Privacy Policy

MightyDam Marketing Ltd - Privacy Policy (UK & International Visitors)

Effective Date: 29th October 2026

ICO registration reference: ZC285623

Welcome to https://mightydam.com (the “Site”).

We respect your privacy and are committed to protecting your personal information. This policy explains what data we collect, how we use it, and your rights under the UK GDPR and PECR.

1. Who we are

MightyDam Marketing Ltd ("MightyDam", "we", "us") is a private limited company registered in England and Wales, company number 14939859. Our registered office is 86-90 Paul Street, London, England, EC2A 4NE.

We are the controller for the personal data we collect about our own website visitors, prospects, enquiries, clients, suppliers, and general business administration. That means we decide why and how that data is used, and this policy explains that in full.

If you have a question about privacy, want to exercise a data right, object to how we use your data, withdraw a consent, or make a privacy complaint, email [email protected]. This inbox is monitored and is our dedicated privacy contact.

For ordinary business matters that are not privacy-related, such as a general enquiry about our services, email [email protected]. Please do not send privacy or data-rights requests to this address, as it is not monitored for that purpose.

2. Controller and processor

In some cases, we deliver services that involve working with a client's own customer data. For example, Google Business Profile and review management, missed-call text-back, CRM and workflow services, review-request systems, and customer follow-up or database reactivation carried out lawfully on a client's behalf.

In these situations, the client is normally the controller of their own customers' data, and we act as the processor, working strictly under the client's instructions and a written data processing agreement (DPA). We do not own or independently control a client's customer database simply because it passes through our systems.

If you believe your data has been processed by us only because you are a customer of one of our clients, please contact that client first. They are responsible for explaining how your data is used and for handling your request.

This policy explains how we handle data where we are the controller. It is not a substitute for, and does not form, the internal data processing agreement that governs how we handle a client's customer data on their behalf.

3. What this policy covers and does not

This policy covers the personal data that MightyDam controls directly, as described in section 1. It does not cover, and is not a replacement for, the privacy notice that one of our clients should give to their own customers. If you are a customer of a business we work with, their privacy notice applies to you, not this one.

4. The information we use

We collect and use several categories of information, depending on how you interact with us.

Website and form data. Information submitted through contact forms, booking forms, or enquiry forms on our website, along with standard technical data generated by visiting our site.

Call and enquiry data. Information you give us when you call, email, or message us with a question or enquiry, including the details of that conversation.

Client and supplier administration. Information needed to manage a contract, onboarding, billing, or an ongoing supplier relationship.

Business-prospecting information. As part of researching potential clients, we gather information from publicly available business sources and business-prospecting or research tools. This can include business websites, Google Business Profiles, public business directories and listings, Companies House, search results, and other similar legitimate public or business-research sources.

This prospecting information may include a business name, business phone number, business address, website, business type and the services offered, trading location, a publicly listed business email address, and, where it is publicly available, the name or business contact details of an owner, director, or other contact at the business.

A business name on its own, with no information about a specific person, is often not personal data. However, where information identifies a living individual, for example a named person's name, a direct phone line, or a personal or role-based email address tied to them, that is personal data, even though it relates to them in a business capacity.

The fact that information is publicly available does not mean someone has consented to us using it, and it does not remove our obligations under UK GDPR. We still have to have a proper reason to use it, and that is explained in the next section.

5. Why we use it and the lawful basis

We only use personal data where we have a proper legal reason to do so. Here is what that looks like in practice.

Responding to your enquiry. When you contact us with a question, we use your details to reply and to take the steps you asked for before entering into a contract with us.

Delivering a contract. Once you become a client, we use your information to perform that contract, including the services, reporting, and communication it requires.

Service, billing, onboarding, and reminders. Day-to-day service communications, such as onboarding, invoicing, appointment reminders, and support, are carried out because they are necessary to perform our contract with you, or because we have a legitimate business interest in running our services properly. These are not based on your consent, since they are not optional extras but part of delivering what we agreed.

Legal obligations. We use certain information, such as invoicing and accounting records, because the law requires us to keep it, for example for tax purposes.

Our own business prospecting. Where we research potential clients, make notes about a business's online presence, or make manual prospecting calls, we rely on our legitimate interest in growing our business. We only do this where that interest is fairly balanced against the rights of the person involved, and only where the rules on live calls, explained in section 6, allow it.

