Privacy Policy

Data Controller

PageTech Solutions Limited ("I", "me") is the data controller for information collected through this website. It is registered with the Information Commissioner's Office under registration reference ZC179729. You can reach me via the contact page.

How this website and the booking page work together

This website is used for service information and initial enquiry. If you choose to book a consultation, you are sent to a booking page hosted by HubSpot: Free 20-minute consultation booking page.

Calendar not loading, or no time suits? Call, WhatsApp or message me.

The booking page is hosted by HubSpot on its own domain, not embedded in this website, so HubSpot's own privacy and cookie notices apply while you are on it. Google tags, GA4, and Google Tag Manager scripts from this website do not run there. Completed booking measurement is therefore handled via first-party capture on this website and server-side conversion submission.

Phone, voicemail, WhatsApp, Teams and LinkedIn messages

The contact pages offer a phone number, a WhatsApp link and a LinkedIn link. They are ordinary links: nothing is loaded from WhatsApp, Meta or LinkedIn, and nothing is sent to them, unless you choose to follow one. Whether the page shows me as available now is worked out in your browser from the time of day; it is not recorded.

• Phone and voicemail: I see the number you call from, and keep any voicemail only as long as I need it to call you back.
• WhatsApp: the link opens WhatsApp, provided in the UK by WhatsApp LLC (part of Meta; WhatsApp Ireland Limited in the EU), whose own terms and privacy policy then apply. I use the WhatsApp Business app; when you message me I see your WhatsApp name, profile and phone number, and the conversation is kept on my phone and in WhatsApp's encrypted backup. Messages are end-to-end encrypted, but WhatsApp processes account and usage data, which can be transferred to the United States under its data transfer terms. I keep a conversation for as long as it relates to an enquiry or an engagement, under the same periods as email (see Records Retention), and delete it when you ask. WhatsApp's privacy policy: whatsapp.com/legal/privacy-policy.
• Microsoft Teams: the “Chat on Microsoft Teams” button runs the same anti-bot check as “Show email address” (Cloudflare Turnstile, loaded only when you press it) and then opens a Teams chat with me. The chat happens in Microsoft Teams under Microsoft’s terms; I see your Teams name and, for a work account, your organisation. Chats are kept in my Microsoft 365 tenant under the same periods as email.
• LinkedIn messages: sent through LinkedIn under its own terms; I see what your LinkedIn profile shows me.

Messages sent these ways are not copied into HubSpot automatically. If an enquiry becomes a conversation, I may add your name and contact details to HubSpot by hand so it can be followed up, as described under Third Parties.

