Brightpace ("we", "us", "our") is committed to protecting your privacy. This policy explains what personal data we collect, why, and your rights under the UK GDPR and the Data Protection Act 2018.
Who we are
Brightpace is a performance-marketing agency based in the United Kingdom. For any privacy questions, or to exercise your rights, contact us at hello@brightpace.co.uk. We are the data controller for the personal data described in this policy.
What data we collect
We collect only what we need:
- Information you give us: when you submit one of our enquiry forms: your name, email address, company or website, and any details you include in your message.
- Free checkers: if you use our free tracking checker or Shopify product checker, we receive the web address you enter and your IP address. We use the address to check that page or store and show you the results. We use your IP address only to limit how many checks can be run, to prevent misuse. We don't link either to your identity, and we don't use them for marketing.
- Usage data: if you consent to cookies, we collect standard analytics data such as pages viewed, approximate location, device and browser, and how you arrived at the site. We also count visits with a cookie-free analytics tool (Umami), which records pages viewed, the referring website, country, device and browser without identifying you.
- Advertising identifiers: if you arrive from one of our online ads and accept cookies, we may record the ad platform's click identifier (for example gclid, fbclid, ttclid, msclkid or LinkedIn's li_fat_id) and campaign parameters (UTMs), so we can measure which campaigns lead to enquiries. With your consent we also set a random visitor ID so advertising platforms can connect your visit to an enquiry.
- Matching enquiries to our ads: only if you accepted cookies, when you send an enquiry we share your email address and name with Meta (Facebook and Instagram) in hashed form, meaning they're converted into a scrambled code before they're used for matching, together with the visitor ID, your IP address and browser details, and your approximate location (town, postcode area, region and country, worked out from your IP address). Meta uses this to tell us whether the enquiry came from one of our ads. If your enquiry progresses (for example, you become a client), we may also tell Google, Microsoft or Meta which stage it reached, using the click identifier or, for Meta, your hashed email address and name, so they can learn which ads lead to real business. We never share the content of your message.
Cookies & tracking
We use cookies and similar technologies to understand how the site is used and to measure our marketing. On your first visit you are asked to accept or reject non-essential cookies, and non-essential tracking does not run until you accept. You can change your choice at any time by clearing your browser's site data. There are two exceptions, neither of which sets or reads cookies or identifies you. Umami runs for all visitors to give us accurate, anonymous visit counts (on the basis of our legitimate interests, see below). And Google’s tags, which run in Google Consent Mode, send only cookieless, consent-denied signals until you accept.
Where enabled, we may use:
- Google Analytics 4 & Google Tag Manager: to measure site usage and manage our tags.
- Google Ads: to measure conversions from our advertising.
- Umami: cookie-free, anonymous visit statistics (pages viewed, referrers, country, device). It sets no cookies and does not track you across other websites.
- Microsoft Clarity: to understand how visitors use our pages (heatmaps and anonymised session recordings), so we can improve the site. It only runs if you accept cookies.
- Meta (Facebook) Pixel & Conversions API: to measure and optimise our advertising.
- TikTok Pixel & Events API: to measure and optimise our advertising.
- LinkedIn Insight Tag: to measure our LinkedIn advertising, build advertising audiences and see, in aggregate, which industries and job roles visit our site. LinkedIn does not share individual visitors’ identities with us.
These services set their own cookies and may process data outside the UK. We use Google Consent Mode. Until you accept, Google receives only cookieless signals that say consent hasn’t been given: no cookies are set or read and no identifiers are sent. Google may use these signals, without identifying anyone, to estimate how many visits and conversions came from people who declined. Full analytics and advertising measurement starts only once you accept.
Server-side measurement
Some measurement is processed server-side. Rather than sending information directly from your browser to each platform, events may pass through our own tagging server (on a subdomain of brightpace.co.uk) which then shares conversion data, such as the advertising identifiers and hashed details described above, with the platforms listed. This helps us measure advertising accurately and follows the same consent choices. We don't use it to build profiles beyond measuring our own marketing.
Why we use your data (legal basis)
- Consent: for non-essential cookies and marketing analytics. You may withdraw consent at any time.
- Legitimate interests: to respond to your enquiry, run our business and keep anonymous, cookie-free visit statistics (Umami), where this does not override your rights.
- Contract: where we are taking steps to enter into or perform a contract with you.
How long we keep it
We keep enquiry data only as long as needed to deal with your request and for our legitimate business records, after which it is deleted. Analytics data is retained according to each provider's settings. Results from our free checkers are stored for up to six hours so a repeat check loads quickly, and the IP addresses used to limit checks are deleted within an hour.
Who we share it with
We do not sell your data. We share it only with service providers that help us operate, and where required by law. They include our website host (Netlify, which receives our enquiry forms), our tagging-server provider (Stape), Cloudflare (which runs our free checkers), our email provider (Zoho), our cookie-free analytics provider (Umami), Google (reCAPTCHA spam protection on our contact form, and Google Sheets and Apps Script, where we keep and manage enquiry records) and the analytics and advertising platforms listed above.
Your rights
Under UK GDPR you have the right to access, correct, delete, restrict or object to the processing of your personal data, and to data portability. To exercise any of these, email hello@brightpace.co.uk. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.
Changes to this policy
We may update this policy from time to time. Any changes will be posted on this page with a revised "last updated" date.