Privacy Policy
Version 2.1 | Last updated: 17 September 2026 | Registered in England and Wales | Company No. 17220978
1. Introduction
Arlieo Ltd is a digital marketing agency. This Privacy Policy explains how we collect, use and store personal data when you visit our website, enquire about our services, or interact with us.
We process personal data in two distinct ways: as a data controller, when we decide why and how data is used for our own business purposes, and as a data processor, when we handle data on behalf of clients following their instructions. Section 3 explains the distinction.
This policy covers our own marketing and prospecting as well as the services we deliver to clients. If you have any questions, contact us at hello@arlieo.co.uk.
Our website is not intended for children under 18 and we do not knowingly collect data from children. Our website may contain links to third party sites; we are not responsible for their privacy practices.
2. Who We Are
Arlieo Ltd is the data controller responsible for the personal data described in this policy, except where we act as a processor on behalf of a client (see Section 3).
| Full legal name | Arlieo Ltd |
| Company number | 17220978 |
| Registered address | 5 Beech Close, Congleton, CW12 4YL |
| hello@arlieo.co.uk | |
| ICO registration number | ZC174174 |
You have the right to complain to the Information Commissioner’s Office at www.ico.org.uk at any time. We would appreciate the opportunity to resolve your concerns first.
3. Our Role as Data Controller and Data Processor
Which role applies depends on whose data it is and who decides what happens to it.
3.1 When we are the controller
We are the controller for data we collect and use for our own purposes:
- Enquiries from potential and existing clients, including through our website
- Our own business development and outreach
- Our own marketing and advertising
- Operating our website and our own analytics
- Our business records, invoicing and contracts
3.2 When we are the processor
We are the processor when we handle personal data that belongs to a client, on their instructions: for example a client’s customer list, CRM data, analytics or advertising accounts. The client is the controller and is responsible for the lawfulness of the data they give us. We use it only for the agreed work, never for our own marketing, and return or delete it when the engagement ends.
If your data has been used in a campaign we ran for a client, please contact that client directly. If you are not sure who that is, contact us and we will help where we can.
We have a written Data Processing Agreement with every client for whom we process personal data. Section 9 describes how we handle client data in practice.
4. Personal Data We Collect
4.1 Data you provide directly
| Category | What it includes | How collected |
|---|---|---|
| Identity | Name, job title, company name | Directly from you |
| Contact | Email, phone, business address | Directly from you |
| Communications | Emails, enquiries, meeting notes | Directly from you |
| Transaction | Services, invoices, payment records | From you and our accounting software |
| Marketing preferences | Consent records and opt-out status | Directly from you |
| Consent audit data | The date, the page or form, and the exact wording you agreed to, recorded when you give consent through a form on our website | Automatically recorded when you submit a form |
Enquiries and newsletter sign-ups submitted through our website are stored in our customer relationship management system, Capsule CRM, together with the consent audit data above. They are not stored on our website itself.
4.2 Data collected automatically
| Category | What it includes | How collected |
|---|---|---|
| Technical | IP address, browser type, device type | Automatically via our website |
| Usage | Pages visited, time on site, referral source | Via analytics tools, where consented |
| Advertising | Website visits and actions, for measurement and retargeting | Via advertising tags and pixels, where consented |
4.3 Data from third party sources
We may collect contact information about prospective clients from publicly available professional sources such as LinkedIn, company websites and professional directories. Section 5 describes this.
We do not intentionally collect special category data (such as health, race, religion or political opinions). If any is inadvertently shared with us we will delete it promptly. We do not carry out automated decision-making that produces legal or similarly significant effects on individuals.
5. How We Collect and Use Prospect Data
As a marketing agency we do our own business development. This section explains how.
5.1 Publicly available sources
We may collect a name, job title, company name and business email address from publicly available professional sources in order to make initial contact with people who are likely to have a genuine interest in our services. We only do this for people acting in a business capacity at organisations that fit the kind of work we do. Our lawful basis is legitimate interests, which we have assessed and documented; the assessment is available on request.
The first time we contact you using data collected this way, we will tell you that we hold your data, where we obtained it, and how to object. If you object, we stop immediately and suppress your details so we do not contact you again. We do not send cold email to sole traders or partnerships; Section 8 explains why.
5.2 Lead magnets and website forms
Where we offer downloadable content through our website, you provide your contact details and give specific consent to receive further communications from us. You may withdraw that consent at any time.
5.3 Lead generation campaigns on social media
We may run advertising campaigns on platforms such as Meta and LinkedIn that include in-platform lead generation forms. When you complete one, the platform shares the details you entered with us on the basis of the consent you gave at that point. The platform processes your data in connection with your own account under its own privacy policy.
