In short
- We collect what you send us, and public information about businesses that we might build a website for.
- We use it to reply to you, to build and show previews, and to run the sites we look after.
- Calls and chats are answered by an AI assistant, which tells you so, and are recorded.
- We don’t sell it. This website uses Google Analytics only if you allow it.
- You can ask what we hold, ask us to correct or delete it, or tell us never to contact you again.
Who is responsible
GFY Marketing Limited, trading as Brand New Design, is the controller of the personal data described here. Questions about your data go to pedro@gfymarketing.co.uk.
- Trading name
- Brand New Design
- Legal name
- GFY Marketing Limited, a private limited company
- Registered in
- England and Wales
- Company number
- 09851041
- Registered office
- 10 John Street, London WC1N 2EB
- Where we work from
- Unit 4, The AJM Centre, Prospect Business Park, Swanage BH19 1EP
- Phone
- 07426 991951
Visiting this website
We count visits to this website without cookies. For each page you open we keep the page, the website that sent you there (such as Google), whether you’re on a phone or a computer, your type of browser and system (such as Safari on an iPhone), your screen’s width, how long the page is open and how far down you read, and a visitor code. While a page is open it tells us every 15 seconds, so we can see how many people are on the site now.
We also keep your rough location: a country and a town, worked out from your IP address on our own server with DB-IP’s free database. Nothing is sent anywhere to do it. The visitor code is made from your IP address and browser with a random value we keep for one day only, so we can tell visits apart within a day but can never work out who you are. We don’t keep your IP address.
Lawful basis: our legitimate interest in knowing which pages are useful.
Analytics, if you allow it. Google Analytics sets cookies with a random ID and sends Google the pages you open, the site that sent you, your type of device and browser, and your rough location (a town or region, worked out from your IP address, which Google Analytics doesn’t keep). Google Ireland Limited provides it, and the data may be processed in the United States. We see the totals in Google’s reports and don’t use them to work out who you are. Google’s advertising features are turned off.
Say no and nothing from Google loads. You can change your mind at any time under Cookies.
Lawful basis for analytics: your consent.
When you contact us
Our start page asks for your name, business name, town, current website, phone number, email address and, for bigger projects, what you need, your budget and a message. You don’t have to give all of them.
To stop spam, we also keep the type of browser you used and a scrambled version of your IP address. It is scrambled one way (hashed), so we can tell repeat sends apart but can’t read the address back.
A person reads every message. Nothing is sent to you automatically. We use what you send to reply and to do what you asked, such as building your preview or quoting for a project.
Lawful basis: our legitimate interest in answering people who contact us, and taking steps you ask for before a contract.
Calls and chats
Our phone number and the chat on this website are answered by an AI assistant. It says it is an AI at the start, and that the conversation is recorded so our team can follow up.
- Phone calls reach us through Twilio, which carries the call, and are answered by ElevenLabs’ assistant. When you call, we use your number to see whether we already know you, for example because we built a preview for your business.
- The chat is ElevenLabs’ chat window. Its code is loaded from unpkg.com, and what you type or say goes to ElevenLabs’ servers in the United States. It sets no cookies until you use it.
- What we keep: the recording and transcript, and the details you give, such as your name, your number or email, and what you need. ElevenLabs keeps recordings for 30 days. We keep the transcript and the details in our own system so the right person can answer you.
- If you ask in a call or chat not to be contacted again, it is written down there and then, and we won’t contact you again.
Lawful basis: our legitimate interest in answering people who call or write to us, and taking steps you ask for before a contract.
Businesses we build for
We look for good local businesses whose website could be better, and build some of them a preview. To do that we use information the business has made public:
- its business listing from Google, through Google’s official Places service (we don’t copy Google Maps),
- open map data from the Overture Maps Foundation,
- the public Companies House register,
- its own website, which our software visits and checks in a browser, taking screenshots.
