Last updated: 10/9/2026

1. WHO WE ARE

Site Surgery Limited is a company registered in England and Wales.

Company number: 17239210

Registered office: 5 Brayford Square, London, E1 0SG, United Kingdom

Privacy contact: privacy@sitesurgery.co.uk

Site Surgery Limited is the data controller for personal data we use for our own business purposes.

Where we process personal data in a client’s website on their behalf, the client normally remains the controller and Site Surgery Limited acts as processor under Schedule 1 of the Website Transformation Agreement.

2. WHAT PERSONAL DATA WE COLLECT AND WHERE IT COMES FROM

Depending on how you interact with us, we may collect:

• your name, job title, company and business contact details;

• information you provide when contacting or communicating with us;

• enquiries, correspondence and meeting information;

• project, contract and client relationship information;

• payment, transaction and accounting information;

• website usage and interaction information;

• device, browser and technical information, including IP address and approximate location; and

• cookie and tracking identifiers, where consent is required and provided.

We may collect personal data directly from you, from your organisation, or from lawful sources including:

• company websites and other publicly available business sources;

• public corporate registers;

• professional networking platforms;

• referrals and introductions; and

• purchased business databases and other business-data providers.

From third-party sources, we generally obtain business contact and company information.

Where we obtain business contact information indirectly and use it for outreach, we do so only where we have an appropriate lawful basis and applicable electronic marketing rules permit it.

3. HOW AND WHY WE USE PERSONAL DATA

We may use personal data for:

• responding to enquiries and discussing potential work, based on legitimate interests or steps taken at your request before entering into a contract;

• providing services and managing client relationships, based on contract or legitimate interests;

• managing projects, communications and business administration, based on legitimate interests;

• processing payments and maintaining transaction records, based on contract and/or legal obligation;

• accounting, tax, regulatory and legal compliance, based on legal obligation;

• B2B sales and marketing, based on legitimate interests where appropriate and permitted by PECR, or consent where required;

• operating, protecting and maintaining our website and systems, based on legitimate interests and strictly necessary storage where applicable;

• website analytics, based on consent; and

• advertising, advertising measurement and related tracking, based on consent.

Our legitimate interests include operating and protecting our business, managing client and prospect relationships, and promoting relevant B2B services.

Where we need personal data to enter into or perform a contract, you do not have to provide it, but we may be unable to provide the service without it.

You may object to the use of your personal data for direct marketing at any time.

4. COOKIES AND SIMILAR TECHNOLOGIES

We use CookieYes to manage cookie consent.

Necessary technologies may operate without consent where required for the website or consent mechanism to function.

You can accept, reject or customise non-essential cookies through our cookie banner and change your choices later using the Cookie Settings available on our website.

The Cookie Settings panel contains the current details of the cookies and similar technologies we use, including their provider, purpose, category and duration.

Google Analytics

We use Google Analytics 4 to understand how visitors use our website.

Where Analytics consent is provided, Google may process information such as page views, website interactions, approximate location, device and browser information, traffic sources and pseudonymous identifiers.

Google Signals is enabled. Where applicable and permitted by your consent choices, Google may associate Analytics data with signed-in Google account information for aggregated behavioural, demographic, interest and cross-device reporting.

Meta Pixel

We use the Meta Pixel for advertising measurement and related advertising purposes where the relevant consent has been provided.

Where available and permitted by your consent choices, Meta’s Automatic Advanced Matching may use information you provide through our website, such as an email address or telephone number, in hashed form to improve matching and advertising measurement.

5. WHO WE SHARE PERSONAL DATA WITH

Where reasonably necessary, we may share personal data with service providers supporting our hosting and technology, communications, CRM and project management, payments, accounting, contracts and electronic signatures, and analytics or advertising where applicable.

We may also share personal data with professional advisers or public authorities where required.

6. INTERNATIONAL TRANSFERS

Some service providers may process personal data outside the United Kingdom.

Where required, we rely on UK adequacy regulations or appropriate safeguards such as the UK International Data Transfer Agreement or UK Addendum.

You can request information about these safeguards at privacy@sitesurgery.co.uk.

7. HOW LONG WE KEEP PERSONAL DATA

We keep personal data only for as long as reasonably necessary, taking account of the purpose for which it was collected, our relationship with you, legal and accounting requirements, potential disputes and applicable opt-outs.

In particular:

• Google Analytics event-level and user-level retention is configured for up to 14 months;

• accounting and transaction records are kept for the periods required by applicable UK law; and

• where someone opts out of marketing, we may retain limited information so that we can continue to respect that choice.

We may delete or anonymise information earlier where it is no longer required.

8. YOUR RIGHTS AND COMPLAINTS

Depending on the circumstances, you may have rights to:

• access your personal data;

• correct inaccurate or incomplete information;

• request erasure of personal data;

• restrict certain processing;

• object to processing;

• request data portability where applicable; and

• withdraw consent where processing is based on consent.

You have an absolute right to object to the use of your personal data for direct marketing.

To exercise a data protection right or make a complaint, contact:

privacy@sitesurgery.co.uk

We will acknowledge a data protection complaint within 30 days, investigate it appropriately and communicate the outcome without undue delay.

You also have the right to complain to the Information Commissioner’s Office, the UK’s data protection regulator.