Information I Collect

• Information you provide directly via forms and correspondence (name, email address, company, and message content). If you choose “Call me back” on the contact form, also the phone number you give for that call; it is stored with your enquiry and contact record and added to HubSpot so I can ring you, and it is not used for anything else.
• Technical data processed via standard server logs (IP address, browser type, pages visited) for security and operational purposes. If your browser blocks something under this site's security policy, it sends the site a short report; I keep only which rule was involved and the domain that was blocked, not your IP address or the page address. If you open an address that does not exist and looks like a referral code, the page asks the server whether the code is genuine before sending you on; nothing about you is stored by that check.
• First-party session analytics — if you allow Google Analytics in Cookie settings, a server-side analytics service records: session identifier, visitor identifier, page URL, referrer, user agent, device type (desktop / mobile / tablet / bot / unknown), browser language preference, screen resolution, country code (derived from Cloudflare's network header — the raw IP address is not stored in the analytics database), page count per browser-tab session, and audience mode (the site area accessed — business, recruiter, freelance, or unspecified). Behavioural events are also recorded (see Ads and web analytics tracking below). These records are stored in a first-party database and not shared with third parties.
• Site statistics, unless you object — unless you object, the site counts page views, scroll depth, errors and similar events so I can see how it is used and improve it. They are listed under First-party behavioural events. They carry a session ID kept in this tab's session storage, which your browser deletes when you close the tab. No visitor ID is stored, nothing links one visit to the next, and nothing is shared. To object, turn off Site statistics in Cookie settings or choose Reject all: the site then records and stores nothing for statistics.
• Browser storage — the site's own code sets no cookies. Cloudflare, which sits in front of the site, runs a bot-protection check on every page before you make any choice in Cookie settings, and that check sets security cookies described below. Apart from those, the site stores the following in your browser:
  • Cloudflare security cookies — cf_clearance (kept for about a year) records that your browser passed Cloudflare's bot check, and __cf_ob (deleted when you close the browser) supports the same check. Cloudflare's script also keeps a tab ID (_cfPre_tabId) in session storage, which your browser deletes when you close the tab. They are set by Cloudflare's bot protection to keep the site secure, are strictly necessary, hold no analytics or advertising data, and are not affected by your choices in Cookie settings.
  • PageTech.Internal.Consent.* — your choice for each optional service (GA4, Clarity, GoogleAds, LinkedIn, MicrosoftAds, Apollo, Chatbot), the version of the choices you answered (SchemaVersion), when you chose (Marketing.Timestamp), and three summary keys (Analytics, Advertising, Marketing), plus Statistics, which is set to objected only if you object to site statistics. Kept whatever you choose, so the site remembers your choice and can show when you made it. A service you have not answered for is treated as refused.
  • PageTech.Internal.Analytics.VisitorId — a random visitor ID that links your visits. Created only if you allow Google Analytics; deleted if you refuse or withdraw.
  • PageTech.Internal.Analytics.Internal — set to 1 only on browsers PageTech uses itself, by opening a page with ?internal=1 (?internal=0 removes it). While it is set the site sends no first-party analytics and tells Google Analytics the visit is internal, so our own visits are not counted as yours. It holds no ID, and the site never sets it on its own.
  • PageTech.Internal.AdsAttribution.LeadSessionId — a random ID that links an enquiry or booking to the visit it came from. Unless you allow Google Analytics it is kept only in the page's memory and is never stored. With that consent it is kept in local storage until you withdraw.
  • PageTech.Internal.AdsAttribution.Gclid — the ad click IDs and campaign tags from the link you arrived on. Each is stored only if you allow the service it belongs to: Google click IDs (gclid, wbraid, gbraid) with Google Ads, the Microsoft click ID with Microsoft Advertising, the LinkedIn click ID with the LinkedIn Insight Tag, and campaign tags with Google Analytics. Each is deleted when you refuse or withdraw that service.
  • PageTech.Internal.AdsAttribution.LinkRef — the code from a PageTech referral link, if you arrived on one. It identifies the link, not you. Stored only if you allow Google Analytics; deleted if you refuse or withdraw.
  • PageTech.Internal.Audience.Mode and PageTech.Internal.Theme.Preference — the section of the site you last used and light or dark mode. These remember your own choices and hold no ID. A few similar keys cache availability data or remember that you have seen a hint.
  • PageTech.Internal.Retention.StickyCtaVariant and two Tracking keys — which wording of a call to action you see this week, and which services and cross-links you have viewed. They are site statistics: they hold no ID and are removed if you object.
  Session storage, which your browser deletes when you close the tab, holds a per-tab session ID (PageTech.Internal.Analytics.SessionId) and page counters (page sequence, click path, how often a call to action was shown, section switches, and whether a prompt was dismissed) used by the events listed under First-party behavioural events, and the ID of the last FAQ answer you opened (PageTech.Internal.Faq.LastOpened, used for 30 minutes to see whether the answer led to a next step). All of it is site statistics and none of it is kept if you object.
• Advertising attribution information, each item only if you allow the service it belongs to (Google Analytics for campaign tags): Google Click ID (gclid), Google privacy-preserving click identifiers (wbraid, gbraid — used on browsers where gclid is unavailable), Microsoft Click ID (msclkid — appended by Microsoft Advertising to ad destination links), LinkedIn click ID (li_fat_id), UTM parameters (source, medium, campaign, content, term), landing page, and timestamp. These click identifiers are read from URL query parameters appended by the respective platforms to ad destination links. If you allow the LinkedIn Insight Tag, it is loaded directly from LinkedIn and may set cookies or similar identifiers under LinkedIn's domain for campaign measurement and retargeting.
• Chat assistant (BottBuddy) — if you allow the BottBuddy chat assistant in Cookie settings, a chat button appears. Only when you click it is the third-party chat widget (BottBuddy) loaded to help you navigate the site and answer questions; it then looks up your approximate location from your IP address and keeps a browser ID in local storage (see BottBuddy Chat Assistant in the Ads & tracking tab). If you use the chat, the messages you send and receive are processed by BottBuddy on my behalf to generate responses. BottBuddy's privacy policy: bottbuddy.com/privacy.
• Booking information submitted through the HubSpot booking page (for example name, email address, and appointment notes) for scheduling and response handling.
• CV request data — if you use the CV request feature on the recruiter pages, I collect your email address, your preference for update notifications, and the page from which the request was made. A one-way hash (SHA-256) of the requesting IP address is also stored alongside the CV request record for fraud and abuse prevention. If a non-business email address is detected, a one-time verification code is sent to confirm ownership; this code is discarded immediately after verification or expiry. CV request data is processed on the basis of steps taken at your request before a potential engagement and legitimate interest in managing placement enquiries. Once a CV request is completed, your email address and the page you asked from are also added to my customer relationship management (CRM) system, HubSpot, as a contact and a recruitment opportunity so I can follow up; they are not added to any marketing list.
• Contact management records — when you submit a contact form enquiry, your name, email address, and company name (if provided) are stored in an internal contact management database to manage correspondence and understand engagement. This processing is carried out on the basis of legitimate interest in managing business relationships. The contact record may also be enriched with professional context (such as job title and company details) through Apollo.io's contact enrichment API. This happens only if you allowed Apollo.io in Cookie settings on the visit you enquired from; it does not happen if you refused Apollo.io or had not yet chosen. Apollo.io's privacy policy: apollo.io/privacy-policy.

Legal Basis for Processing

I process personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, on the following bases:

• Legitimate interest — responding to enquiries, scheduling consultations, operating the website securely, and counting how the site is used so I can improve it (site statistics). Site statistics use your browser's storage under the statistics exception in the Privacy and Electronic Communications Regulations (Schedule A1, paragraph 5), which applies because the information is used only for that purpose, is not shared, is described here, and you can object at any time.
• Steps at your request before entering into a contract — processing your CV request (delivering the CV, sending the verification code) and handling consultation bookings.
• Consent — each optional service in Cookie settings, each with its own switch: Google Analytics, Microsoft Clarity, Google Ads (conversion tracking, remarketing and Enhanced Conversions), the LinkedIn Insight Tag, Microsoft Advertising (UET and Enhanced Conversions), Apollo.io (form enrichment and website visitor tracking), and the BottBuddy chat assistant.

