Privacy Policy

The Data Controller is:

As the data controller, I decide why and how personal information collected through this website and in connection with my business is processed. I remain responsible for those decisions when I use service providers to process information on my behalf.

The information collected depends on how you interact with the website and with me.

Information you provide directly

You may provide personal information when you:

• submit a contact or consultation form
• request an SEO audit, quotation or proposal
• contact me by email, telephone or another communication channel
• subscribe to a newsletter or marketing communication
• become a client
• provide information necessary for me to deliver professional services

This may include:

• your name
• email address
• telephone number
• company or organisation name
• postal or business address
• job title
• information contained in your enquiry or message
• information about your website, business or marketing activities
• billing and invoicing information
• communication preferences
• any other information you choose to provide

Please avoid sending sensitive personal information through website forms unless it is genuinely necessary.

Information collected automatically

When you visit the website, certain technical and usage information may be collected automatically by the website or third-party services used to operate, secure and analyse it.

This may include:

• IP address
• approximate geographical location
• browser type and version
• device type
• operating system
• referring website or source
• pages visited
• time and date of visits
• time spent on pages
• links and buttons clicked
• scrolling and interaction information
• session information
• cookie and similar technology identifiers
• cookie consent choices and related consent records
• technical diagnostic and security information

If you consent to relevant analytics technologies, some tools may also collect interaction information such as mouse movements, scrolling behaviour and page engagement. Tools used for security and essential website operation may process limited technical information without optional cookie consent.

I only use personal information where there is a legitimate reason to do so.

Responding to enquiries

If you contact me through the website, email, telephone or another channel, I use the information you provide to respond to your enquiry, discuss your requirements and provide requested information, quotations or proposals.

The lawful basis will normally be:

• taking steps at your request before entering into a contract, or
• my legitimate interest in responding to business enquiries

Providing professional services

Where you become a client, I may use your information to:

• provide agreed SEO, PPC, digital marketing, website or consulting services
• communicate with you about your account or projects
• manage contracts, proposals and work
• issue invoices and manage payments
• maintain appropriate business records
• provide ongoing support

The lawful basis is normally performance of a contract and, where appropriate, compliance with legal obligations.

Website operation, security and fraud prevention

Technical information may be processed to:

• operate and maintain the website
• keep it secure
• prevent abuse, spam and malicious activity
• diagnose technical problems
• manage website traffic
• improve reliability and performance

The lawful basis is normally my legitimate interest in maintaining a secure and effective website.

Website analytics and improvement

Analytics tools may be used to understand:

• how visitors find the website
• which pages are visited
• how visitors interact with pages
• which content performs well
• technical performance
• how the website can be improved

For analytics that rely on non-essential cookies or comparable access to your device, I request consent before enabling them. Where personal information is processed through those analytics technologies, the lawful basis is normally your consent. You can withdraw it through the website's cookie settings.

Advertising and conversion measurement

I may use advertising and measurement technologies to understand whether advertising campaigns generate visits, enquiries or other conversions.

This may include Google Ads conversion measurement and remarketing technologies.

Advertising cookies and similar tracking technologies are only enabled after you consent. Where the related processing involves personal information, I normally rely on your consent. Declining marketing cookies does not prevent you from using the website.

Marketing communications

If you subscribe to a newsletter or otherwise ask to receive marketing communications, I may use your contact details to send relevant information about SEO, digital marketing, website services, articles or my professional services.

You can unsubscribe at any time using the unsubscribe option included in an email or by contacting me directly.

Depending on the circumstances, marketing may be based on consent or legitimate interests where permitted by law. Electronic marketing will also be handled in accordance with PECR.

Legal and regulatory obligations

I may process or retain information where necessary to:

• comply with tax, accounting or other legal obligations
• respond to lawful requests from public authorities
• establish, exercise or defend legal claims, or
• protect my rights, property, website, clients or users

This website uses cookies and similar technologies to provide essential features and, where you agree, understand website usage and measure advertising.

Cookies are small pieces of information stored on your device. Some technologies also access information on your device or recognise your browser. The rules apply to these technologies as well as traditional cookies.

Strictly necessary cookies

These support essential website functions, security, remembering your consent choices and features you specifically request. They do not normally require your consent under PECR. They are not used as a way of enabling optional advertising or analytics.

Analytics cookies

With your permission, analytics services such as Google Analytics 4 and, where in use, Microsoft Clarity may help me understand page visits, sources of traffic and how visitors use the website. Some analytics services can also record interactions or produce heatmaps. Optional analytics technologies are switched off unless you consent.

