Privacy Policy

Last updated: 13 October 2026

1. Who we are

This policy explains how Orchid Agency collects, uses and protects personal data when you visit our website, contact us or work with us.

1.1 Orchid Agency (“we”, “us”, “our”) is [registered company name], a company registered in England and Wales under company number [number], with its registered office at [address].

1.2 For the personal data described in this policy, we are the data controller. We are registered with the Information Commissioner’s Office (ICO) under registration number [ICO number].

1.3 If you have any questions about this policy or how we use your data, contact us at sam@orchidagency.co.uk.

2. The data we collect

We only collect the personal data we need to respond to you, deliver our services and run our business.

2.1 Contact and enquiry data: your name, business name, job title, email address, phone number and any details you share when you fill in a form, email us, call us or book a call.

2.2 Client data: contact details of the people we work with at your business, along with billing details needed to set up direct debits and payment links.

2.3 Website usage data: information about how you use our website, such as pages visited, time on site, device and browser type, approximate location and how you arrived on the site. This is collected through cookies and similar technologies, subject to your consent (see section 8).

2.4 Communications: records of emails, messages, call notes and meeting notes where they relate to an enquiry or our work together. Calls and meetings may be recorded or transcribed for note-taking, and we will always tell you when this happens.

2.5 We do not knowingly collect special category data (such as health, religion or ethnicity) through our website, and we ask that you do not send it to us.

3. How we use your data and our lawful basis

We use your data to reply to enquiries, deliver and manage our services, get paid and improve our website, and we always rely on a lawful basis under UK GDPR.

  • Responding to enquiries and preparing proposals: legitimate interests, or steps taken at your request before entering into an agreement.
  • Delivering our services and managing your account: performance of our agreement with you.
  • Invoicing, direct debits, payment links and keeping financial records: performance of our agreement and legal obligation.
  • Website analytics and advertising cookies: your consent.
  • Sending you relevant updates, insights or offers about our services: legitimate interests for business contacts, and you can opt out at any time.
  • Protecting our business, resolving disputes and meeting legal requirements: legitimate interests and legal obligation.

4. Data we handle on behalf of our clients

When we run campaigns for clients, some personal data belongs to the client, and in that case the client is the data controller and we act as their data processor.

4.1 This can include customer lists used for audience targeting, lead and enquiry data used for offline conversion tracking, and website or campaign data inside the client’s own accounts.

4.2 We only process this data on the client’s instructions, keep it secure, and do not use it for any other purpose.

4.3 If you are a customer of one of our clients, please refer to that business’s own privacy policy, or contact them directly about your data.

5. Who we share your data with

We never sell your personal data, and we only share it with trusted providers who help us run our business, under appropriate data protection terms.

5.1 These include:

  • Advertising and analytics platforms, such as Google, Meta and Microsoft
  • Website hosting and website management providers
  • Email, calendar, file storage and productivity tools, such as Google Workspace
  • Payment and direct debit providers, such as [direct debit provider]
  • Accounting and bookkeeping software and our accountants
  • Meeting, call and note-taking tools
  • Trusted freelancers or specialist partners who help deliver our services

5.2 We may also share data where required by law, to protect our legal rights, or as part of a sale or restructure of our business.

6. International transfers

Some of our providers store or process data outside the UK, and where they do, we make sure appropriate safeguards are in place.

6.1 These safeguards include UK adequacy regulations, the UK International Data Transfer Agreement or Addendum, or the UK Extension to the EU-US Data Privacy Framework, as appropriate.

7. How long we keep your data

We keep personal data only for as long as we need it for the purpose it was collected for.

  • Enquiries that do not lead to work: up to 2 years from our last contact.
  • Client records and communications: for the length of our relationship and up to 6 years after it ends.
  • Invoices and financial records: 6 years from the end of the financial year they relate to, as required by law.
  • Website analytics data: in line with the retention settings of the analytics tool, typically up to 14 months.

8. Cookies

Our website uses cookies, and any non-essential cookies are only set with your consent.

8.1 Essential cookies are needed for the website to work and cannot be switched off.

8.2 Analytics cookies (such as Google Analytics) help us understand how visitors use our website so we can improve it.

8.3 Advertising cookies (such as Google Ads and Meta Pixel) help us measure the results of our own advertising and show relevant ads to people who have visited our website.

8.4 You can accept, reject or change your cookie choices at any time through our cookie banner or your browser settings. We use Google Consent Mode, so Google tags respect the choices you make.

9. Keeping your data secure

We take appropriate technical and organisational measures to protect your data from loss, misuse and unauthorised access.

9.1 These include access controls, two-step verification on our business accounts, secure password management, and only giving team members access to the data they need for their role.

9.2 No method of sending or storing data online is completely secure, but if a data breach happens that is likely to affect you, we will tell you and the ICO where required.

10. Your rights

Under UK data protection law you have rights over your personal data, and you can use them at any time free of charge.

  • Access: ask for a copy of the data we hold about you.
  • Rectification: ask us to correct inaccurate or incomplete data.
  • Erasure: ask us to delete your data, where we no longer have a reason to keep it.
  • Restriction: ask us to limit how we use your data.
  • Objection: object to us using your data based on legitimate interests, including for marketing.
  • Portability: ask for your data in a format you can pass to another organisation.
  • Withdraw consent: where we rely on consent, you can withdraw it at any time.

10.1 To use any of these rights, email sam@orchidagency.co.uk. We will respond within one month.

11. Complaints

If you are unhappy with how we have handled your data, please contact us first so we can put it right.

11.1 You also have the right to complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113.

12. Links to other websites

Our website may link to other websites, and we are not responsible for their content or privacy practices, so please check their own privacy policies.

13. Changes to this policy

We may update this policy from time to time, and the latest version will always be on our website with the date it was last updated.

14. Contact us

For any questions about this policy or your personal data, contact us at sam@orchidagency.co.uk or by post to our registered office.

Consent Preferences