This website is directed at UK-based businesses. If you visit from the European Economic Area (EEA), the EU General Data Protection Regulation (EU GDPR — Regulation 2016/679) may also apply; the rights and safeguards described in this policy apply equally to EEA residents. EEA visits are incidental rather than targeted; no EU representative has been designated under Article 27 EU GDPR.

Mandatory and Optional Information

When you submit an enquiry via the contact form, the following fields apply:

Field	Required?	Why
Name	Required	To address and identify you in correspondence
Email address	Required	To send a reply
Message	Required	To understand your enquiry
Organisation	Optional	Context for the enquiry
Technology stack	Optional	To tailor the response
Timeline	Optional	To tailor the response
File attachments	Optional	Supporting documents at your discretion
Company size	Optional	To tailor the response and project scoping
Budget	Optional	To tailor the response and project scoping
Urgency	Optional	To tailor the response and prioritise
Preferred contact method	Optional	To respond in your preferred way

You are not obliged to provide optional fields. Omitting them will not prevent me from responding to your enquiry; it may simply mean my response is less tailored.

When using the CV request feature (available on recruiter pages), only your email address is required. The update notification preference is optional. The site also records the page you asked from and a one-way hash of your IP address, as described above.

Use of Information

I use information to respond to enquiries, schedule consultations, provide services, improve website performance, measure advertising effectiveness (where consented), and protect against abuse. I do not sell your personal data.

Testimonials (Share Experience)

If you share a testimonial through the Share Experience page, this is what happens to it and to the details you give.

What is stored

I store what you type into the Share Experience form, an encrypted copy of your email address and, only if you choose to verify, the LinkedIn member identifier and name returned by your LinkedIn account. I never see your LinkedIn password, photo or connections. Your email is never shown publicly.

Your private name, email address, private message and any internal verification details are never published. Only the public display name you choose (or your name if you leave that blank), your role and organisation if given, the testimonial itself, the skills you endorse, the period you worked with me and — if you tick the box — a link to your LinkedIn profile can appear on the site.

Publication

I read every testimonial before it goes live. It is published word for word or not at all, never edited. You can ask for it to be changed or removed at any time. Nothing is published automatically, and every submission requires your explicit consent to publication before it can be sent.

Verification

If you sign in with LinkedIn or Microsoft, your testimonial shows that you confirmed it through that account. The provider did not review, verify or endorse the testimonial, and sets its own cookies during sign-in. Signing in is optional and is never required to share a testimonial.

Correction and removal

To correct, unpublish or delete a testimonial you gave, use the contact page or the privacy contact below. Unpublishing removes it from the site while keeping the record; deletion removes your identifying details.

A published testimonial is kept for as long as it stays published. One that is declined, or submitted and never published, is deleted automatically after 6 months, along with any verification record and any confirmation links it created. See Records Retention for the full list of periods.

Ads and web analytics tracking

This website uses consent-aware tracking technologies, including:

• Google Ads tag ID: AW-18030475098
• Microsoft Advertising UET tag ID: 97254229
• Google tag ID: GT-WRGF2GZZ
• Google Analytics (GA4) measurement ID: G-QCFSG1V45L
• Cloudflare Web Analytics: counts page views and page speed without cookies. To do this Cloudflare receives your IP address and basic browser details. It is part of site statistics, so it does not run if you object.
• LinkedIn Insight Tag: campaign measurement and retargeting for LinkedIn ads, loaded directly from LinkedIn only if you allow it.
• Apollo.io website tracker: reports which companies visit this site, loaded directly from Apollo.io only if you allow Apollo.io.
• First-party session analytics: A server-side analytics service stores page-visit and behavioural data in a first-party database. This data is not shared with third parties.
• Microsoft Clarity: behavioural analytics that captures heatmaps and session recordings to help understand how visitors interact with this site. Clarity loads only if you allow Microsoft Clarity. For information on how Microsoft collects and uses this data, see the Microsoft Privacy Statement.

Each service above that needs consent runs only if you allow it in Cookie settings. The exception is Google's tags, which load first in a restricted, cookieless mode, as described below. If you refuse or withdraw, the service stops, and the site deletes its own visitor and attribution IDs from your browser.

Google tags

Google Analytics and Google Ads load only after you allow one of them. Before you choose, and if you refuse both, this site sends Google nothing. Google Tag Manager, which loads the Google tags, is itself loaded only once you have allowed Google Analytics or Google Ads, and each tag inside it still runs only for the service you allowed. The LinkedIn Insight Tag and the Apollo.io tracker do not go through Google: allowing either of them sends Google nothing.

LinkedIn Insight Tag

The LinkedIn Insight Tag reports visits to this site from LinkedIn members, so I can measure LinkedIn campaigns and show ads to people who have visited. It loads only if you allow the LinkedIn Insight Tag in Cookie settings, and it may set cookies under LinkedIn's domain. Refusing it does not affect any other service. LinkedIn's privacy policy: linkedin.com/legal/privacy-policy.

Apollo.io website visitor tracking

Apollo.io's website tracker matches the IP address of a visit against Apollo's company database to report which organisations visit this site and which pages they view. I use it to see which companies are interested in my services. It loads only if you allow Apollo.io in Cookie settings, the same switch that controls form enrichment on the enquiry pages. When Apollo.io decides it may track a visit, its tracker also loads a script from LiveIntent (d-code.liadm.com), a service Apollo.io works with, which receives your IP address and browser details in the same way; this too happens only if you allow Apollo.io. Apollo.io's privacy policy: apollo.io/privacy-policy.

