anonymous counts our analytics and advertising tools report. Neither identifies you. Submissions are stored in this website’s database, and a notification is emailed to us so that we can reply.
Bolt’s AI chat
When you use Bolt’s AI chat, we send your current question and relevant approved BuzzBoost information through our WordPress website and Vercel gateway to OpenAI to answer it. We rely on our legitimate interests in answering questions and protecting the service. Bolt does not save a chat transcript in our website or gateway databases. We keep session and abuse-prevention metadata, including a hashed IP address. Detailed token-use and spending records are held in our Neon database and removed by daily cleanup after 30 days. Hosting and security logs, backups and OpenAI’s processing have their own retention rules. OpenAI may retain questions and responses for abuse monitoring for up to 30 days, or longer where required by law or to protect its services or others. These providers may process information outside the UK. AI chat does not itself submit an enquiry to our team. Please do not share sensitive or confidential information.
Cookies and similar technologies
Our cookie tool, Complianz, runs on this website itself and stores your cookie choices only in your browser. WordPress sets login cookies for members of our team who are signed in. If you switch the Statistics category on in cookie settings, we use Google Analytics 4 to understand how the website is used: which pages are viewed, how visitors arrive, which buttons and links are clicked, and whether an enquiry form was completed. It never receives what you type into a form, and Google Analytics is not loaded and receives nothing at all until you switch that category on. If you switch the Marketing category on, we use three advertising measurement services to see whether visits that start from our adverts lead to an enquiry: Google Ads, the Meta pixel (for Facebook and Instagram adverts) and LinkedIn’s conversion pixel. The Meta pixel receives a page view for the pages you open; LinkedIn receives nothing while you browse. All three receive a single signal when an enquiry is completed. None of them receives what you typed into the form, your name, email address or phone number, and none of them is loaded until you switch Marketing on. We do not use remarketing or build advertising audiences from visitors, and we have not switched on Google’s “enhanced conversions”, Meta’s advanced matching or automatic events, or Meta’s Conversions API. Our Cookie Policy lists each cookie and explains how to change your choices at any time.
Our Google reviews
Pages that show our Google reviews only load them if you select “Allow and show reviews” on the reviews card. Until you do, nothing is requested from Google or from Trustindex, the service that supplies the review widget, and we show a link to our Google listing instead. If you do allow it, those providers receive your IP address and basic browser information so they can deliver the files. Your choice is remembered in your browser for 12 months, and you can withdraw it by selecting “Stop showing reviews from Google and Trustindex”.
Hosting and security records
Our hosting provider keeps server and access logs, which include IP addresses, for a period they set and we do not control. A security plugin on the website records login attempts and requests it blocks, and the software the site is built on is monitored for known vulnerabilities.
Why we use it, and our lawful basis
| What we do | Lawful basis |
|---|---|
| Read your enquiry, reply to it, and talk to you about the work you are asking about | Our legitimate interests in responding to people who contact us and in running our business. Where the exchange leads to an engagement, we also rely on taking steps at your request before entering a contract. |
| Keep the website secure: block spam and suspicious requests, and keep hosting and security records | Our legitimate interests in protecting the website and the people who use it |
| Record your cookie choices in your browser, and only load optional content once you have allowed it | Your consent for anything optional. Storing your choice in your browser is strictly necessary to respect it, and follows from our legal obligation under the Privacy and Electronic Communications Regulations to ask for and respect that choice |
| Understand how the website is used so we can improve it (Google Analytics, only if you switch Statistics on in cookie settings) | Your consent, which you can withdraw at any time in cookie settings |
| Measure whether our adverts on Google, Facebook, Instagram and LinkedIn lead to enquiries (Google Ads conversion measurement, the Meta pixel and LinkedIn’s conversion pixel, only if you switch Marketing on in cookie settings) | Your consent, which you can withdraw at any time in cookie settings |
We do not use the details you send us to build a marketing list without asking you. If we ever want to send you marketing, we will ask for your permission first, and you will be able to withdraw it at any time.
Who we share it with
We do not sell personal information. The only information shared for advertising purposes is the Google Ads, Meta and LinkedIn measurement described below, and only if you switch Marketing on. We use service providers who handle information on our behalf and on our instructions:
- Hostinger — hosts this website and its database, where enquiries are stored.
- Google (Google Workspace) — our business email accounts, which receive enquiry notifications and hold our correspondence with you.
- Twilio SendGrid — delivers the notification emails this website sends.
- Trustindex — supplies the Google reviews widget, and only after you select “Allow and show reviews”.
- Google (Google Analytics and Google Tag Manager) — receives website usage data only if you have switched the Statistics category on in cookie settings. Google processes this data on our behalf under its data processing terms; it is not shared for advertising.
- Wordfence — the security plugin that records login attempts and blocked requests in this website’s own database.