5.4 Newsletter and content subscriptions
When you subscribe to our newsletter, the Insights Hub, we collect your name and email address on the basis of your consent. Subscribing through our website is the act of consent; the terms are shown beside the subscribe button and recorded with your subscription. You may unsubscribe at any time using the link in any email or by contacting us.
6. How We Use Your Personal Data
We only use your data where the law permits. The lawful bases we rely on are:
- Consent: where you have given clear, specific and freely given consent.
- Legitimate interests: where processing is necessary for our genuine business interests and those interests are not overridden by your rights. We carry out a Legitimate Interests Assessment before relying on this basis; it is available on request.
- Performance of a contract: where processing is necessary to deliver services you have engaged us for.
- Legal obligation: where we must process data to comply with the law.
| Purpose | Data used | Lawful basis |
|---|---|---|
| Responding to enquiries made through our website or by email | Identity, Contact, Communications | Consent |
| Delivering contracted services | Identity, Contact, Transaction | Contract |
| Invoicing and payment | Identity, Contact, Transaction | Contract; Legal obligation |
| Service communications | Identity, Contact | Contract |
| Outbound prospecting from public sources | Identity, Contact | Legitimate interests |
| Marketing to opted-in contacts | Identity, Contact, Marketing preferences | Consent |
| Marketing to existing corporate contacts | Identity, Contact, Marketing preferences | Legitimate interests |
| Marketing to sole traders and partnerships | Identity, Contact, Marketing preferences | Consent, or the PECR soft opt-in |
| Advertising measurement (enhanced conversions) | Identity and Contact, hashed; Advertising | Consent, via cookie preferences |
| Website retargeting | Technical, Advertising | Consent, via cookie preferences |
| Custom advertising audiences | Identity, Contact, Advertising | Consent |
| Lookalike audiences | Advertising | Legitimate interests |
| Lead generation campaigns | Identity, Contact, Marketing preferences | Consent |
| Legal and financial records | Identity, Contact, Transaction | Legal obligation |
| Website analytics and improvement | Technical, Usage | Consent, via cookie preferences |
Where you enquire through our website, you consent to us storing your details to reply to you. If you later withdraw that consent, we will delete the enquiry unless we need to keep it for a legal reason or a contract has since been formed, in which case the bases above apply.
7. Advertising and Audience Building
We use advertising technology to promote our services and to measure whether it works. This section explains how personal data is involved. Nothing in this section happens unless you have consented to advertising cookies through our cookie preference panel.
7.1 Website retargeting
We may place advertising tags on our website from platforms such as Google Ads, Meta and LinkedIn that record a visit to our site so that we can show advertisements to previous visitors on those platforms. If you decline advertising cookies, no such data is collected. You can update your preferences at any time via the consent tool on our website.
7.2 Advertising measurement (enhanced conversions)
Where you submit an enquiry form on our website and have consented to advertising cookies, we share a hashed version of the contact details you provided with Google Ads, so that Google can tell us which advertisement, if any, led to your enquiry.
The details are converted into an irreversible code in your browser using SHA-256 before anything is sent. We do not send Google your email address, name or telephone number in readable form. Google uses the hashed data only to match the enquiry to an advertisement click and reports the result to us in aggregate. Google acts as an independent controller for that data once it has been transmitted, under its own terms and privacy policy.
If you decline advertising cookies, nothing is shared. Our lawful basis is consent, which you can withdraw at any time through the consent tool or by emailing hello@arlieo.co.uk.
7.3 Custom audiences
We may upload contact lists to advertising platforms such as Google Ads, Meta and LinkedIn to create custom audiences, so that we can show relevant advertisements to existing contacts on those platforms. We only do this where you have given prior consent to be included in our advertising audiences. Data is hashed before upload using the platform’s own privacy tools. You can withdraw consent at any time by emailing hello@arlieo.co.uk.
7.4 Lookalike audiences
We may ask advertising platforms to build audiences of people whose characteristics resemble our existing contacts. The platform constructs these within its own systems; we never receive or hold personal data about anyone identified this way. Our lawful basis is legitimate interests.
7.5 Lead generation advertising
Where you complete a lead generation form within one of our advertisements on a social platform, we process the data you provide on the basis of your consent, as described in Section 5.3.
7.6 Advertising platforms as controllers
Once data has been transmitted to an advertising platform, whether through a tag on our website or an uploaded list, that platform processes it under its own terms and privacy policy. For UK users, Meta acts as an independent controller under its Business Tools Terms and UK Controller Addendum; Google and LinkedIn take comparable positions under their respective terms. We recommend reviewing the privacy settings of any platform you use.