Microsoft Advertising

I advertise on Microsoft Advertising (Bing). To measure whether those ads lead to enquiries, this website can load the Microsoft Universal Event Tracking (UET) tag, tag ID 97254229. Its purpose is conversion tracking and remarketing for Bing ads.

Microsoft Advertising has its own control in Cookie settings, separate from Google Ads and from the LinkedIn Insight Tag. Only that control governs it: granting Google Ads or LinkedIn consent does not enable Microsoft Advertising.

If you do not grant Microsoft Advertising consent, the UET tag is never loaded — no Microsoft advertising script is requested and no Microsoft advertising cookie is set by it. If you grant consent, the tag is loaded and told that ad storage is permitted, using Microsoft's Consent Mode.

If you allow Microsoft Advertising and then send an enquiry, the Microsoft click ID from the ad you arrived on is also sent to Microsoft from the server, so the enquiry counts as a conversion. Nothing is sent if you did not allow Microsoft Advertising.

If you withdraw consent after the tag has loaded during a visit, the tag is told that ad storage is denied and no further conversion events are sent. On your next page load the tag is not loaded at all. Withdrawing consent does not by itself delete cookies Microsoft has already set; you can remove those through your browser's cookie controls.

You can change this choice at any time through Cookie settings in the footer. For information on how Microsoft collects and uses this data, see the Microsoft Privacy Statement.

Microsoft Clarity

I use Microsoft Clarity to capture behavioural metrics, heatmaps, and session recordings that show how visitors use and interact with this website. This information is used solely to improve the site and the experience for visitors. Clarity may set session-tracking cookies (for example _clck and _clsk) under this site's domain as part of its service.

Clarity loads only if you allow Microsoft Clarity in Cookie settings, and your consent is the legal basis for it (Article 6(1)(a) UK GDPR). You can withdraw it at any time through the Cookie settings link in the site footer, or contact me via the contact page. For information on how Microsoft collects and uses this data, see the Microsoft Privacy Statement.

BottBuddy Chat Assistant

This site offers an optional chat assistant, provided by BottBuddy, to help visitors find information and navigate the site. It works in two steps. Allowing the BottBuddy chat assistant in Cookie settings shows my chat button; it does not contact BottBuddy. Nothing is requested from BottBuddy until you click that button. When you do, your browser loads BottBuddy's chat widget from BottBuddy's own servers and content delivery network (mdbcdn.b-cdn.net, and BottBuddy's Amazon Web Services storage in the US East region). If you use the chat, the content of your messages is processed by BottBuddy on my behalf to generate responses. Where you follow a link the assistant suggests, a first-party analytics event notes which suggested link you followed, if you have also allowed Google Analytics (see First-party behavioural events below).

Once open, the widget asks BottBuddy's own server (ai.bottbuddy.com) to estimate where you are from your IP address; BottBuddy's server does this with a further service, apiip.net. The lookup returns an approximate location: town or city, postcode area and map coordinates. The widget also keeps a browser ID (browser_unique_id) and your country (country) in your browser's local storage so it can recognise your browser on a later visit. None of this happens unless you have allowed the assistant and clicked the chat button. If you allowed the assistant before 30 September 2026, when this page said your IP address was not sent for a location lookup, you are asked again, because your earlier choice did not cover it.

This switch is separate from the others: changing it does not change them. The assistant does not load on the Privacy Policy, Terms and Conditions, or error pages. You have the right to withdraw this consent at any time — manage your preferences via the Cookie settings link in the site footer, or contact me via the contact page. For information on how BottBuddy collects and uses this data, see the BottBuddy Privacy Policy.

First-party behavioural events

Unless you object, some events are recorded to the first-party analytics database as site statistics, on the basis of legitimate interest (Article 6(1)(f) UK GDPR) and the statistics exception in PECR. They carry no personal data, no ad click IDs and no campaign details: only a session identifier that your browser deletes when the tab closes, and the address of the page the event happened on, without its query string. Turn off Site statistics in Cookie settings, or choose Reject all, and none of them are recorded.

Each event is also marked with whether the request looked automated, such as a search-engine crawler or a monitoring tool, so that visits by people can be counted apart from them. This is worked out on the server from the description your browser sends with every request (its user agent). Only the yes-or-no answer is kept; the description itself is not stored with these events.