Google Ads — if you switch Marketing on, Google receives the ad-measurement data described in our Cookie Policy: the ad click identifier and random identifier held in the _gcl cookies, the page address, your IP address and browser details, and the fact that an enquiry was completed. It does not receive the contents of the form. For this measurement Google acts as a separate controller under the Google Ads Controller-Controller Data Protection Terms, and uses the data as set out in its privacy policy and at policies.google.com/technologies/partner-sites.
Meta — if you switch Marketing on, Meta Platforms Ireland Limited receives, through the Meta pixel, a page view for each page you open and one “Lead” event when an enquiry is completed, together with the page address, the identifiers held in the _fbp and _fbc cookies, your IP address and browser details. It does not receive the contents of the form, your name, email address or phone number: automatic advanced matching, automatic events and the Conversions API are switched off. For this measurement we and Meta are joint controllers under Meta’s Controller Addendum, and Meta is responsible for its own use of the data after it receives it, as described in its Privacy Policy. You can ask us or Meta to exercise your rights over this data.
LinkedIn — if you switch Marketing on and complete an enquiry, LinkedIn Ireland Unlimited Company receives, through LinkedIn’s conversion pixel, one conversion signal, together with our website address, any LinkedIn cookies already in your browser, your IP address and browser details. LinkedIn receives nothing while you browse other pages. It does not receive the contents of the form, your name, email address or phone number, and we only see aggregated reports. LinkedIn decides for itself how it uses the data after it receives it, as described in its Privacy Policy. You can ask us or LinkedIn to exercise your rights over this data.
We also use ordinary business software to manage client work, proposals and accounts, which may hold your contact details and our correspondence if we go on to work together. We may share information where the law requires it, or to establish or defend a legal claim.
Where your information is held
This website is hosted in the United Kingdom. Some of our providers operate outside the UK, or use infrastructure outside it. SendGrid is operated by Twilio, a United States company; transfers to Twilio are covered by the UK International Data Transfer Agreement incorporated into Twilio’s data protection addendum, which applies automatically to our account. Where any other provider stores or processes information outside the UK, we rely on that provider’s data protection terms, which incorporate the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. Google, Meta and LinkedIn may process advertising measurement data in the United States. Those transfers rely on the UK Extension to the EU–US Data Privacy Framework, or on the UK International Data Transfer Agreement or Addendum included in their terms.
How long we keep it
We keep personal information only for as long as we need it, and then delete it. In practice:
- Enquiries you send through the website are kept for as long as we need them to deal with your enquiry and anything that follows from it. We review what is stored on the website at least once a year and delete what we no longer need.
- Correspondence in our mailbox is kept for as long as it is useful for the relationship it belongs to, and is reviewed on the same basis.
- Your cookie choices are stored only in your browser, for 12 months. Records of choices made with our previous cookie tool before 26 September 2026 are kept for no longer than 12 months from when they were made, then deleted.
- Google Analytics data (only collected if you switch Statistics on) is kept in our Google Analytics account for 2 months at event level and 14 months at user level, then deleted automatically; aggregated reports do not identify you.
- Google Ads measurement data (only collected if you switch Marketing on): the _gcl cookies expire from your browser after 90 days. Google keeps the conversion data it receives under its own retention policies; in our Google Ads account we see counts of enquiries credited to ads, not who sent them.
- Meta and LinkedIn measurement data (only collected if you switch Marketing on): the _fbp and _fbc cookies expire from your browser after 90 days and any li_fat_id cookie left from an earlier visit expires within 30 days (we no longer set it). Meta and LinkedIn keep what they receive under their own retention policies; in our ad accounts we see counts of enquiries credited to adverts, not who sent them.
- The log of emails this website sends is kept for 60 days and then deleted automatically.
- Hosting and security records are kept for the period our providers set.
- Records we need for accounting and tax are kept for six years from the end of the financial year they relate to.
You can ask us to delete an enquiry sooner, and we will unless we need to keep it for a reason we will explain.
Your rights
You have the right to ask us for a copy of the personal information we hold about you; to have it corrected if it is wrong; to have it deleted; to ask us to restrict how we use it; to object to our using it where we rely on legitimate interests; and, where it applies, to receive it in a portable form. Where we rely on your consent, you can withdraw it at any time without affecting anything done before you did.
To exercise any of these, email support@buzzboost.co.uk. We will respond within one month, and we will tell you if we need longer or need to ask you something to find your information.
If you are unhappy
Please tell us first, at support@buzzboost.co.uk — we would rather put something right than have you go elsewhere, and we will acknowledge your concern within 30 days. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk, or by calling 0303 123 1113.
How we keep it safe
This website is served over an encrypted connection. Access to the administration area is limited to a single administrator account, a security plugin monitors and blocks suspicious login attempts, and the software the site is built on is monitored for known vulnerabilities.
Changes to this notice
We will update this notice if what we do with personal information changes — for example if we add analytics, or a new provider. The date at the top shows when it was last revised.