1. Who is responsible for your data
seo-consultant.co is an independent consultancy operated by Syed, based in London, United Kingdom. For the purposes of UK GDPR, I am the “data controller”, the person who decides how and why your personal data is processed.
You can contact me about anything on this page by email at hello@seo-consultant.co. I read every message personally and reply within one working day.
2. What data I collect and why
I try to collect as little personal data as possible. What I do collect falls into three categories:
2.1 Contact data you give me directly
When you submit the brief form, email me at hello@seo-consultant.co, or message the WhatsApp number listed on this site, I collect and retain your name, email, phone / WhatsApp number, company, website, industry, budget band, preferred meeting time and the contents of your message. I use this data to reply to your enquiry, to prepare a scope of work if the engagement proceeds, and to maintain a commercial relationship if we start working together.
The legal basis is UK GDPR Article 6(1)(b), performance of a contract (or steps at your request before entering into a contract). If we do not end up working together, I retain your enquiry for 12 months on the basis of legitimate interest (Article 6(1)(f)) so that if you come back later I have context. You can ask me to delete the record at any point.
2.2 Analytics data collected automatically
This website uses Google Analytics 4 (GA4) via Google Tag Manager (GTM container ID GTM-MGZMNGBD) to measure aggregate traffic. GA4 loads with IP anonymisation enabled and Google signals turned off. The data is pseudonymised, it cannot identify you personally unless you voluntarily submit identifiable information via the contact channels above.
Under PECR, non-essential cookies require your consent. The cookie banner that appears on your first visit asks for that consent through Google Consent Mode v2 defaults, GA4 and any ad-conversion tags inside the GTM container do not fire until consent is granted. You can withdraw consent at any time using the “Cookie preferences” link in the footer. The legal basis for analytics is UK GDPR Article 6(1)(a), consent.
2.3 Server logs
This site is hosted on Vercel. The hosting infrastructure maintains access logs containing IP addresses, user agents, and request timestamps for up to 30 days, solely for security and operational purposes. Legal basis: Article 6(1)(f), legitimate interest.
3. Who I share your data with
I do not sell your personal data. I do not share it with advertising networks, lead-generation aggregators, or anyone else who would use it for their own marketing. The only third parties who have access to any of your data are:
- Email hosting, Google Workspace.
- Form delivery, Web3Forms — receives and forwards the brief form payload to my inbox.
- WhatsApp (Meta), if you contact me via WhatsApp.
- Vercel, hosts this website and processes request logs.
- Google Analytics 4 / Google Ads, only if you consent. Used for traffic measurement and ad conversion attribution. Meta Pixel + Conversions API may also fire if you consent and arrived from a Meta campaign.
- Accounting software, if we enter a commercial engagement, your invoicing details are held in UK-based accounting software for the period required by HMRC (currently 6 years from the end of the relevant tax year).
4. International data transfers
Some of the third parties above are based in the United States. Where your data is transferred outside the UK, the transfer is covered by Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum, and the EU-US Data Privacy Framework as applicable. If you want copies of the specific transfer mechanisms, email me and I will share them.
5. How long I keep your data
- Enquiries that did not proceed, 12 months from last contact, then deleted.
- Active client records, for the duration of the engagement plus 6 years afterwards to meet UK accounting and tax obligations.
- Marketing emails, until you unsubscribe.
- Server logs, 30 days.
- Analytics data, 14 months (GA4 EU default).
6. Your rights under UK GDPR
- The right to be informed, this policy is part of how I meet that duty.
- The right of access, you can ask for a copy of the personal data I hold about you.
- The right to rectification, you can ask me to correct inaccurate data.
- The right to erasure, in most circumstances you can ask me to delete your data.
- The right to restrict processing.
- The right to data portability.
- The right to object, you can object to processing based on legitimate interest.
- Rights around automated decisions, I do not make automated decisions about individuals.
To exercise any of these rights, email hello@seo-consultant.co. I respond within one calendar month. No fee for a reasonable request.
7. How I keep your data secure
Reasonable technical and organisational measures: encryption in transit (HTTPS/TLS), encryption at rest on all primary systems, access controls on my working devices, two-factor authentication on all service logins, and diligence about phishing and social-engineering. If there is a personal data breach that is likely to result in risk to you, I will notify the ICO within 72 hours and tell you directly as soon as practical.
8. Cookies and similar technologies
- Strictly necessary cookies, used for cookie-consent preferences and basic site functionality. These do not require consent under PECR.
- Analytics cookies (GA4), only set if you consent via the cookie banner.
- Advertising cookies (Google Ads, Meta Pixel), only set if you consent and only on visits with Meta / Google Ads attribution.
You can manage cookies in your browser settings at any time, or use the “Cookie preferences” link in the footer to re-open the consent banner.
9. AI tools and your data
I sometimes use AI tools to assist with drafting, outlining, and analysis. I do not paste client personal data, proprietary commercial data, or confidential strategy information into third-party AI services unless the client has agreed in writing. When client data needs to be processed by an AI system as part of a deliverable, that processing is governed by a specific written agreement.
10. Children
This site and the services offered through it are not directed at children. I do not knowingly collect personal data from anyone under the age of 16. If you believe a child has submitted data to me, please contact me and I will delete it.
11. Changes to this policy
I review this policy at least annually and update it when practices or the law change. The “last updated” date at the top reflects the most recent substantive change.
12. How to complain
If you believe I have not handled your data properly, please raise it with me first at hello@seo-consultant.co. If you are not satisfied, you have the right to complain to the Information Commissioner's Office (ICO):
- Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
- Helpline: 0303 123 1113
- Website: ico.org.uk
Last reviewed: 11 May 2026. Next scheduled review: 11 May 2027.