• Page views — the page address without its query string, the referring domain only, and device class (mobile / tablet / desktop). No persistent visitor identifier is included. When a link to the home page forwards you to a section, the referring domain is kept for the next page in your browser’s tab storage, without the rest of the address, and deleted as soon as that page has read it; it is not kept if you have objected to site statistics.
• Shared post links — when a link I have shared in a post (on LinkedIn, in a newsletter or an email signature) carries a post code, such as li-20261019-contact-form, the page view you land on records that code: which post, on which channel and day it went out. The code names the post, never a person, and is removed from the address straight away so a reload or a copied link is not counted again.
• First interaction — time elapsed from navigation start to the user's first click or scroll, and the type of interaction.
• Back navigation — detection of browser back/forward navigation, page path, and referrer domain.
• Session context — viewport width, device class, connection type, navigation entry type (navigate / reload / back_forward), browser language preference, and screen resolution. No persistent visitor identifier is included.
• Scroll depth — the percentage of the page scrolled (25 %, 50 %, 75 %, 100 %).
• Time on page — total milliseconds spent on the page, recorded when the tab is closed or navigated away.
• Core Web Vitals — technical performance metrics (LCP, FCP, CLS, INP, TTFB) per page path, recorded once per page view when the page is hidden or closed. Each comes with how the page was reached (navigate / reload / back_forward / prerender / restore) and a coarse device band: mobile, tablet or desktop from the window width, and low, mid, high or unknown from the rounded device memory your browser reports. TTFB also carries how long each step of loading the page took, in milliseconds (redirects, service worker start-up, cache, DNS lookup, connection and waiting for the server). No user-identifying data is included, and nothing is read from your browser's user agent.
• JavaScript errors — unhandled errors and unhandled promise rejections, including error message and script file path (origin stripped, and any query string removed from web addresses in the message). Capped at five reports per page load. No personal data is captured.
• Consent choices — that you made a choice in Cookie settings and which services you allowed, so analytics can be read accurately.
• Contact form progress — that the contact form was shown, that you started filling it in, that you selected Send and that your message was sent; which step of the contact form you moved to or back from, which field showed an error and the kind of error (for example “required” or “too long”), the step you left on, why a send failed, whether you used the download or email fallback, and how the spam check ended for a sent message (passed, answered by the maths question, timed out or blocked). Each is a fixed code; what you typed is never recorded.
• FAQ answers — which answer you opened (by a fixed ID), whether you marked it helpful, the reason you picked from a short list if it was not, and whether opening an answer was followed in the same tab by starting the contact form or clicking a booking link.
• Pages not found — the address you tried, without its query string, and the kind of page that linked to it (none, this site, a search engine, social media or another site).
• Searches — for site search and the FAQ filter: how many results were found (in bands such as “none” or “1 to 3”), the length of the search in bands, and any words from a fixed list of topics the site covers (such as “azure” or “pricing”). The search text itself is never recorded.
• AI agent tool use — when an AI agent in your browser uses one of the tools this site offers to agents (such as checking availability or searching the site), which tool it was and whether it worked, was given unusable input or failed, as fixed codes. What the agent asked, and anything it filled in, is never recorded.
• Booking link clicks — that a booking link was selected, which audience’s booking page it leads to, a fixed code for where on the page the link sits, and device class (mobile / tablet / desktop). Nothing about you or what you book is included; the booking itself happens on HubSpot’s page.
• Share clicks — that one of the share options on a Workshop article was used (for example LinkedIn, email or copy link) and the page it was on, without its query string. The share links are plain links: nothing from LinkedIn, X or any other service loads on this site until you choose one, and what you share is between you and that service. The shared link carries a tag naming the service (for example utm_source=linkedin), which is recorded for the person who follows it like any other campaign tag: only if they allow Google Analytics.
• Home page choices — which link on the home page was followed (one of the three sections, or the “Continue to” link) and which section it leads to, as fixed codes.
• Contact route clicks — which way of getting in touch was selected on a contact page (phone, WhatsApp, LinkedIn, Teams, the contact card download or showing the email address) and which section’s contact page it was, as fixed codes. Nothing you type and nothing about the conversation that follows is recorded.
• Review card clicks — on the reviews page, which of the three reviews was chosen and whether it was to read its full scope or to get a quote, as fixed codes.
• Email address shown — that the email address (or the Teams chat link) was shown after you selected “Show email address”, which section of the site you were in, and a fixed code for where on the page the button sits. The address itself, and anything you then write, is never recorded.

The following additional events are recorded only if you allow Google Analytics:

• Referral link landings — the code from a PageTech referral link you arrived on, whether it was valid, and the landing page.
• CTA interactions — clicks on call-to-action buttons and links, including label, destination, page section, and whether the link was external.
• Booking CTA clicks — clicks on scheduling buttons, including destination and referral source.
• Phone CTA clicks — clicks on phone number links, including page section.
• Contact form funnel — form open, first interaction, field completion, submission attempt, success, and error events (no form content is recorded).
• Service and section engagement — service item expansions, section dwell time, and back-navigation detection (full cross-session correlated version with persistent visitor ID).
• Section visibility — which named page sections (e.g. hero, services, FAQ) have been scrolled into view, recorded once per section per page load. No section content is captured.
• Outbound link clicks — clicks on links to external websites, including the destination domain, path (no query string), visible link text (truncated to 80 characters), and the page on which the click occurred.
• Chatbot-assisted link clicks — when a link suggested by the BottBuddy chat assistant is followed, the destination page, the specific on-page target, and a label identifying the suggested link are recorded, to measure how much the chat assistant helps visitors find what they need.
• Chat assistant opens — when you press the Chat button, whether the chat opened or could not load (with a short reason code if it failed) and the page you were on. Nothing you type into the chat is recorded by this site.

Browser storage

The site's own code sets no cookies. Cloudflare's bot protection, which runs on every page whatever you choose, sets two strictly necessary security cookies: cf_clearance (kept for about a year) and __cf_ob (deleted when you close the browser). The services you allow in Cookie settings may set their own: Google Analytics and Google Ads, Microsoft Clarity (under this site's domain), Microsoft Advertising, LinkedIn and Apollo.io, and the BottBuddy chat assistant keeps its own keys in local storage once you open it. Those cookies are governed by each company's privacy policy. The full list of what this site stores in your browser, and when, is under Information I Collect in the Overview tab.

