Privacy Policy

Effective date: 1 July 2026

This Privacy Policy explains how Think Mad Ltd (“Think Mad”, “we”, “us”, “our”) collects, uses, shares and protects personal data when you visit thinkmad.co.uk (the “Site”), get in touch with us, become a client, or otherwise interact with us.

We are a friendly UK digital marketing agency based in Widnes. We build websites, provide hosting, and run SEO, social media and email marketing for our clients. We take your privacy seriously and are committed to handling your personal data fairly, lawfully and transparently, in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003 (PECR).

This policy covers how we handle the personal data of our own website visitors, enquirers and clients. It does not cover the personal data we process on behalf of our clients when we deliver services to them (for example, data in a client’s website, mailing list or social media accounts). That relationship is governed by a separate Data Processing Agreement (DPA), where we act as a data processor and the client is the data controller.

Who we are and how to contact us

For the purposes of data protection law, Think Mad Ltd is the data controller responsible for the personal data described in this policy.

• Company: Think Mad Ltd
• Registered address: 26a Foundry House, Waterside Lane, Widnes WA8 8UD
• Company number: 12636177
• VAT number: 478874811
• Phone: 0151 316 0110
• Email: projects@thinkmad.co.uk

We are registered with the Information Commissioner’s Office (ICO) as a data controller under registration number [ICO REGISTRATION NUMBER — TO BE INSERTED].

If you have any questions about this policy or about how we handle your data, please get in touch using the details above. We’re happy to help.

What personal data we collect, and how

We aim to collect only the data we actually need. Depending on how you interact with us, we may collect:

• Website enquiries and contact forms — your name, email address, phone number, company name, and the content of any message you send us, together with anything else you choose to include.
• Phone and email — your contact details and the details of any conversation or correspondence when you call or email us.
• Client billing and account data — the information we need to set you up as a client and manage our relationship: contact and company details, billing address, VAT number, records of the services we provide, correspondence, invoices, and Direct Debit / payment details. Direct Debit payments are collected through GoCardless (see “Who we share your data with” below).
• Data our clients ask us to process — where we deliver services (websites, hosting, SEO, social media and email marketing) we may handle personal data belonging to a client’s own customers or contacts. When we do this we act as the client’s data processor, and that processing is governed by our separate Data Processing Agreement, not by this policy.
• Analytics and cookies — information about how you use the Site, such as pages viewed, time on page, referring website, approximate location, and device and browser type. This is collected through cookies and similar technologies, and only where you have consented to non-essential cookies (see “Cookies and analytics” below).
• Server and hosting logs — technical data automatically recorded by our hosting infrastructure, including IP address, date and time of access, and pages requested, used for security, performance and troubleshooting.

We do not deliberately collect special category data (such as health, ethnicity or political opinions), and we ask that you don’t send us such information unless it is genuinely necessary and you’re content for us to process it.

Why we use your data, and our lawful bases

Under the UK GDPR we must have a lawful basis for using your personal data. We rely on the following:

• Contract — to provide the services you’ve asked for, set you up as a client, manage your account, raise invoices, collect payment, and provide support. Where processing is necessary to enter into or perform our contract with you, this is our basis.
• Legitimate interests — to respond to enquiries, run and secure the Site, understand how our website is used so we can improve it, keep records, prevent fraud, and promote our services to businesses in a proportionate way. Where we rely on legitimate interests, we balance our interests against your rights and freedoms, and you can object at any time (see “Your rights”).
• Consent — for setting non-essential cookies and, where required, for sending marketing communications. You can withdraw consent at any time.
• Legal obligation — where we must process data to comply with the law, for example keeping accounting and tax records or responding to lawful requests from authorities.

In short, we use your data to reply to you, deliver and administer our services, take payment, keep our business and Site running and secure, meet our legal obligations, and — where appropriate — tell you about what we do.

Cookies and analytics

Our Site uses cookies and similar technologies to make it work properly, remember your preferences, and understand how it’s used.

• Strictly necessary cookies are always active — the Site can’t function properly without them, and they don’t require consent.
• Non-essential cookies, including analytics cookies, are only set with your consent, in line with PECR. You give or refuse consent through our cookie banner / consent tool, and you can change your choice at any time.