We do not currently operate managed company pages on social platforms. When we do, we will update this policy to reflect any joint controller arrangements that apply.
8. Marketing
8.1 Our approach
We may send information about our services, insights and case studies to business contacts where we have a lawful basis to do so. We market to businesses only and do not send unsolicited marketing to people acting in a personal capacity. Every marketing communication includes a clear and easy way to opt out.
8.2 Legal framework
Our marketing is governed by UK GDPR, which requires a lawful basis for processing personal data, and by the Privacy and Electronic Communications Regulations 2003 (PECR), which governs electronic marketing and applies alongside it.
8.3 Corporate subscribers
If you work for a limited company or other incorporated body, we may email you where you have opted in, or where we have an existing business relationship with your organisation, you were given an opportunity to opt out when we first made contact, and you have not done so. In that case our marketing will relate to services similar to those already discussed or provided.
8.4 Sole traders and partnerships
If you are a sole trader or a partner in an unincorporated partnership, PECR gives you the same protection as a private individual. We will only email you marketing where you have given prior specific consent, or where the PECR soft opt-in applies: you previously bought or enquired about similar services, were given an opportunity to opt out at the time, and did not. We do not send cold email to sole traders or partnerships with whom we have no prior relationship.
8.5 Your right to opt out
You have an absolute right to object to direct marketing at any time. We will stop immediately without asking why. Use the unsubscribe link in any marketing email, or contact hello@arlieo.co.uk.
9. Services for Retained Clients
9.1 Data we may access
Depending on the services, we may access a client’s customer and contact lists, CRM data, website analytics and advertising accounts.
9.2 How we handle it
When processing personal data on a client’s behalf we act only on the client’s instructions, use the data solely for the agreed purposes, never use it for our own marketing or business development, apply appropriate security, notify the client of any breach affecting their data, and return or delete it at the end of the engagement.
9.3 Data Processing Agreements
We have a written DPA with every client for whom we process personal data, setting out the subject matter, duration, nature and purpose of the processing. Clients are responsible for having a lawful basis for the data they provide. Where we use third party platforms such as advertising networks in delivering client work, those platforms may also process client data; our client agreements permit this and appropriate sub-processor terms are in place.
9.4 Lead generation on behalf of clients
Where we run lead generation campaigns for a client, the client is the controller of the data collected. The campaign presents the client’s own privacy notice and consent wording. We process that data only on the client’s instructions under the DPA and do not keep or use it for anything else.
10. Artificial Intelligence and Your Data
We use commercial artificial intelligence tools, including Claude, provided by Anthropic PBC on a paid commercial plan, to support client deliverables, copywriting, analysis and strategy.
Under Anthropic’s commercial terms and Data Processing Addendum, Anthropic processes our data as a processor on our instructions and commits not to use content from commercial plans to train its models. Anthropic retains prompt and response data for a limited period for operational and safety purposes, under its terms as updated from time to time.
We apply data minimisation and do not routinely or intentionally enter personal data about identifiable individuals into AI tools. We review AI-assisted output before use and do not use AI for automated decisions with legal or similarly significant effects on individuals.
Transfers to Anthropic, based in the United States, are covered by Standard Contractual Clauses and the UK International Data Transfer Addendum as incorporated into Anthropic’s commercial terms.
11. Third Party Processors
We share personal data with processors who provide services to us. Each operates under a data processing agreement and may handle data only securely and for the specified purpose.
| Processor | Purpose | Transfer mechanism |
|---|---|---|
| Capsule CRM (Zestia Ltd) | Customer relationship management: storage of enquiries, contacts, newsletter subscribers and consent records | UK based; confirmed on request |
| Google Workspace | Email, documents, internal communications | UK Adequacy |
| Google Analytics and Google Tag Manager | Website analytics and tag management, where consented | UK-US Data Bridge |
| Google Ads | Advertising, measurement including enhanced conversions, audience matching | UK-US Data Bridge |
| Meta, LinkedIn and other advertising platforms, where used | Advertising, tracking, audience matching | UK-US Data Bridge or IDTA |
| Anthropic PBC (Claude) | AI-assisted service delivery | SCCs / UK IDTA |
| Operational software (accounting, project management, e-signatures, banking) | Day to day business administration | UK Adequacy or IDTA |
We review our suppliers periodically. Specific vendors within these categories may change as the business develops; equivalent protections remain in place at all times, and material changes are reflected in this policy.
12. International Transfers
Some of our providers are based in the United States. Where personal data leaves the UK we rely on safeguards under Chapter V of UK GDPR:
- UK-US Data Bridge, for transfers to certified US organisations, including Google.