If you refuse or withdraw consent for a service, the site stops loading it, and deletes the identifiers that service left under this site's own domain which the site's code can reach (for Google Analytics, Google Ads, Microsoft Advertising, LinkedIn, Apollo.io and BottBuddy). Cookies a service set on its own domain, such as Google's, Microsoft's or LinkedIn's, cannot be removed by this site; you can clear them in your browser settings, and they are governed by that company's privacy policy.

Remarketing

This website uses Google Ads remarketing features, which allow my ads to be displayed to people who have previously visited this website. This uses cookies or similar identifiers to recognise prior visits and show relevant ads across Google's advertising network, only if you allow Google Ads in Cookie settings.

You can also opt out of Google's personalised advertising by visiting Google Ads Settings.

Enhanced Conversions for Leads

When you send an enquiry, the email address you give can be used to match it to an ad you clicked. For Google Ads this happens only if you allowed Google Ads: the server hashes the address with SHA-256, keeps the hash with the attribution record for up to 14 days, and sends it to Google with the click ID. For Microsoft Advertising it happens only if you allowed Microsoft Advertising: your browser hashes the address and sends it with the conversion. The address itself is never sent to either company for this purpose.

In plain terms, this means first-party data such as email address is normalised and protected before sharing for measurement. The process is:

1. trim leading and trailing spaces,
2. convert to lowercase,
3. apply SHA-256 hashing.

This data is used for conversion measurement and campaign optimisation only. It is not sold and not shared for other parties' independent marketing.

Booking data use

If you book a consultation, you submit personal data such as name, email address, and booking notes on the HubSpot booking page. HubSpot holds the booking and your contact record in its customer relationship management (CRM) system, and this website's server reads the booking from HubSpot. This information is used to schedule and deliver consultations, and to respond to your enquiry.

Completed bookings are reported as conversions from the server, using the first-party signals captured before you leave for the booking page, and only under the consent you gave on this website. If you cancel, the cancellation is recorded against the booking.

Data Retention & Security

I keep personal information only for the periods listed under Records Retention below. Technical and organisational measures in place include: TLS encryption for all data in transit; role-based access controls on systems holding personal data; Azure's built-in infrastructure security controls for hosted services (including DDoS protection and encrypted storage at rest); and Cloudflare's network security layer for all web traffic, including its web application firewall and bot protection.

Records Retention

I apply the following retention periods to different categories of records:

• Enquiry correspondence — each message is deleted automatically 12 months after it is received. Correspondence that becomes part of an engagement is kept as an engagement record instead (below).
• Engagement and contract records — retained for 6 years after the end of the engagement, in line with HMRC requirements and the Limitation Act 1980.
• Invoices and financial records — retained for 6 years as required by the Companies Act 2006 and HMRC.
• GDPR / data rights requests — retained for 3 years from the date of the response, to demonstrate compliance.
• Published testimonials — retained for as long as they remain published, and deleted if you withdraw yours or ask for it to be removed. Publishing is the only thing that makes a testimonial permanent, and you can end that at any time.
• Testimonials that are never published — a testimonial that is declined, or that is submitted and not published, is retained for 6 months and then automatically deleted, together with any verification record and any confirmation links it created.
• Testimonial notification emails — the email sent to me when a testimonial is submitted is kept in my own mailbox and is not deleted automatically. It stays until I delete it, which I will do when you ask.
• Server logs — retained for no more than 90 days, then automatically purged.
• Advertising attribution sessions (first-party) — lead intent records (including booking signals, full UTM payload, and click identifiers such as gclid) retained for up to 14 days for conversion matching, then deleted. Before they are deleted they are added to daily totals (how many visits came from each campaign, and how many of those asked to book). The totals hold no click identifiers or anything else that could identify you, and are kept indefinitely. UTM parameters and click identifiers captured as part of the general session record are retained as part of that session for up to 365 days alongside other session data (see First-party analytics session records below).
• First-party analytics events and engagement records — retained for 90 days, then automatically purged.
• First-party analytics session records — retained for 365 days, then automatically purged.
• Contact form submission log — one row per enquiry recording its reason, the email domain (not the address), the device type and how the visit arrived. Retained for 365 days, then automatically purged.
• Enquiry delivery queue — an enquiry and any attachments are held until they are delivered by email, then deleted 7 days after delivery.
• Referral and campaign attribution records — which referral link or campaign a visit came from, retained for 180 days, then automatically purged.
• Hashed email addresses for conversion measurement — for Google Ads, kept with the attribution record for up to 14 days, only if you allowed Google Ads, then deleted. For Microsoft Advertising, your browser hashes the address and sends the hash straight to Microsoft, only if you allowed Microsoft Advertising; this site does not keep that hash.
• CV request records — the email address and update preference from a CV request are deleted 7 days after the request if a verification code was sent and never used, and 90 days after the request otherwise. If you opted in to update notifications, your email address is kept for 12 months from when you opted in and then deleted; ask me through the contact form and I will remove it sooner. The copy of a completed request held in HubSpot follows Contact management records below. Verification codes expire 15 minutes after they are sent and cannot be used again once verified.
• Contact management records — a contact form submission, a booking or a completed CV request creates or updates a contact record. Copies of it are held in up to four places, and not all of them are deleted automatically yet:
  • This site's own contact records — your name, email address, phone number, company and job title, and any details added by Apollo.io enrichment, are deleted automatically 3 years after the record last changed. A new enquiry, booking or CV request, or an update to your details, starts the 3 years again. The raw copy of each submission used to build the record is deleted once it is 90 days old and has been processed. If you become a client, your record is not deleted automatically while you are one and is kept under Engagement and contract records above.
  • HubSpot — the contact, and the opportunities, notes and company record kept with it, are not deleted automatically. They stay in HubSpot until I delete them, which I will do when you ask.
  • Outlook contacts — the copy in my Microsoft 365 contacts list is not deleted automatically either. It stays until I delete it, which I will do when you ask.
  • Apollo.io — if you allowed Apollo.io, your name, email address and company name are sent to Apollo.io to look up professional details. What Apollo.io keeps of them is governed by its own privacy policy (see Third Parties below); this site cannot delete anything held by Apollo.io.
  I plan to make the HubSpot and Outlook copies delete automatically at the same time as this site's own record. Until then they are deleted by hand.

