Privacy policy

1. What data we collect

We may collect the following personal data when you use our website, contact us, or use our services:

• Contact information: your name, email address, and company name when you fill in a form or contact us directly.
• Usage data: limited information about how you use our website, including pages visited. This is collected automatically via privacy-respecting analytics and cookies.
• Device and technical data: your IP address, browser type, operating system, and screen resolution, as logged by our hosting provider.
• Client data: if you become a client, we may collect billing information, advertising account data, and business information necessary to deliver our services.

2. How we use your data

• To respond to enquiries and provide information about our services.
• To deliver our PPC management, feed optimisation, and related services to clients.
• To send you relevant communications, only with your consent.
• To improve our website and understand how visitors use it.
• To comply with legal obligations.

3. Legal basis for processing

We process personal data under the following legal bases as defined by UK GDPR:

• Consent: when you submit a form or accept cookies, you consent to us processing your data for the stated purpose.
• Legitimate interests: we may process data where we have a legitimate business interest, such as responding to enquiries or improving our services.
• Contractual necessity: where processing is necessary to fulfil a contract with you as a client.
• Legal obligation: where we are required to process data to comply with the law.

4. Third-party services

The following services may collect or process personal data when you use this website or our services:

• Cloudflare: website hosting, DNS, content delivery, and security. Cloudflare privacy policy.
• Sanity.io: content management for this website. Visitor data is not transmitted to Sanity. Sanity privacy policy.
• Resend: transactional email delivery for form submissions. Resend privacy policy.
• Google Fonts: web fonts used for the design system. May log your IP address when loading fonts. Google privacy policy.
• Google Analytics 4 (GA4): website analytics to understand how visitors use our site. Runs with Google Consent Mode v2: before you accept cookies, GA4 sends only cookieless, anonymised pings (no personal data is stored on your device). After you accept, standard analytics cookies are set. Google privacy policy.
• Google Ads: conversion tracking to measure the effectiveness of our advertising. Operates under the same Consent Mode v2 mechanism as GA4 above. Google privacy policy.

We do not sell your personal data to any third party.

5. Cookies

This website uses a small number of cookies. When you first visit, you'll see a consent banner asking whether you accept analytics cookies.

Essential cookies: required for the website to function and to protect against abuse. Set by Cloudflare for bot management and security. These do not require consent.

Consent preference: your Accept or Decline choice is stored in your browser's local storage (rtn-consent) so we don't ask you again on every visit. This is not a cookie and contains no personal data.

Analytics cookies (Google Analytics 4 and Google Ads): these are only set after you click Accept. Before that, GA4 and Google Ads run in cookieless mode under Google Consent Mode v2 — they send anonymised, aggregated pings with no cookies or personal identifiers stored on your device. If you decline, this cookieless mode continues for the rest of your visit and no analytics cookies are ever placed.

You can change your mind at any time by clearing your browser's local storage for this site, which will reset the consent banner on your next visit. You can also manage cookies through your browser settings.

6. Data retention

• Enquiry data: retained for up to 24 months after your last interaction with us.
• Client data: retained for the duration of our contract plus 6 years to comply with HMRC requirements.
• Server logs: retained for short periods as part of normal hosting operations.

7. Your rights

Under UK GDPR, you have the following rights:

• Right of access: you can request a copy of the personal data we hold about you.
• Right to rectification: you can ask us to correct inaccurate data.
• Right to erasure: you can ask us to delete your data where there is no compelling reason for us to keep it.
• Right to restrict processing: you can ask us to limit how we use your data.
• Right to data portability: you can request your data in a structured, commonly used format.
• Right to object: you can object to processing based on legitimate interests.

To exercise any of these rights, email hello@rtn.digital. We will respond within 30 days.

8. Data security

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or destruction. The website is served over HTTPS, sensitive credentials are stored as encrypted environment variables, and access to client data is limited to those who need it.

9. International transfers

Some of our third-party service providers (such as Cloudflare, Sanity, Resend, and Google) may process data outside the UK. Where this happens, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses or adequacy decisions.

10. Complaints

If you are unhappy with how we have handled your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Telephone: 0303 123 1113

11. Changes to this policy

We may update this policy from time to time. Any changes will be posted on this page with an updated "last updated" date. We encourage you to review this policy periodically.