ClickBreeze ("Agency", "we", "us", "our") is a performance-focused digital marketing agency operating in Dundee, Scotland, serving businesses throughout Scotland and the United Kingdom.
For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018), ClickBreeze is the Data Controller responsible for deciding how and why your personal data is collected and processed through clickbreeze.co.uk.
2. Information We Collect
We believe in data minimization: we only collect the minimum information necessary to provide consultation, respond to project enquiries, deliver contracted digital marketing services, and maintain website security.
Inquiry & Contact Information: When you submit our contact or consultation forms, we collect your name, business email address, company name, telephone number (if provided), selected service interest, and any project notes you submit.
Technical & Telemetry Data: When you visit our website, our servers automatically record standard internet telemetry: IP address (used for rate-limiting, regional latency routing, and abuse mitigation), browser type, operating system, page response latency, referring URL, and session timestamps.
Client Relationship & Billing Data: If you engage our agency for services, we process corporate billing details, company registration numbers, VAT IDs (if applicable), and authorised stakeholder contact information necessary for contract administration.
We DO NOT Collect Sensitive Data: We do not collect "Special Category" personal data (such as health, biometric, political, or religious data), nor do we knowingly collect consumer financial payment card numbers directly (all media spend is handled via direct ad network portals).
3. How We Use Your Data & Lawful Basis Under UK GDPR
Under Article 6 of the UK GDPR, every processing activity must be supported by an explicit lawful basis. Here is how and why we process your data:
Responding to Consultations & Enquiries: Lawful Basis:Legitimate Interests (Article 6(1)(f)) — to communicate with commercial prospects and provide proposals requested by you.
Delivering Contracted Marketing & Consulting Services: Lawful Basis:Performance of a Contract (Article 6(1)(b)) — fulfilling agreed Statements of Work (SOWs), technical SEO audits, Google Ads management, and campaign optimization.
Accounting, Invoicing & Statutory Record-Keeping: Lawful Basis:Legal Obligation (Article 6(1)(c)) — complying with UK corporate tax, VAT, and HMRC statutory accounting regulations.
We have never sold, rented, or commercialized visitor or client data to data brokers or third-party advertisers, and we never will.
4. Cookies & Tracking Technologies Policy
Our website uses minimal, purpose-specific cookies and edge analytics strictly compliant with the Privacy and Electronic Communications Regulations (PECR) and UK GDPR:
Strictly Necessary Cookies: Essential for site functionality and security. For example, our internal administrative portal uses secure, encrypted, HTTP-only session tokens to authenticate authorised administrators. These cannot be disabled as the site cannot function securely without them.
Performance & Analytics Cookies: We measure aggregate, privacy-conscious telemetry to monitor page speed, server response times, and broken links. IP addresses are truncated or anonymised to prevent personal identification.
Marketing & Conversion Pixels: Where advertising conversion tags (such as Google Ads or Meta Pixel) are configured, they measure whether an ad resulted in a consultation booking. You can manage or disable advertising cookies at any time via your browser settings or ad network opt-out portals (Google Ad Settings).
Managing Cookies in Your Browser: You can block or delete cookies through your web browser preferences (Chrome, Safari, Firefox, Edge). Please note that blocking essential cookies may affect administrative functionality.
5. AI Search Engines, Machine Learning & Automated Decisions
As a specialist agency in Answer Engine Optimisation (AEO) and Generative Engine Optimisation (GEO), we maintain total ethical transparency regarding artificial intelligence:
Zero Third-Party Model Training: ClickBreeze does not sell, feed, or license any client commercial information, conversion analytics, or visitor contact submissions to foundation AI model developers (such as OpenAI, Anthropic, or Meta) for generative AI training.
Machine-Readable Policies: We maintain structured, machine-readable crawling policies through our /llms.txt and /robots.txt protocols, explicitly permitting authorized search citation crawlers (e.g. OAI-SearchBot, PerplexityBot) to index public insights while strictly disallowing private client endpoints.
No Automated Profiling: We do not conduct automated profiling or automated decision-making that produces legal or significant personal effects on individuals.
6. Sub-Processors & Infrastructure Security
To deliver rapid, secure, and resilient web performance, ClickBreeze partners exclusively with tier-one, privacy-certified infrastructure providers:
Cloudflare, Inc.: Global CDN edge hosting, serverless edge workers, DDoS mitigation, and serverless SQLite database storage (Cloudflare D1). Cloudflare operates under strict Data Processing Addendums (DPAs) and ISO 27001 / SOC 2 Type II certifications.
MailChannels: Secure transactional email relay used strictly to route contact form notifications to our private inbox via TLS encryption.
Google Workspace: Encrypted corporate communications, document collaboration, and cloud storage governed by Google Cloud's UK GDPR compliance framework.
All sub-processors are legally bound by formal Data Processing Agreements guaranteeing confidentiality, data protection, and adherence to UK data privacy standards.
7. International Data Transfers
Where personal data is transferred or hosted outside the United Kingdom (for example, via Cloudflare's global edge network), we ensure that an adequate level of protection is maintained through legally recognised transfer mechanisms:
Transfers to countries approved by the UK Government as providing an adequate level of data protection; or
Implementation of the UK International Data Transfer Addendum (IDTA) or European Commission Standard Contractual Clauses (SCCs) alongside supplementary technical encryption safeguards.
8. Data Retention Schedule
We do not keep personal data longer than necessary for the purpose it was collected:
Prospective Enquiries: Retained for a maximum of twenty-four (24) months from your last communication, allowing us to reference previous project scopes if you choose to re-engage us.
Contracted Client Records: Client contracts, invoices, and transaction logs are retained for six (6) years following the conclusion of the commercial contract, in strict accordance with UK HMRC tax and corporate statutory requirements.
Server Logs & IP Telemetry: Anonymised and automatically cleared on a rolling 30-day security cycle.
9. Your Statutory Legal Rights Under UK GDPR
You possess enforceable legal rights regarding your personal data. ClickBreeze is committed to facilitating any of the following statutory requests:
Right of Access: Request a complete copy of the personal data we hold about you (commonly known as a Subject Access Request / SAR).
Right to Rectification: Request correction of inaccurate, outdated, or incomplete personal data.
Right to Erasure ("Right to be Forgotten"): Request that we permanently delete your personal information where there is no overriding statutory requirement for us to retain it.
Right to Restrict Processing: Request temporary suspension of data processing during verification disputes.
Right to Data Portability: Request that your digital records be transferred directly to you or another provider in a common, machine-readable format.
Right to Object: Object at any time to data processing carried out under the basis of our legitimate interests.
To exercise any of your statutory rights, email us directly at contact@clickbreeze.co.uk. In accordance with the UK GDPR, we respond to all verified requests within one calendar month free of charge.
10. Children's Privacy
Our website, digital marketing services, and advisory offerings are strictly intended for commercial entities and business professionals aged 18 and older. We do not knowingly solicit or collect personal information from individuals under the age of 18. If you believe a minor has submitted personal data to us, please notify us immediately for swift deletion.
11. Regulatory Complaints & ICO Authority
We take all data privacy concerns seriously. If you have an inquiry, dispute, or complaint regarding how your data has been handled, we request that you contact us first so we can resolve the matter immediately.
You also have the statutory right to lodge a formal complaint with the UK supervisory authority:
Information Commissioner's Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
If you have any questions about this Privacy Policy, wish to exercise a statutory right, or require further clarification regarding our data protection standards, please contact our team:
ClickBreeze — Data Privacy Team
45/5 Erskine Street, Dundee, Scotland, DD4 6RJ, United Kingdom