Where a period is given above, records are securely deleted or anonymised when it ends. You can ask me at any time to delete any copy listed here, including the HubSpot and Outlook copies, through the contact page. Please do the same if you believe I hold data beyond its retention period.

Database backups — the databases behind this site are backed up automatically, encrypted and stored in the UK. A record deleted from them, including one deleted at your request, stays in the backups until they expire: up to 5 weeks for enquiry and website analytics records, and up to 12 months for unsubscribe (opt-out) records and accounting records. Backups are used only to recover from a failure. If one is ever restored, anything deleted at your request is deleted again before the data is used.

Third Parties

The following third-party services process personal data on my behalf or in connection with this website:

• HubSpot, Inc. — customer relationship management (CRM) and appointment booking. The booking page is hosted by HubSpot, and your name, email address, company and job title (and, for a call-back request, your phone number) from a contact form enquiry or a booking, and the email address from a completed CV request, are copied into HubSpot so I can respond and keep track of the conversation. Each enquiry, booking or completed CV request is also recorded there as an opportunity, with the reason you gave and the page and channel you came from; the text of your message is not copied. Contacts are not added to any marketing list. Data is held in HubSpot's EU data centre in Germany. HubSpot's privacy policy: legal.hubspot.com/privacy-policy.
• WhatsApp LLC (Meta) — only if you choose to message me on WhatsApp. See Phone, voicemail, WhatsApp, Teams and LinkedIn messages.
• Google LLC — Google Analytics (GA4), Google Ads conversion tracking, and Enhanced Conversions for Leads. Used for website analytics and advertising measurement, only if you allow them (see Google tags). If you allowed Google Ads and send an enquiry, the ad click ID and a hashed copy of your email address are also sent from the server (see Enhanced Conversions for Leads). Google Tag Manager loads these tags once you have allowed Google Analytics or Google Ads. Google's privacy policy: policies.google.com/privacy.
• Microsoft Corporation (Microsoft Advertising) — Microsoft Advertising Universal Event Tracking (UET, tag ID 97254229) for conversion tracking and advertising measurement where consent is granted. If you allowed Microsoft Advertising and send an enquiry, your browser sends a SHA-256 hash of your email address with the conversion (Enhanced Conversions) to improve conversion matching (see Enhanced Conversions for Leads). Microsoft's privacy policy: privacy.microsoft.com.
• Microsoft Corporation — Microsoft Clarity (behavioural analytics, if you allow it), Azure Static Web Apps (website hosting), and the Microsoft Graph API, which delivers all transactional email sent by this site — contact form submissions and acknowledgements, and the CV request feature's CV delivery and, where opted in, update notifications. Microsoft Graph also keeps the contacts list in my Microsoft 365 mailbox in step with the contact records this site keeps, once a day, so the name, email address, company, job title and phone number you gave with an enquiry or booking appear as an Outlook contact. Microsoft's privacy statement: privacy.microsoft.com.
• Cloudflare, Inc. — All web traffic to this site transits Cloudflare's network as part of its DNS, CDN, and DDoS-protection services; Cloudflare processes connection metadata (including IP addresses and request headers) in that capacity. Cloudflare Web Analytics counts page views and page speed without cookies, receiving your IP address and browser details to do so; it is part of site statistics and does not run if you object. Aggregated daily Cloudflare reports (traffic, page, error, performance, security and DNS totals, with no IP addresses or other visitor-level data) are copied into this site's analytics database and kept for 730 days. Cloudflare Turnstile checks that the contact form and the testimonial form are being used by a person rather than a bot. It loads when you start using one of those forms, which makes it strictly necessary for the service you asked for, and uses browser and connection signals, including your IP address, for that check. A separate, invisible Turnstile check runs only when you select Show email address or Chat on Microsoft Teams, to keep the address away from automated harvesting, and another only when you send the CV request form or ask for a new code, so that the CV is emailed to people rather than to addresses a bot supplies. If the check is blocked, does not finish or does not pass, the contact or testimonial form still sends what you wrote and marks it for me to review as possible spam rather than refusing it, and a CV request is held until I send the CV myself. Cloudflare's processing for Turnstile is covered by its Turnstile Privacy Addendum. When you send an enquiry, Cloudflare's DNS service is also asked whether your email domain can receive email. Cloudflare's privacy policy: cloudflare.com/privacypolicy.
• Apollo.io — used in three ways, each only with consent: (1) if you allow Apollo.io, a form enrichment script on the business and recruiter enquiry pages matches your IP address against Apollo's database to fill in company details before you complete the form; (2) if you allow Apollo.io, the website tracker described under Apollo.io website visitor tracking reports which companies visit; (3) if you allowed Apollo.io in Cookie settings on the visit you enquired from, the name, email address and company name from a contact form submission are sent to Apollo's contact enrichment API to add professional context (such as job title and company details) to the internal contact record. Apollo.io's privacy policy: apollo.io/privacy-policy.
• LinkedIn — the LinkedIn Insight Tag, for campaign measurement and retargeting if you allow it. LinkedIn's privacy policy: linkedin.com/legal/privacy-policy.
• BottBuddy — provides the optional chat assistant widget. Nothing is requested from BottBuddy until you have allowed the assistant in Cookie settings and clicked the chat button. Then the widget loads from BottBuddy's servers, its content delivery network (mdbcdn.b-cdn.net, BunnyCDN) and its Amazon Web Services storage in the US East region; it asks BottBuddy's server (ai.bottbuddy.com) for an approximate location from your IP address (town or city, postcode area and map coordinates); and it keeps a browser ID (browser_unique_id) and your country in your browser's local storage. If you use the chat, the content of chat messages is processed by BottBuddy to generate responses; retention of chat conversation content is governed by BottBuddy's own retention policy rather than the periods listed above. BottBuddy's privacy policy: bottbuddy.com/privacy.