Marketing and advertising cookies

With your permission, services such as Google Ads may use cookies or similar technologies for conversion measurement, advertising attribution and remarketing. These are switched off unless you consent. I do not treat advertising cookies as strictly necessary.

Embedded content and third-party features

Some pages may include maps, videos, widgets or other content from external providers. Loading such content may involve sharing technical information with its provider. Where an embedded feature sets or reads non-essential information on your device, the relevant consent requirements apply.

How Cookie Confirm manages your choices

I use Cookie Confirm to present the cookie banner and manage consent preferences. When you first visit, you can accept all optional categories, reject them or choose which categories to allow. Non-essential analytics and marketing categories are off by default.

Cookie Confirm also helps keep a record of consent choices. Its provider states that these records may include a partial IP address, browser user-agent information, country, consent status and the method of consent. Its published standard retention period for these logs is up to one year unless otherwise agreed. This information is used to manage and evidence your cookie preferences, rather than to send marketing messages.

You can change or withdraw your choices later using the Cookie Settings control on the website. Withdrawing consent does not change whether processing already carried out while consent was valid was lawful. You can also use your browser's cookie controls, although this may affect some features.

For the current cookie list, purposes, providers and expiry periods, please see my Cookie Policy. For information about the consent-management provider itself, see Cookie Confirm's privacy policy.

I use selected third-party providers to operate, secure, analyse and improve the website and to support my business activities.

Depending on the pages and features you use, these may include the following.

Google

Google services may include:

• Google Analytics 4
• Google Tag Manager
• Google Ads conversion measurement
• Google Ads remarketing
• Google Maps
• Google Fonts
• Google reCAPTCHA where enabled

Depending on the service and your cookie preferences, Google may receive technical information such as IP address, device information, cookie identifiers and website usage information.

Cookie Confirm

Cookie Confirm provides the cookie consent banner, preference controls and consent record service. It may process limited technical information and consent choices on my behalf, as described in section 4. Cookie Confirm is operated by Hashtag SEM Marketing Management FZCO, a business registered in the United Arab Emirates. Please see its privacy policy for further information.

Microsoft Clarity

Microsoft Clarity may be used to understand how visitors interact with pages through tools such as heatmaps and session recordings.

Information processed may include device and browser information, clicks, scrolling, page interactions, approximate location and other website usage information.

Where used on this website, optional Clarity tracking is subject to your analytics cookie consent.

Cloudflare

Cloudflare may be used for website security, traffic management, performance optimisation, content delivery and protection against malicious traffic or automated bots.

Because Cloudflare sits between visitors and the website, it may process technical information including IP addresses, browser information and request data.

Elfsight

The website may use Elfsight to display embedded widgets or externally sourced content.

Elfsight may receive usage and device information when a widget is loaded or used.

Zoho

Zoho services may be used for customer relationship management, business administration, invoicing or related operational activities.

Information processed may include contact information, company information, communications and billing details where relevant.

OpenAI and AI-powered functionality

Certain tools or website features may use OpenAI technology or other artificial intelligence services.

Where an AI-powered feature is provided, information you deliberately submit to that feature may be transmitted to the relevant AI service in order to generate a response or perform the requested function.

Website hosting and technical providers

Personal and technical information may also be processed by companies that provide:

• website hosting
• email delivery
• database services
• backups
• security
• website maintenance
• other technical infrastructure

These providers only receive information necessary to perform the relevant service.

The website uses contact forms to allow you to send enquiries.

When you complete a form, I may collect information including your:

• name
• email address
• telephone number
• company name
• the information contained in your message

The information is used primarily to respond to your enquiry and, if appropriate, discuss potential services.

Form submissions may be stored within the website and/or sent to me by email.

Submitting an enquiry does not automatically subscribe you to marketing communications.

Where newsletter or email subscription facilities are available, your email address and any other information you provide may be used to send the communications you requested.

You can unsubscribe at any time.

I may retain limited information confirming that you have opted out so that I can ensure your preference continues to be respected.

I do not sell personal information or mailing lists to third parties.

I do not sell or rent your personal information.

I may share information where reasonably necessary with:

• hosting and website infrastructure providers
• analytics providers
• cookie consent management providers, including Cookie Confirm
• CRM and business administration providers
• email and communication providers
• accountants and professional advisers
• advertising and marketing platforms
• security and fraud-prevention providers
• technology providers supporting services I deliver
• public authorities where disclosure is required by law

Where a third party processes information on my behalf, I take reasonable steps to ensure that appropriate data protection arrangements are in place.

