What I hold, why, and what you can ask me to do with it

Who I am

GrowthMatix is the trading name of Dean Vinyard, a sole trader based in Ipswich, Suffolk, United Kingdom. I build websites, online shops, business systems and run SEO for small businesses. For the purposes of UK data protection law, I am the data controller for any personal data collected through this website or when you contact me.

What I collect and why

When you get in touch by WhatsApp, email or phone, I keep your name, contact details, the name of your business and what we discussed. I use this to reply to you, put together a quote and, if you go ahead, deliver the work. The legal basis is taking steps at your request before entering into a contract, and then performing that contract.

If you become a client, I also hold the information needed to build and look after your website or system: domain and hosting details, content you supply, and access credentials you choose to share. That data stays in the tools used to deliver the work and is only used for that purpose.

I may send occasional emails to past and current clients about services that are relevant to work I have already done for you. That is on the basis of legitimate interest, and every message includes a way to opt out.

Website visitors

This site does not use advertising cookies or sell data to anyone. Basic server logs record IP addresses and pages visited, purely to keep the site running and secure. If analytics are in use they are configured to collect aggregated, non-identifying data only.

Clicking the WhatsApp button opens WhatsApp on your device. Anything you send from that point is handled under WhatsApp's own privacy policy as well as this one.

Who I share it with

I do not sell personal data. It is shared only with the services needed to run the business and deliver the work, for example:

• The CRM and hosting platform used to build and manage websites and enquiries
• Email and messaging providers
• Payment and invoicing providers, if you become a client
• Domain registrars and DNS providers, where I manage those for you

Each of these processes data under their own agreements and I choose providers that meet UK GDPR standards. Some of these services store data outside the UK. Where that happens, the transfer is covered by the UK International Data Transfer Agreement, the UK Addendum to EU standard contractual clauses, or an adequacy decision.

How long I keep it

Enquiry details are kept for up to two years so that I can pick up a conversation if you come back later. Client records are kept for the length of the working relationship plus six years, as required for tax and accounting. After that they are deleted.

Your rights

Under UK GDPR you can ask me to:

• Tell you what personal data I hold about you and provide a copy
• Correct anything that is wrong
• Delete it, where there is no legal reason to keep it
• Stop using it for a particular purpose, including marketing
• Provide it in a portable format

Email dean@growthmatix.co.uk with what you need and I will respond within one month. If you are not happy with how I have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk.

Security

Client access details are stored in an encrypted password manager, never in plain text or shared documents. Accounts I control use two-factor authentication where the provider supports it.

Changes to this policy

If this policy changes in a way that affects you, I will update the date at the top of this page. Where the change is significant and you are a current client, I will let you know directly.