Marketing. Where the law requires your consent before we market to you, we will ask for it. Where it is lawful to rely on legitimate interests instead, particularly in appropriate business-to-business situations, we will tell you that is the basis we are using, and you can object at any time, as explained in section 8.

We do not currently run unsolicited cold email or cold SMS marketing campaigns. Our prospecting calls are made manually from our business telephone number, and we do not use GoHighLevel, or any other automation tool, to make cold calls.

6. Calls, TPS and CTPS

If we make live marketing calls to businesses, those calls must follow the Privacy and Electronic Communications Regulations (PECR) as well as UK GDPR. Before we make a prospecting call, we check the number against the Telephone Preference Service (TPS) and the Corporate Telephone Preference Service (CTPS), and we also check our own do-not-contact list.

We do not call a number registered on either the TPS or the CTPS unless that subscriber has specifically consented to our calls. If someone tells us directly that they do not want our calls, we stop calling them and add them to our own suppression list, even if their number is not on either register.

Sole traders and some partnerships are often treated as individual subscribers and may be registered with the TPS. Limited companies and other corporate subscribers are more likely to be registered with the CTPS. Because our prospecting lists usually contain a mix of business types, we screen against both registers rather than assuming one applies.

A business being listed in a public directory or on a website does not give us permission to call it. Public availability tells us a number exists. It does not tell us the subscriber is happy to be called, so we still carry out the checks above.

7. How people hear about this policy when we did not collect the data from them

Sometimes we obtain personal data about a business contact from a source other than that person, for example a public directory, a business website, or Companies House. Where this counts as personal data, UK GDPR Article 14 requires us to give that person privacy information within a reasonable period, and no later than one month after we obtain it. If we intend to contact the person for marketing, we must give them this information at the latest when we first contact them.

In practice, our normal method is to identify MightyDam clearly when we call and tell the person that this privacy policy is available at mightydam.com. We do not rely on "the information was on a public website" as a reason to stay silent about what we are doing with it. If we have obtained someone's personal data from another source, the duty to tell them applies regardless of where that source was.

This duty applies to personal data about an identifiable living person. A plain company record, such as a business name, general trading address, or switchboard number with no link to a named individual, is not personal data and falls outside this duty. We do not promise a written notice before every single call, but we do make sure people can quickly find out who we are and where to read this policy.

8. Marketing choices versus privacy rights

We keep two things separate: stopping marketing, and asking us to deal with your personal data under UK GDPR. They are not the same request, and we do not treat them as the same.

You can opt out of marketing at any time using the method described in the message you received. For marketing text messages, replying STOP will stop further marketing texts from us. This is a marketing opt-out, not a request to delete your personal data.

If you want us to erase your data, or exercise another data-rights request, that is assessed under UK GDPR rather than carried out automatically because a particular word was used. We will look at what you are asking for and what applies to your situation, and respond properly, as explained in section 13. To stop us contacting you again after an opt-out, we may need to keep a small suppression record, for example your name or number on a do-not-contact list. This is kept only to honour your opt-out, not for any other purpose.

You can send a privacy or data-rights request to [email protected]. We will also recognise a clear request made through another reasonable channel, such as a phone call or a letter, even if it does not use that email address. You have an absolute right to object to direct marketing at any time, and once you do, we will stop.

9. Service communications

Not every message we send is marketing. We send service and transactional communications as part of doing business with you, including replying to your enquiry, confirming or reminding you of an appointment, onboarding you as a new client, delivering the service you have asked for, billing you, providing support, and administering your account.

These messages are necessary to run the relationship you have asked for or agreed to, so we do not rely on your consent to send them. Depending on the message, our lawful basis is performing our contract with you, taking steps you asked for before entering a contract, or our legitimate interest in running our services properly. You cannot generally opt out of necessary service communications while remaining a client, in the same way you can opt out of marketing, because they are part of the service itself rather than a separate promotional message.

10. Automation and AI

We use everyday business tools to run MightyDam and to deliver services to clients. These include CRM systems, workflow automation, appointment scheduling, missed-call text-back, and SMS or chat tools. In some services, we also use AI-assisted chat or voice tools.

