Legal
Privacy notice
What we collect, why we collect it, who else sees it and how to get it removed. Written to be read, not to be survived.
The short version
The full notice is below and it is the one that counts. This is the gist.
- We collect very little. An email address if you ask for something, a name and a company if you book a call, and basic figures about how the site is used.
- Nothing non-essential runs until you say yes to it. Decline the cookie banner and the measurement scripts never load.
- We do not sell or rent your details, and we do not pass them to anyone for their own marketing.
- Every email we send has a working unsubscribe link at the bottom. One click and you are off the list for good.
- Ask us what we hold on you and we will tell you, then delete it if you want it gone. Email [email protected].
Who we are
TWV Media is a boutique digital marketing and media agency. Tradition with vision, working with UK and international businesses since 2010.
Privacy questions go to [email protected], where a person reads them rather than a ticketing robot.
What this notice covers
It covers www.twvmedia.com, the forms and booking links on it, the emails we send, and the records we keep about people who enquire, subscribe or become clients.
It does not cover other websites we link to, including the Google booking page our call links point at. Those sites have their own notices and their own cookies. It also does not cover personal data we handle inside a client's own systems on that client's instructions. Section 07 explains that split, because it changes who is responsible for what.
What we collect
When you visit the site
Our host records standard server logs: IP address, browser and device type, the pages requested and the time of the request. These are security and diagnostic records, and they are kept separately from anything you send us.
If you accept measurement cookies, we also receive the pages you viewed, roughly where in the world you were and how you arrived. Those figures are pseudonymous and we look at them in aggregate.
When you get in touch or book a call
Your name, email address, company name, and whatever you choose to put in the message or the booking notes. If the call happens, we keep a short written note of what was discussed so that the second conversation does not repeat the first.
When you subscribe to The Vision Note
Your email address, the date and source of your sign-up, and whether our emails were opened or clicked. We hold the sign-up record because we have to be able to show that you asked for it.
When you become a client
Business contact details for the people we work with, billing details, and the working files and correspondence that come with the project. Payments are issued via invoice from us to you and we will not ask for any debit or credit card details.
What we do not collect
We do not ask for special category data, which covers things like health, ethnicity, religion, politics and biometrics. Please do not send it to us. Our services are aimed at businesses, so the site is not directed at children and we do not knowingly collect information about anyone under 18.
Why, and our legal basis
UK law requires a lawful basis for every use of personal data. Here is ours, purpose by purpose.
| What we use it for | Legal basis |
|---|---|
| Replying to an enquiry and holding a booked call | Steps taken at your request before a contract, or legitimate interests |
| Delivering the work and running the relationship | Contract |
| Sending The Vision Note and the guide you asked for | Consent |
| Measuring how the site is used so we can improve it | Consent, given through the cookie banner |
| Invoicing, accounts and tax records | Legal obligation |
| Security, backups, fraud and spam prevention | Legitimate interests |
| Occasional business-to-business outreach to a work address | Legitimate interests, and the business rules in PECR |
Where we rely on legitimate interests, we have weighed our interest in running the agency against your interest in being left alone, and we think a proportionate business use passes that test. You can disagree. Section 10 covers your right to object, and we act on it.
Where we rely on consent, you can take it back at any time. Withdrawing consent does not undo anything done lawfully before you withdrew it.
Work done for clients
A large part of what we do involves other people's data. When we run a campaign, rebuild a site or set up a CRM, the client decides what is collected and why. The client is the controller and we act as a processor on their documented instructions.
In that role we work to a written data processing agreement covering confidentiality, security, approved sub-processors, breach notification, and returning or deleting the data when the work ends.
If you are a customer of one of our clients and you want your details corrected or removed, go to that business first, since they hold the record and can act on it fastest. Contact us instead if you would rather, and we will pass the request to them and tell you we have done it.
Where it is held
Our own records sit in the UK and the European Economic Area wherever the supplier offers it. Some of the platforms above are based in the United States, so a transfer outside the UK is unavoidable in those cases.
When that happens we rely on a UK adequacy decision where one exists, and otherwise on the International Data Transfer Agreement or the UK Addendum to the standard contractual clauses, along with checks on the supplier's own safeguards. Ask us and we will tell you which mechanism applies to a particular provider.
How long we keep it
We keep things for as long as there is a reason to, then we get rid of them. In practice that means:
- Enquiries that go nowhere: 24 months from the last contact, then deleted.
- Newsletter subscribers: until you unsubscribe. We hold the record of your sign-up and unsubscribe for 12 months after that, as proof we handled it properly.
- Client records: for the life of the relationship and then seven years, which is what tax and accounting rules require of us.
- Analytics: 14 months, which is the shortest retention the platform allows.
- Server logs: 90 days.
Backups are on a rolling cycle and are overwritten in turn, so a deleted record can survive in a backup for a short period before it disappears with the rest of that copy.
Your rights
UK data protection law gives you the following rights over your own information.
- Access. Ask for a copy of what we hold about you and an explanation of what we do with it.
- Rectification. Have anything wrong or incomplete put right.
- Erasure. Have it deleted, unless we are legally required to keep it.
- Restriction. Have us pause our use of it while a dispute or a correction is sorted out.
- Portability. Receive the data you gave us in a common machine-readable format, or have it sent on.
- Objection. Object to any use we base on legitimate interests. Object to direct marketing and we stop, with no test to apply and no questions asked.
- Withdrawing consent. Take back consent at any time, for cookies or for email.
Email [email protected] and we will respond within one month. It costs nothing. If a request is unusually broad or repeated we may take an extra two months, and we will tell you why within the first month. We may ask a question or two to check you are who you say you are, since handing your data to the wrong person would be worse than a delay.
We do not use automated decision-making or profiling that produces legal effects for anyone.
Marketing and opting out
The Vision Note goes out no more than twice a month. Every issue carries an unsubscribe link that works on the first click, and the list is cleaned rather than re-imported.
We sometimes approach businesses directly by email or on LinkedIn where the service we offer is plainly relevant to what they do. Reply once to say no and that is the end of it. We do not cold-call, and we do not buy contact lists.
Keeping it safe
Accounts use strong unique passwords and two-factor authentication, access is limited to the people who need it for the work in hand, laptops are encrypted, and traffic to this site is served over TLS. Suppliers are chosen partly on their own security record.
No system is beyond reach and we will not pretend otherwise. If a breach happens that puts anyone at real risk, we report it to the ICO within 72 hours and tell the people affected directly.
Changes to this notice
The date and version at the top of the page tell you which edition you are reading. Small corrections happen without ceremony. If something material changes, such as a new purpose or a new category of supplier, we will say so on the site and email subscribers before it takes effect.
Contact and complaints
Email [email protected].
Still not clear
Ask us a plain question, get a plain answer
Privacy pages are written by lawyers and read by nobody. If something here worries you, or you want to know exactly what we hold on you, send one line to [email protected]. No form, no portal.
Book a call instead-
Data controller
TWV Media, 152, 160 City Rd, London EC1V 2NX
-
Privacy contact
-
Supervisory authority
Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. 0303 123 1113
-
Response time
One month for any rights request, usually a good deal sooner