- UK Adequacy Regulations, for platforms holding data in the EU.
- International Data Transfer Agreements and Standard Contractual Clauses, for US providers where the Data Bridge is not the sole mechanism, including Anthropic.
We review our vendors’ transfer mechanisms periodically.
13. Your Rights
Under UK data protection law you have the following rights. To exercise any of them, contact hello@arlieo.co.uk. We respond within one month, extendable by up to two further months for complex or numerous requests, in which case we tell you within the first month. We may need to verify your identity. No fee is charged unless a request is manifestly unfounded or excessive.
| Right | What it means |
|---|---|
| Access | Request a copy of the personal data we hold about you. |
| Correction | Ask us to correct inaccurate or incomplete data. |
| Erasure | Request deletion where there is no lawful reason to keep it. Some legal obligations require us to retain certain data. |
| Object | Object to processing based on legitimate interests. Your right to object to direct marketing is absolute and we stop immediately. |
| Restriction | Ask us to restrict processing in certain circumstances, for example while we investigate a correction. |
| Portability | Where we process by consent or contract, receive your data in a structured, machine-readable format. |
| Withdraw consent | Withdraw consent at any time where we rely on it. Withdrawal does not affect processing already carried out. |
14. How Long We Keep Your Data
We keep personal data only as long as necessary for the purpose it was collected for.
| Type of data | Retention period |
|---|---|
| Client contact and contract data | Six years from the end of the financial year in which the relationship ended (Limitation Act 1980). |
| Accounting and financial records | Seven years from the end of the relevant financial year (HMRC requirements). |
| Website enquiries that do not lead to an engagement | Two years from the last contact, or until you withdraw consent, whichever is sooner. |
| Prospect data from public sources, no contract entered | Two years from last meaningful contact, or until you object, in which case we delete or suppress promptly. |
| Consent-based data (lead forms, newsletter sign-ups) | Until you withdraw consent. If there is no engagement within two years we delete the data or seek renewed consent. |
| Consent records | Kept for a reasonable period after the relationship ends, as evidence of compliance. |
| Website analytics data | Up to 26 months (Google Analytics 4 default). |
| Advertising audience data within platforms | According to each platform’s retention: for example Meta website custom audiences up to 180 days; uploaded lists per platform defaults; Google and LinkedIn per their documentation. |
Data no longer required is securely deleted or anonymised.
15. Our Website and Cookies
When you visit arlieo.co.uk we automatically collect certain technical and usage data. A consent management platform presents a cookie preference panel on your first visit:
- Strictly necessary cookies are always active because the website needs them to work.
- Analytics cookies, from Google Analytics, are only set with your prior consent.
- Advertising and tracking cookies, from Google Ads and, where we use them, platforms such as Meta and LinkedIn, are only set with your prior consent. They let us measure advertising performance, including the enhanced conversions described in Section 7.2, and show advertisements to previous visitors.
Where you give consent through a form on our website, we record the date, the page or form, and the exact wording you agreed to, as part of our consent audit record. This is kept for the same period as the consent record itself and used only to evidence compliance.
You may update your preferences at any time via the consent tool on our website. Withdrawing consent stops new data being collected but does not remove you from advertising audiences that already exist; contact us if you would like that done.
For the specific cookies we set and how to manage them, see our Cookie Policy.
16. Data Security
We use secure, access-controlled cloud platforms with strong authentication, and review our security practices and supplier arrangements regularly. Where we share data with processors, we assess their security as part of due diligence. No method of electronic transmission or storage is completely secure.
We have procedures to identify, assess and manage personal data breaches. Where the law requires, we notify affected individuals and report to the ICO within 72 hours of becoming aware.
17. Changes to This Policy
We keep this policy under review and update it as needed. The current version is always at arlieo.co.uk/privacy-policy. For material changes, such as a new category of processing or a significant new processor, we notify existing clients by email and update the version number.
Changes in version 2.1: Capsule CRM added as our CRM and the store for website enquiries; Google Ads named and enhanced conversions described; Mailchimp removed; the consent audit record clarified; the basis for responding to enquiries stated as consent.
18. Contact Us
| hello@arlieo.co.uk | |
| Post | Arlieo Ltd, 5 Beech Close, Congleton, CW12 4YL |
You also have the right to complain to the ICO at any time at www.ico.org.uk or on 0303 123 1113. We would welcome the chance to address your concerns directly first.
Arlieo Ltd | Company No. 17220978 | Registered in England and Wales | Privacy Policy Version 2.1 | Last reviewed 17 September 2026