We use Google Analytics to understand how visitors find and use our Site (for example which pages are popular and how people arrive). Google Analytics sets cookies and processes usage data on our behalf; we only enable it once you’ve consented. You can also manage or block cookies through your browser settings. For full details of the cookies we use, please see our separate Cookie Notice / cookie consent tool on the Site.

Marketing and how to opt out

We may send you information about our services — for example occasional updates, offers or news that we think will be relevant to your business.

• If you are an existing client or you’ve enquired about our services, we may contact you about similar services on the basis of the PECR “soft opt-in”, having given you a clear chance to opt out when we collected your details.
• In other cases we’ll rely on your consent where the law requires it.

Every marketing email we send includes an easy unsubscribe link, and you can opt out at any time by clicking it or by emailing projects@thinkmad.co.uk. Opting out of marketing won’t affect any service-related messages we need to send you (such as invoices, renewal reminders or important account notices).

Who we share your data with

We do not sell your personal data. We share it only where necessary, with:

• GURU (our hosting provider) — hosts our website and the associated infrastructure and logs.
• GoCardless — processes Direct Debit payments and manages recurring billing.
• Google (including Google Analytics and Google Workspace) — provides website analytics and the email/productivity tools we use to run our business and correspond with you.
• Email marketing platform — sends and manages our email communications and mailing list.
• Social media platforms (Facebook, Instagram, LinkedIn and Google Business Profile) and OnlySocial — where you engage with us on social channels, and via our white-label social management dashboard used to schedule and publish content.
• Ubersuggest and similar SEO tools — support our SEO research and reporting.
• WordPress / Elementor — the platform on which our website is built and maintained.
• Professional advisers — such as our accountants, lawyers or other advisers, where reasonably necessary.
• Authorities or third parties — where we’re required to by law, or to protect our rights, our clients, our users or the public.

Each of these providers acts on our instructions as a processor (or, where they’re a controller in their own right, under their own privacy terms), and is bound to protect your data and use it only for the purposes we specify.

International transfers

Some of our providers (for example Google, and certain email and social tools) may process data outside the UK. Where personal data is transferred outside the UK, we make sure appropriate safeguards are in place — such as the UK’s adequacy regulations (“adequacy decisions”), the UK International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses — so your data continues to be protected.

How long we keep your data

We keep personal data only for as long as we need it:

• Enquiries — for as long as needed to deal with your enquiry, and then a reasonable period afterwards (typically up to 2 years) in case you come back to us.
• Client and billing records — for the duration of our relationship and then for at least 6 years after it ends, to meet accounting, tax and legal requirements.
• Marketing data — until you unsubscribe or ask us to stop, after which we keep a minimal record to honour your opt-out.
• Analytics data — in line with our analytics provider’s settings, normally no longer than 14 months in identifiable form.
• Server and hosting logs — for a short period for security and diagnostic purposes.

When data is no longer needed, we securely delete or anonymise it.

Your rights

Under the UK GDPR you have the right to:

• be informed about how we use your data (which this policy is designed to do);
• access a copy of the personal data we hold about you;
• have inaccurate data corrected (rectification);
• have your data erased in certain circumstances (“right to be forgotten”);
• restrict our processing of your data in certain circumstances;
• object to processing based on our legitimate interests, and to direct marketing at any time;
• data portability — to receive certain data in a portable format; and
• withdraw consent at any time where we rely on it (this won’t affect processing carried out before you withdrew it).

To exercise any of these rights, just contact us at projects@thinkmad.co.uk or on 0151 316 0110. We’ll respond within one month, and there’s normally no charge. We may need to verify your identity first.

How to complain

If you’re ever unhappy with how we’ve handled your personal data, please contact us first — we’d much rather hear about it so we can put things right.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s supervisory authority for data protection:

• Website: ico.org.uk
• Helpline: 0303 123 1113
• Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Children’s data

Our Site and services are aimed at businesses and are not directed at children. We don’t knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, please contact us and we’ll delete it.

Security

We take reasonable technical and organisational measures to protect your data against loss, misuse and unauthorised access. No transmission over the internet can be guaranteed to be completely secure, but we work hard to safeguard your information appropriately.

Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices or the law. The “Effective date” at the top shows when it was last revised. If we make significant changes, we’ll take reasonable steps to let you know. Please check back periodically.

This policy is provided in plain English for transparency and is not legal advice. It should be reviewed by a qualified adviser before publication.