Not every service we offer uses AI. Where we do use these tools, they mainly do practical, low-level jobs: replying to a message, collecting basic information, routing an enquiry to the right place, or triggering a routine next step in a workflow.

We do not use automation or AI to make decisions about a person that have a legal effect or a similarly significant effect on them, such as decisions about credit, eligibility, or employment. A person is always able to reach us directly if a query needs human judgement.

11. Who we share data with

We share personal data only with the people and services needed to run our business and deliver our services. These fall into the following categories:

email and workspace tools

CRM and messaging automation tools

payment processing

video call tools

Google business and advertising-related tools, where used

website hosting and domain services

professional advisers, such as our accountant or solicitor

a client, where we are acting on that client's instructions

We do not sell personal data. We do not publish a full list of every individual service provider in this policy, but we can explain our arrangements in more detail if you ask.

Some of these providers may process personal data outside the UK. Where this happens, we only use providers who have an approved legal safeguard in place, such as the UK's data adequacy regulations, the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses.

12. How long we keep it

We keep personal data only for as long as we have a genuine reason to do so. Our current retention periods are set out below.

Prospect and unsuccessful enquiry records: 12 months from the last meaningful contact, or sooner if the person objects, after which we delete the record or reduce it to a minimal suppression record.

Client and contract records: 6 years after the contract ends.

Invoices and accounting records: 6 years.

Privacy request and complaint records: 3 years after the matter is closed.

Consent records: for as long as we rely on that consent, plus 6 years after it ends, so we can show what was agreed.

Suppression and do-not-contact records: for as long as we carry out marketing, limited to what we need to honour the opt-out.

CRM conversations: for the life of the relationship, then in line with the relevant period above.

Client customer data we process as a processor: for the period set out in the client's instructions and our data processing agreement with them, after which we delete or return it.

We may keep data for longer than these periods where the law requires it, or where we need to in connection with a live legal claim.

13. Your rights

Depending on your circumstances and the lawful basis we use, you have some or all of the following rights under UK GDPR: access to your data, correction of inaccurate data, erasure, restriction of processing, objection to processing, data portability (where our basis is consent or contract and the processing is automated), and withdrawal of consent where we rely on it. You also have an absolute right to object to direct marketing at any time.

These rights depend on your circumstances and the lawful basis we are using. Erasure, in particular, is not automatic. We may refuse or limit a request where the law allows us to, and if we do, we will explain why.

We will normally respond to a rights request within one month. If the request is complex or you have made several requests, we may extend this by up to two further months, and we will tell you if we do.

14. Complaints

If you are unhappy with how we have handled your personal data, you can tell us by emailing [email protected]. We do not currently offer a separate complaints form.

When we receive a complaint, we will acknowledge it within 30 days. We will look into it without undue delay, keep you informed if it is taking longer than expected, and tell you the outcome once we have reached one.

You do not have to complain to us first. You have the right to complain directly to the Information Commissioner's Office at ico.org.uk at any time. That said, we would welcome the chance to look into it and put things right.

15. Cookies

Our website may use cookies and similar technologies. We do not load non-essential cookies, such as analytics or advertising cookies, until you have given your consent through our cookie banner. Essential cookies that are needed to make the site work may be set without asking first, because the law allows this.

Turning off cookies in your browser settings is not our method of compliance. Our cookie banner is the way we ask for and record your consent before any non-essential cookie is set.

We do not list every individual cookie in this policy. A separate cookie notice, generated from our live website and cookie-management tool, sets out the specific cookies we use, what each one does, and how long it lasts. That notice is kept up to date as our tools change, so it sits apart from this policy.

16. Children

MightyDam is a business-to-business service. Our website and services are aimed at businesses, not children, and we do not knowingly collect personal data from children. If we become aware that we have collected a child's personal data without the appropriate consent, we will delete it.

17. Changes to this policy

We may update this policy from time to time, for example if our services change or the law changes. When we do, we will post the updated version on our website and change the date shown below. This version is dated 29 October 2026.

18. Where this policy comes from

This policy reflects UK GDPR, including the rules on lawful processing, telling people how we use their data, and the right to object to marketing. It also reflects the Privacy and Electronic Communications Regulations on live marketing calls, the Information Commissioner's Office guidance on business-to-business and telephone marketing, and the data protection complaints duty introduced by the Data (Use and Access) Act 2025, as explained in ICO guidance.