Some of the service providers used by this website and my business operate outside the United Kingdom. Depending on the service, personal information may be processed in the European Economic Area, the United States, the United Arab Emirates or other countries. Cookie Confirm's operator is registered in the United Arab Emirates, although its service may use infrastructure in other locations.

Where a transfer is restricted under UK data protection law, an appropriate legal transfer mechanism must apply. This may include UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to EU Standard Contractual Clauses, or another mechanism recognised under UK law, depending on the recipient and circumstances.

You can contact me to request further information about a particular transfer and the safeguards that apply.

I do not keep personal information for longer than reasonably necessary.

The appropriate retention period depends on why the information was collected and whether there are legal, accounting or contractual reasons to keep it.

As a general guide:

• Enquiries from prospective clients: normally retained for up to two years after the last meaningful contact unless there is a continuing business reason to retain them.
• Client records and correspondence: retained for the duration of the client relationship and for a reasonable period afterwards where necessary for business, contractual or legal purposes.
• Invoices, transaction and accounting records: retained for the period required under applicable tax and accounting legislation, typically up to six years.
• Marketing information: retained until you unsubscribe, withdraw consent or the information is no longer required. Limited suppression information may be kept after an opt-out to make sure your preference is respected.
• Analytics and technical information: retained in accordance with the settings and retention periods applied to the relevant analytics or technology service.
• Cookie consent records: Cookie Confirm states that its standard consent logs are held for up to one year unless a different arrangement has been agreed.
• Security logs: retained for as long as reasonably necessary to investigate security issues, prevent abuse or maintain website integrity.

Information may be retained for longer where required by law or where reasonably necessary to establish, exercise or defend legal claims.

I take appropriate technical and organisational measures designed to protect personal information against:

• unauthorised access
• loss
• misuse
• disclosure
• alteration
• destruction

Measures may include encrypted connections, access controls, secure hosting, software updates, backups, security monitoring and limiting access to information to those who genuinely need it.

No internet-based service can guarantee absolute security, but reasonable precautions are taken to reduce risks.

Depending on the circumstances and the lawful basis used for processing, UK data protection law gives you a number of rights.

These may include the right to:

• access the personal information I hold about you
• rectify inaccurate or incomplete information
• erase your personal information in certain circumstances
• restrict the way your information is processed
• object to certain processing based on legitimate interests
• object to direct marketing at any time
• receive certain information in a portable format where the right to data portability applies
• withdraw consent at any time where processing is based on consent, and
• complain to a data protection regulator

Not every right applies in every situation.

Requests can be sent to: hi@georgepapatheodorou.com. You may also withdraw optional cookie consent using the website's Cookie Settings control.

I may need to verify your identity before fulfilling a request.

Valid requests will normally be handled within one month, although data protection legislation permits additional time in certain circumstances.

Your right to object

Where processing is based on legitimate interests, you may also have the right to object based on your particular circumstances.

If you have a concern or complaint about how I handle your personal information, you can email hi@georgepapatheodorou.com or write to the postal address in section 1. Please explain the issue and provide any information that will help me look into it. You do not need to use a particular form.

I will acknowledge receipt of a data protection complaint within 30 days. I will make appropriate enquiries, keep you informed where needed, and explain the outcome without undue delay.

You also have the right to complain to the UK's independent data protection regulator, the Information Commissioner's Office (ICO), whether or not you first contact me.

If you live outside the United Kingdom, you may also have rights to raise concerns with a relevant local data protection authority.

Website analytics, advertising and remarketing technologies may use automated methods to categorise website interactions or audiences.

I do not use information collected through this website to make solely automated decisions that produce legal effects or similarly significant effects about individuals.

This website is primarily intended for businesses, professionals and people interested in digital marketing services and information.

It is not designed or directed specifically at children, and I do not knowingly seek to collect personal information from children through the website.

If you believe that a child has provided personal information inappropriately, please contact me.

This website contains links to external websites and services.

I am not responsible for the privacy practices, content or security of third-party websites. You should review the privacy information provided by those organisations before submitting personal information to them.

I may update this Privacy Policy periodically to reflect:

• changes to the website
• changes to the services or technologies I use
• changes to my business activities, or
• changes in legal or regulatory requirements

The latest version will always be published on this page and the date at the top of the policy will be updated.

Where a material change requires fresh consent, I will request that consent where required.

For questions about this Privacy Policy, the personal information I hold about you, or your data protection rights, please contact: