Privacy notice
This notice explains what we do with personal data on the Gydon website, and what we do with it when we provide the Gydon software to a customer. It is written to be read rather than to be survived.
Last updated: 1 September 2026
Before this goes live: the bracketed placeholders below must be filled in, and this notice should be reviewed by somebody qualified to sign it off. It is a solid starting draft, not legal advice.
Who we are
Online Marketing Surgery is the data controller for personal data collected through this website. We are registered in England and Wales under company number 08528410, at Unit 2, Blake Court, Cobbett Rd, Burntwood, Staffordshire WS7 3GL, United Kingdom. We are registered with the Information Commissioner's Office under number [TODO ICO registration number].
For anything about this notice or your data, contact hello@gydon.co.uk.
Website visitors
What we collect and why
| What | Why | Lawful basis | Kept for |
|---|---|---|---|
| Name, company, email, phone and anything else you type into an enquiry or demo form | To answer you, to prepare and run a demonstration, and to quote | Legitimate interests: responding to a business enquiry you chose to send us | Two years after our last contact, unless you become a customer |
| Your email address, where you have ticked the optional marketing box | To send you occasional news about Gydon | Consent | Until you unsubscribe, or two years without engagement |
| Server logs: IP address, browser, pages requested, timestamps | To keep the site running and to investigate abuse and faults | Legitimate interests: security and reliability | Up to 30 days |
| Analytics about how the site is used, only if you accept analytics cookies | To understand which pages are useful and improve them | Consent | As set out on our cookies page |
What we do not do
- We do not sell your personal data, and we never will.
- We do not buy marketing lists, and we do not email people who have not asked to hear from us.
- We do not set analytics or advertising cookies before you have accepted them.
- We do not use dark patterns to push you towards accepting cookies. Rejecting them takes exactly one click, the same as accepting.
Customers and their data
When we host Gydon for a customer, that customer is the data controller for the personal data they put into it: their contacts, their staff, their suppliers. We are their data processor, and we only act on their instructions. That relationship is governed by the data processing terms in our agreement with them rather than by this notice.
If you are an individual whose data is held inside a customer's Gydon and you want it corrected or removed, please contact that business directly. They control it. If you cannot identify who they are, get in touch and we will help you work it out.
We do hold ordinary business contact details for our customers' own staff, so that we can administer the service, provide support and invoice. Our lawful basis for that is the performance of our contract with the customer, and our legitimate interest in running the service properly.
Who else sees your data
We use a small number of suppliers who process personal data on our behalf. Each is bound by a contract that limits them to our instructions.
- Hosting. Our servers, and therefore the data on them. [TODO: name the hosting provider and the country the data sits in.]
- Email. The service that carries our mail. [TODO: name the email provider.]
- Analytics. Google Analytics, but only where you have accepted analytics cookies. See the cookies page.
We will also disclose data where the law requires it, or to establish or defend a legal claim.
Where your data is held
We host in the United Kingdom. Where a supplier processes data outside the UK, we rely on UK adequacy regulations or on the International Data Transfer Addendum to the European Commission's standard contractual clauses, together with any additional safeguards the transfer needs. [TODO: confirm this reflects the suppliers finally chosen.]
Your rights
Under UK GDPR you have the right to:
- ask what personal data we hold about you, and get a copy of it
- have inaccurate data corrected
- have data erased, where we no longer have a good reason to hold it
- restrict how we use it while a question about it is resolved
- object to processing we are carrying out on the basis of legitimate interests
- receive data you gave us in a portable form
- withdraw consent at any time, where consent is what we relied on
Ask by emailing hello@gydon.co.uk. We will respond within one month. There is no charge.
If you are not happy with how we have handled it, you can complain to the Information Commissioner's Office at ico.org.uk, or by calling 0303 123 1113. We would rather you came to us first so we can put it right.
Changes to this notice
If we change it we will update the date at the top. Where a change materially affects people we already hold data about, we will tell them.