This can include the business name, address, phone number, website, opening hours, photos, reviews and ratings, and what the website says. For a sole trader or partnership, some of this is personal data.
Our software scores businesses on things like their reviews and how well their current website works, to decide which ones to build for. That decision has no legal or similarly significant effect on anyone: at most, it decides whether we offer a free preview.
We use AI to help write and check the text of a site: Anthropic’s Claude models, and open models running on our own server. Business details are sent to them for that purpose only. Our hero films are made with Higgsfield’s AI video, from descriptions of a trade, not from anyone’s personal details.
Lawful basis: our legitimate interest in offering a useful service to businesses, using information they have chosen to publish. We have weighed that interest against the interests of the people behind those businesses, and you can ask us for that assessment.
How we contact businesses
We tell a business about its preview through the contact form on its own website, and sometimes by post. Every message says who we are and how to tell us to stop.
If you tell us to stop, we will never contact you again. To make sure of that, we keep a short record (your business name, website and phone number) on a do-not-contact list.
Previews
Previews are private and not on search engines. When a preview is opened, we record that it was viewed, what was clicked, and the type of browser, so we know whether the owner has seen it. To count repeat visits, the preview keeps a random ID in your browser; it says nothing about who you are. To stop being counted, tap “Don’t count my visits” in the bar at the bottom of any preview. See Cookies.
If you use a form on a preview, for example to say you want the site or to ask for a change, we keep your name, phone number, email address, the domain you’d like and your message.
A preview that isn’t wanted is taken down after 30 days.
Clients
When you become a client, we also keep your contact and billing details and what we have done for you. Your domain is registered in your name with GoDaddy, so your details go to GoDaddy, and some may appear in public domain records. Card payments go through a payment provider, which we will name here before we take payments online; we never see your full card number.
Lawful basis: to carry out our contract with you, and to meet our legal duties, such as keeping accounts.
Pass it on
When you join Pass it on, we keep your name, your phone number or email, your code, and the businesses you pass on, so we can tell you how each one is going and pay you. We ask for your bank details only when a payment is due. We tell a business you passed on your first name, and that you get £100 from us.
For a business you pass on, we ask only for its public name, town and website. We don’t ask for the owner’s personal details, and we don’t contact a business because someone named it.
Lawful basis: to carry out our agreement with you, and to meet our legal duties, such as keeping accounts.
How long we keep it
- Messages, calls and chats: 24 months after we last hear from you. Call and chat recordings at ElevenLabs: 30 days.
- Business details used for previews: the preview comes down after 30 days if it isn’t wanted; the details behind it are kept for 12 months after we last use them.
- Do-not-contact list: for as long as we contact businesses, because its whole purpose is to remember.
- Client records: while you are a client, then six years, as the law requires for accounts.
- Google Analytics: the detailed records for up to 14 months; its cookies for 13 months.
Keeping it safe
Our website and every site we host use HTTPS, and IP addresses from our website’s forms are stored only in scrambled form. Only our own team can see the data, each person signing in with their own account, and our servers are backed up.
Your rights
Under UK data protection law you can ask us to:
- tell you what we hold about you and give you a copy,
- correct anything that’s wrong,
- delete it,
- limit how we use it, or stop using it,
- send it to you, or to someone else, in a usable format.
You can object to our use of your data at any time. If you object to us contacting your business, we stop, always.
Where we rely on your consent, you can take it back at any time, as easily as you gave it, under Cookies. That doesn’t undo what was collected before.
Write to pedro@gfymarketing.co.uk. We will reply within one month.
Complaints
If you’re unhappy with how we’ve handled your data, tell us first at pedro@gfymarketing.co.uk. We will acknowledge your complaint within five working days and tell you what we’re doing about it.
You can also complain to the Information Commissioner’s Office: ico.org.uk/make-a-complaint, or 0303 123 1113.
Changes to this notice
If we change how we use personal data, we will update this notice and the date in the contents.