1. Who is responsible for your data
seo-consultant.co is an independent consultancy operated by Syed, based in London, United Kingdom. For the purposes of UK GDPR, I am the “data controller”, the person who decides how and why your personal data is processed.
You can contact me about anything on this page by email at hello@seo-consultant.co. I read every message personally and reply within one working day.
2. What data I collect and why
I try to collect as little personal data as possible. What I do collect falls into three categories:
2.1 Contact data you give me directly
When you submit the brief form, email me at hello@seo-consultant.co, or message the WhatsApp number listed on this site, I collect and retain your name, email, phone / WhatsApp number, company, website, industry, budget band, preferred meeting time and the contents of your message. I use this data to reply to your enquiry, to prepare a scope of work if the engagement proceeds, and to maintain a commercial relationship if we start working together.
The legal basis is UK GDPR Article 6(1)(b), performance of a contract (or steps at your request before entering into a contract). If we do not end up working together, I retain your enquiry for 12 months on the basis of legitimate interest (Article 6(1)(f)) so that if you come back later I have context. You can ask me to delete the record at any point.
2.2 Analytics data collected automatically
This website does not load Google Analytics or Google Tag Manager. The only Google measurement code is the Google Ads tag (AW-18059952386), and it is not loaded site-wide. It appears on four pages only: the home page, and the three pages that carry an enquiry form (/contact, /free-seo-audit and /get-started). On every other page of this website no Google code loads and your browser makes no request to Google.
On those four pages the tag loads for all visitors, not only people arriving from an advert, because Google requires the tag to be present on the page an advert points to in order to measure anything at all. Loading the tag is not the same as recording you: a conversion is only ever recorded if you arrived by clicking a Google advert AND you go on to submit an enquiry form. If you arrived from organic search, from a link, or directly, no conversion is recorded for you at any point. Advertising storage stays "denied" under Google Consent Mode v2 until you accept the cookie banner, so the tag writes no advertising cookie before you choose. Every page does carry a short Google Consent Mode v2 snippet which sets advertising and analytics storage to "denied" by default: it measures nothing, contacts no server and writes no cookie. It exists precisely so that no Google tag can store anything about you before you accept the cookie banner.
Separately, and on every page, this site records any advertising click identifiers in the page address (gclid, fbclid and UTM tags) into your browser's session storage. This is how an enquiry is matched to the advert that produced it. It is cleared when you close the tab, is never sent anywhere on its own, and contains no name, email or phone number. If you send a Global Privacy Control signal, no advertising measurement runs at all.
If you arrived from a Meta (Facebook or Instagram) campaign AND you accept advertising cookies, then on a successful enquiry our server sends a SHA-256 hashed copy of your name, email address and phone number to the Meta Conversions API so Meta can attribute the conversion. Meta receives the hashes, not the plain values. If you decline advertising cookies, or send a Global Privacy Control signal, nothing is sent. There is no Meta Pixel on this website.
Under PECR, non-essential cookies require your consent. The cookie banner that appears on your first visit asks for that consent, and Google Consent Mode v2 defaults hold all advertising and analytics storage at “denied” until you accept, so the Google Ads tag cannot store anything before then. The server-side Meta Conversions API call described below is likewise withheld unless you accept advertising cookies. You can withdraw consent at any time using the “Cookie preferences” link in the footer. The legal basis for advertising measurement is UK GDPR Article 6(1)(a), consent.
2.3 Server logs
This site is hosted on Vercel. The hosting infrastructure maintains access logs containing IP addresses, user agents, and request timestamps for up to 30 days, solely for security and operational purposes. Legal basis: Article 6(1)(f), legitimate interest.
3. Who I share your data with
I do not sell your personal data. I do not share it with advertising networks, lead-generation aggregators, or anyone else who would use it for their own marketing. The only third parties who have access to any of your data are:
- Email hosting, Google Workspace.
- Form delivery, Web3Forms: receives and forwards the brief form payload to my inbox.
- WhatsApp (Meta), if you contact me via WhatsApp.
- Vercel, hosts this website and processes request logs.
- Google Ads, only if you reached this site by clicking a Google advert, and only if you consent. Used solely to attribute an enquiry to the advert that produced it. This website does not use Google Analytics.
- Meta Conversions API, only if you arrived from a Meta campaign and only if you accept advertising cookies. This is a server-to-server call. There is no Meta Pixel on this website.
- Accounting software, if we enter a commercial engagement, your invoicing details are held in UK-based accounting software for the period required by HMRC (currently 6 years from the end of the relevant tax year).
4. International data transfers
Some of the third parties above are based in the United States. Where your data is transferred outside the UK, the transfer is covered by Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum, and the EU-US Data Privacy Framework as applicable. If you want copies of the specific transfer mechanisms, email me and I will share them.
5. How long I keep your data
- Enquiries that did not proceed, 12 months from last contact, then deleted.
- Active client records, for the duration of the engagement plus 6 years afterwards to meet UK accounting and tax obligations.
- Marketing emails, until you unsubscribe.
- Server logs, 30 days.
- Advertising measurement data, retained by Google Ads and Meta under their own policies. This website stores no analytics data of its own.
6. Your rights under UK GDPR
- The right to be informed, this policy is part of how I meet that duty.
- The right of access, you can ask for a copy of the personal data I hold about you.
- The right to rectification, you can ask me to correct inaccurate data.
- The right to erasure, in most circumstances you can ask me to delete your data.
- The right to restrict processing.
- The right to data portability.
- The right to object, you can object to processing based on legitimate interest.
- Rights around automated decisions, I do not make automated decisions about individuals.
To exercise any of these rights, email hello@seo-consultant.co. I respond within one calendar month. No fee for a reasonable request.
7. How I keep your data secure
Reasonable technical and organisational measures: encryption in transit (HTTPS/TLS), encryption at rest on all primary systems, access controls on my working devices, two-factor authentication on all service logins, and diligence about phishing and social-engineering. If there is a personal data breach that is likely to result in risk to you, I will notify the ICO within 72 hours and tell you directly as soon as practical.
8. Cookies and similar technologies
- Strictly necessary cookies, used for cookie-consent preferences and basic site functionality. These do not require consent under PECR.
- Analytics cookies, none. This website does not run Google Analytics or any other analytics product.
- Advertising cookies (Google Ads), only set if you consent, and only if you reached this site by clicking a Google advert. Organic and direct visitors are served no advertising tag at all.
You can manage cookies in your browser settings at any time, or use the “Cookie preferences” link in the footer to re-open the consent banner.
9. AI tools and your data
I sometimes use AI tools to assist with drafting, outlining, and analysis. I do not paste client personal data, proprietary commercial data, or confidential strategy information into third-party AI services unless the client has agreed in writing. When client data needs to be processed by an AI system as part of a deliverable, that processing is governed by a specific written agreement.
10. Children
This site and the services offered through it are not directed at children. I do not knowingly collect personal data from anyone under the age of 16. If you believe a child has submitted data to me, please contact me and I will delete it.
11. Changes to this policy
I review this policy at least annually and update it when practices or the law change. The “last updated” date at the top reflects the most recent substantive change.
12. How to complain
If you believe I have not handled your data properly, please raise it with me first at hello@seo-consultant.co. If you are not satisfied, you have the right to complain to the Information Commissioner's Office (ICO):
- Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
- Helpline: 0303 123 1113
- Website: ico.org.uk
Last reviewed: 11 May 2026. Next scheduled review: 11 May 2027.