I review all providers for appropriate data-protection safeguards before use.

International Transfers

Google, Microsoft, Cloudflare, Apollo.io, LinkedIn, and HubSpot are headquartered in the United States. When data is transferred to these organisations, it is protected by one or more of the following safeguards:

• UK–US Data Bridge — for UK-to-US transfers where the recipient is certified under the UK Extension to the EU–US Data Privacy Framework. Google, Microsoft, and Cloudflare are certified participants. LinkedIn (operated independently of Microsoft for privacy purposes) relies on Standard Contractual Clauses.
• Standard Contractual Clauses (SCCs) — for EEA-to-US transfers, or as a supplementary or alternative safeguard where Data Bridge certification is absent or unconfirmed (including Apollo.io and LinkedIn). HubSpot holds this site's data in its EU data centre in Germany; any access from the United States is covered by HubSpot's data processing agreement.

BottBuddy's data processing location and applicable transfer safeguards are set out in its own privacy policy (linked above) rather than restated here, since this is determined by BottBuddy and may change at its discretion. Once you open the chat, the widget's files are served to your browser from Amazon Web Services storage in the United States (US East region).

You can request details of the specific safeguards in place for any transfer via the contact page.

Consent and how to withdraw

You can change your choices at any time, using the banner shown on your first visit or the Cookie settings link in the site footer. If you withdraw consent for a service you had allowed, the page reloads so that service stops straight away, the site deletes its own visitor and attribution IDs for it, and later server-side uploads for that service stop. The site also deletes the cookies and storage keys that service set under this site's own domain, where the site's code can reach them (see Browser storage in the Ads & tracking tab). You can also object to site statistics at any time with the Site statistics switch. Cookies a service set on its own domain (for example Google's, Microsoft's or LinkedIn's) stay until you clear them in your browser's settings (typically Settings › Privacy › Site data).

Automated Decision-Making

I do not carry out solely automated decision-making, including profiling, that produces legal effects or similarly significant effects on individuals.

Your Rights

Under UK data-protection law (UK GDPR) you have the right to:

• Request access to your personal data
• Request correction of inaccurate data
• Request erasure of your data
• Restrict or object to processing
• Data portability (where applicable)
• Withdraw consent for any optional service at any time

Where processing is carried out on the basis of legitimate interest (such as the first-party behavioural events recorded without consent), you have the specific right to object to that processing. Contact me via the contact page to exercise this right; I will cease processing unless I can demonstrate compelling legitimate grounds that override your interests.

To exercise any of these rights, contact me via the contact page. I will respond within one calendar month. For complex or numerous requests, this period may be extended by up to two further months; I will notify you of any extension and the reason within the initial one-month period, in accordance with Article 12(3) UK GDPR.

Complaints

If you are not satisfied with how I handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO).

Children

This website is directed exclusively at businesses and adult professionals. I do not knowingly collect or process personal data relating to children under the age of 13. If you believe a child has submitted personal data via this site, please contact me via the contact page and I will delete it promptly.

Changes to this policy

I may update this policy from time to time. The "last updated" date at the top of this page will be revised accordingly.

Reporting a security issue

If you think you have found a vulnerability in this website or its API, email me with “Security” at the start of the subject. Please include what you found, where, and how to reproduce it. I will acknowledge a report within 2 working days and keep you informed until it is fixed. Please do not access, change or keep data that is not yours, and give me reasonable time to fix an issue before you disclose it. Reports sent this way are not recorded as enquiries or used for marketing. This page is the policy that security.txt refers to.

Privacy Contact

If you have any questions regarding the processing of your personal data, wish to exercise your rights under UK GDPR, or have any privacy concerns, please contact:

Jamie Page, Director
PageTech Solutions Limited
jamie.page [at] pagetechsolutions [dot] co [dot] uk
or use the contact page.

PageTech Solutions Limited has assessed its processing activities and does not currently consider that it is required to appoint a statutory Data Protection Officer under UK GDPR.