Privacy Policy

Last updated: 17 August 2026 — HeroSEO, registered England & Wales 12520563

1. Who we are

The data controller for heroseo.co.uk is Hero SEO Ltd, a digital marketing agency registered in England & Wales (company number 12520563), with a principal place of business in Brighton, East Sussex.

If you have any privacy questions, please contact us:

We are registered with the Information Commissioner's Office (ICO) as required by UK data protection law.

2. What personal data we collect and why

2.1 Enquiry and contact forms

When you submit an enquiry via our Let's Talk form or the on-page contact slide, we collect:

Legal basis: Legitimate interests (UK GDPR Art. 6(1)(f)) — to respond to your enquiry and potentially enter into a contract for services.

Retention: Enquiry data is held for up to 2 years. If you become a client, relevant data is retained for 6 years to comply with HMRC record-keeping requirements.

2.2 Website analytics

We use Google Analytics 4 (GA4) to understand how visitors use our website. GA4 collects anonymised usage data including pages visited, session duration, device type, approximate geographic location (city level), and traffic source. IP addresses are anonymised before storage.

Legal basis: Legitimate interests (UK GDPR Art. 6(1)(f)) — to improve our website and marketing effectiveness.

Retention: GA4 data is retained for 26 months (Google's default). You can opt out using the Google Analytics Opt-out Browser Add-on or by managing cookie preferences on our Cookies page.

2.3 Technical log data

Our web server automatically logs IP addresses, browser type, referring URL, and pages requested. These logs are used solely for security monitoring and are retained for 30 days.

Legal basis: Legitimate interests (UK GDPR Art. 6(1)(f)) — to maintain website security and diagnose technical issues.

3. Who we share your data with

We do not sell or rent your personal data. We share it only with trusted service providers who process it on our behalf:

All processors are bound by data processing agreements and must handle your data in accordance with UK GDPR.

4. International transfers

Some of our service providers (including Google) may process data outside the UK. Where this occurs, we ensure adequate safeguards are in place — either via the UK International Data Transfer Agreement (IDTA) or by using providers that participate in the UK Extension to the EU-US Data Privacy Framework.

5. Your rights under UK GDPR

You have the following rights in relation to your personal data:

To exercise any of these rights, email [email protected]. We will respond within one calendar month.

6. Cookies

We use cookies on this website. For full details of which cookies we set, what they do, and how to control them, please see our Cookies Policy.

7. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. Our website uses HTTPS (TLS) encryption. Access to any stored enquiry data is restricted to authorised personnel only.

8. Children's privacy

Our services are intended for business professionals. We do not knowingly collect personal data from anyone under 18 years of age. If you believe a child has submitted data to us, please contact us and we will delete it promptly.

9. Changes to this policy

We may update this Privacy Policy from time to time. The date at the top of this page will always reflect the most recent revision. For significant changes we will take reasonable steps to notify you.

10. How to complain

If you are unhappy with how we have handled your data, please contact us first at [email protected] and we will do our best to resolve the matter.

If you remain unsatisfied, you have the right to lodge a complaint with the UK's supervisory authority:

Information Commissioner's Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Tel: 0303 123 1113
ico.org.uk/make-a-complaint