Last updated 19 October 2026
This policy explains how Carson Clicks uses personal information when you visit www.carsonclicks.co.uk, contact us or use our digital marketing services. It also explains your data protection rights and how to contact us.
Who is responsible for your information
Carson Clicks is the trading name of Richard Carson, a sole trader. Richard Carson is the data controller for the personal information covered by this policy.
Postal address: Studio 105, Embroidery Mill, Abbey Mill Business Centre, Paisley, PA1 1TJ, United Kingdom.
Email: richard@carsonclicks.co.uk
Where we handle personal information on a client’s behalf and under their instructions, the client’s privacy information and our contractual arrangements with that client apply to that processing.
Information we collect and where it comes from
We collect information directly from you when you submit our contact form, email us, telephone us or work with us. The contact form asks for your company name, first name, last name, email address, the service you are interested in and your message. We also retain relevant correspondence and information you provide about your project.
If you become a client, we may hold business contact details, proposals, agreements, service records, invoices and payment records. A business may provide its staff’s contact details so that we can deliver the agreed services.
Our hosting service records website access logs containing your IP address, the date and time of access, the requested URL, the server response code, the amount of data transferred, the referring page and browser/user-agent details. These logs support the operation, security and troubleshooting of the website. With your consent, Google Analytics also collects information about visits and interactions, as described below.
Contact form messages are emailed to us. We do not retain a separate copy of form submissions in the WordPress website database. Email and hosting services still process information when transmitting or storing those messages.
Why we use information and our lawful bases
Enquiries and quotations: to respond and prepare proposals. We rely on taking steps at your request before entering a contract with you personally, or our legitimate interest in responding to company representatives and other business enquiries.
Client services: to deliver agreed work and manage the relationship. We rely on performance of a contract with you, or our legitimate interest in delivering services to the business you represent.
Business administration and security: to manage records, protect our website and deal with disputes. We rely on our legitimate interests in running and protecting the business, balanced against your rights.
Accounting and tax: to maintain required financial records and comply with legal obligations.
Website analytics: to understand and improve website use. We rely on your consent for Google Analytics tracking.
Without sufficient contact and project information, we may be unable to respond or provide services. We do not subscribe enquirers to newsletters or promotional mailing lists.
Google Analytics and cookies
We use Google Analytics 4, provided by Google, to understand how people find and use our website and to improve its content and performance. Analytics information can include pages viewed, interactions, referral source, approximate location, device and browser information, and cookie identifiers. It does not need your name or email address, and we do not send the content of enquiry forms to Google Analytics.
We use CookieYes to manage cookie preferences. Necessary technologies support the website and remember your choices. Optional analytics cookies are used only after you give consent. You can accept, reject or customise optional cookies and change your choice at any time using the cookie preferences control on the website. Withdrawing consent does not affect processing that was lawful before you withdrew it.
The cookie information available through our consent controls explains the cookies detected on the website, their purposes and their durations. Cookie expiry and the retention of information already collected are separate matters.
Google Analytics user and event data is retained for two months before automatic deletion. Aggregated reports may remain available for longer where they no longer identify individuals. Google’s privacy information is available at https://policies.google.com/
Who receives personal information
We use service providers to operate the website and business. They may process personal information as necessary to provide their services. These include:
Omniscot for website hosting and associated technical services.
Our email and business document provider, Google Workspace, for receiving enquiries and managing correspondence and records.
Google for Google Analytics, where you consent to analytics tracking.
CookieYes for managing cookie choices and consent records, according to the plugin’s configuration.
Accounting software providers, our accountant and professional advisers where necessary for accounts, legal obligations or advice.
We may also disclose relevant information to HMRC, regulators, law enforcement or other bodies where legally required, or where necessary and lawful to establish, exercise or defend legal rights. Information shared for these purposes is limited to what is needed.
Processing outside the United Kingdom
Some of our service providers, including Google, operate internationally, so personal information may be processed outside the United Kingdom. Where a transfer requires protection under UK data protection law, it must be covered by UK adequacy regulations or appropriate safeguards, such as approved contractual terms and the UK Addendum to the EU Standard Contractual Clauses, as applicable to the provider and transfer.
Contact richard@carsonclicks.co.uk for information about the arrangements applying to your information and how to obtain a copy of relevant safeguards.
How long we keep information
We keep personal information only for as long as it is needed for the purpose for which it was collected. Our retention approach is:
Enquiries that do not become client work: normally deleted within 12 months of the last meaningful contact, unless there is a documented need to retain relevant information for an ongoing discussion, complaint or legal matter.
Client information: kept during the relationship, then reviewed. We retain only records needed for continuing administration, legal obligations or potential legal claims, for the period justified by that purpose. Irrelevant or duplicate information is deleted sooner.
Tax and accounting records: kept for the applicable statutory periods. As a sole trader, relevant business tax records are normally kept for at least five years after the 31 January filing deadline for the relevant tax year. VAT records are normally kept for at least six years. Where more than one requirement applies, we follow the longer applicable period.
Website access logs: the server processes and archives access logs every 24 hours. At the end of each calendar month, it removes the previous month’s archived raw logs. Retention therefore follows a monthly deletion schedule rather than a fixed number of days.
Hosting backups: backups are scheduled every four hours to two separate off-server destinations within the UK/EU. Each backup job retains 184 recovery points, providing approximately one month of history when the jobs run on schedule. Retention depends on the number of recovery points rather than a fixed deletion deadline. Information removed from active systems may remain in backups until the relevant recovery points are removed through this cycle.
Cookie consent records: these are retained according to the operational and compliance purposes for which they are needed and the relevant provider’s retention arrangements.
We retain relevant information longer where needed for an unresolved complaint, dispute, investigation or legal requirement. Otherwise, information is deleted or anonymised when no longer needed.
Your data protection rights
Depending on the circumstances and the lawful basis used, you may have the right to:
Access your personal information and receive a copy.
Have inaccurate or incomplete information corrected.
Ask for information to be deleted, or for its use to be restricted.
Object to processing based on legitimate interests.
Receive information you provided in a portable format, where the legal conditions apply.
Withdraw consent at any time where we rely on it, including through the website’s cookie preferences.
To exercise a right, contact Richard Carson using the email or postal address above. These rights are subject to legal conditions and exemptions. We normally respond within one month and without a fee. Where the law allows an extension, we will explain why and tell you within the required period. We may need information to verify your identity.
Questions and complaints
If you have a concern about how we use your information, contact richard@carsonclicks.co.uk or write to Richard Carson at the address above. We will acknowledge a data protection complaint within 30 days, investigate it, keep you informed and provide a response without undue delay.
You also have the right to complain to the Information Commissioner’s Office, the UK data protection regulator. Visit https://ico.org.uk for its current complaints information.
Changes to this policy
We will update this policy when our services or use of personal information changes, including if we introduce advertising tracking. The date at the top shows when it was last updated.