Who is responsible for your information
Gecko Web Solutions Ltd is responsible for the personal information described in this notice. We trade as Gecko and provide website hosting, maintenance and related services. We are registered in England and Wales under company number 07972756. Our registered office is 15 Neptune Court, Vanguard Way, Cardiff, Wales, CF24 5PJ.
For privacy enquiries, including requests to access or delete personal information, contact [email protected]. You may also write to our registered office, marking your correspondence “Privacy”.
This notice explains what we collect, why we use it, who receives it and your choices. We distinguish our own customer administration from personal data that a customer asks us to host or handle for their business. For the latter, the customer will normally determine the purposes of processing and their own privacy notice applies; we act on their instructions under the agreed processing terms.
Information you give us
When you contact us, request advice or become a customer, we use the information needed to respond and provide the requested service. This may include your name, business name, email address, website address, correspondence and relevant instructions.
Our website enquiry form asks for your website address, the help you need, whether you have an online store, your preferred moving time, your name and email address. You can also provide a business name, additional information and indicate that you would like a video call. Required fields are identified on the form. Without those details we may be unable to respond usefully; optional fields can be left blank.
Please do not put passwords, payment-card details or sensitive information in the general enquiry form. If access is needed for a service, we will arrange an appropriate way to provide it.
We use GoHighLevel (GHL) to store and manage website enquiries, including your contact details, form answers, correspondence and enquiry notes. We use this information to assign follow-up tasks, respond to your enquiry and send relevant acknowledgements and follow-ups. If you request a video call, we may send the booking link and limited reminders to arrange it. If you book an enquiry or onboarding call, GHL processes the appointment details and sends booking confirmations and reminders. These activities do not subscribe you to our newsletter or unrelated marketing. A booking request does not by itself authorise recording, transcription or an AI notetaker.
We use Zoom for enquiry and onboarding video calls. With your permission, we use Fathom as an AI notetaker to record and transcribe the discussion and help prepare notes of agreed actions. Recordings we retain are stored in Dropbox Business; Fathom also processes the recording, transcript and generated notes. We explain the features and providers we intend to use and ask for permission before starting capture. You can decline and still have the call without recording, transcription or an AI notetaker. You can also ask us to stop during the call.
When you subscribe, we receive the customer and transaction information needed to administer your purchase, such as contact and billing details, the plan and add-ons, payment status, transaction identifiers and relevant tax information.
Payments take place through Stripe. We do not ask you to enter card details in the Gecko enquiry form. Stripe processes payment information and makes relevant payment records available to us; we do not receive your full card number through that form. Stripe also processes information for its own payment, fraud-prevention and legal purposes. See Stripe’s Privacy Policy.
Information collected automatically and from other sources
When you visit a website, its hosting and security systems may process technical information such as your IP address, requested page, time of access, browser/device information, referrer and error or security events. We use the information needed to operate and protect the service, investigate faults and prevent abuse.
We may inspect the public website you ask us to help with and receive information from your authorised colleagues, existing suppliers or payment provider where needed to handle your enquiry or service. We do not treat public availability as permission to use information for unrelated purposes.
With your consent to statistics cookies, we use Google Analytics to understand visits and improve the website. This can include pages viewed, interactions, referral information and browser or device information, associated with online identifiers.
With your consent to marketing cookies, we use the Meta Pixel to measure and improve our advertising. Meta receives information about visits and interactions, including page addresses, online identifiers and browser or device information, and may associate it with a Facebook or Instagram account to measure advertising and support relevant ads. These technologies are managed through Google Tag Manager. You can refuse them or change your choice without losing access to our services.
Why we use information and our legal bases
Where UK or EU data-protection law applies, we identify a legal basis for each purpose:
| Purpose | Information used | Legal basis |
|---|---|---|
| Responding to an individual’s request for a service or taking steps towards their own contract | Contact details, enquiry and relevant website information | Steps at the individual’s request before entering a contract, or performance of that contract |
| Communicating with employees or representatives of an organisation that is enquiring or buying | Business contact details, correspondence and instructions | Legitimate interests in dealing with the organisation and providing the service |
| Administering subscriptions and support | Customer details, service history and payment status | Contract where the individual is the customer; otherwise legitimate interests in administering the business relationship |
| Keeping required accounting and tax records | Invoices, transactions and relevant billing information | Legal obligation |
| Protecting services, preventing abuse and dealing with disputes | Relevant logs, communications and transaction records | Legitimate interests in security, business protection and establishing or defending claims; legal obligations where applicable |
| Optional call recording, transcription and AI-generated meeting notes | Audio, video, transcript and the information discussed in the call | Consent to the recording and notetaking features explained before capture |
| Optional marketing communications and consent-based tracking | The contact details or device/activity data described at the point of choice | Consent |
Asking us to reply to an enquiry is not the same as subscribing to marketing. We do not interpret an enquiry-contact checkbox as blanket permission for unrelated promotional messages or advertising tracking.
Newsletter and marketing signup is optional and separate from enquiries and purchases. We only add you to our marketing list when you opt in, and we use GoHighLevel (GHL) to manage that signup and send the communications you requested. You can unsubscribe using the link in our marketing emails. Service messages about your order, billing, security or support may still be needed after you opt out of marketing.
Who receives information
Access is limited to those who need information for the relevant purpose. Depending on the service, recipients include authorised Gecko personnel, hosting and security suppliers, payment providers, business communications and accounting suppliers, and advisers or authorities where necessary for a legal obligation or legitimate claim.
Stripe handles subscription payments. GoHighLevel (GHL) stores enquiry and customer contact records, form answers and notes, supports follow-up tasks and communications, and manages call bookings, confirmations and reminders. It also manages separately opted-in newsletter subscriptions. Zoom provides video calls, Fathom provides permission-based AI meeting notes, and Dropbox Business stores retained recordings and off-server backups. The information each receives depends on the service you use.
Google receives analytics information when you allow statistics cookies. Meta receives advertising-related information when you allow marketing cookies. See Google’s Privacy Policy and Meta’s Privacy Policy for their own processing and your provider-level choices.
International access and transfers
Gecko is a UK-registered company, and authorised service administration includes access from France. Our service providers may also process information outside the UK or your country, including in the United States. A UK hosting location does not mean that every service, backup or authorised access takes place only in the UK.
Where an international transfer requires safeguards, the applicable arrangements may include an adequacy decision or approved contractual safeguards, such as standard contractual clauses and the UK Addendum, together with any required additional protections. The arrangement depends on the provider and processing concerned.
You can contact us for information about the safeguards applicable to your data and how to obtain a copy, subject to appropriate protection of confidential information.
How long we keep information
We keep information only for as long as needed for its purpose, including relevant contractual, accounting, security and legal requirements. Retention differs by record type; it is not an indefinite period for everything.
| Record | Retention period or rule |
|---|---|
| Enquiries that do not become a customer relationship | Delete 12 months after the last substantive contact, unless a live request, dispute or specific legal requirement justifies longer retention |
| Call recordings and full transcripts | Delete 90 days after the call; retain longer only for a specific legal obligation or live dispute, with restricted use |
| Agreed actions extracted from calls | Keep relevant actions in the customer's service record for as long as needed to provide the service or retain necessary contract/claim evidence; not an indefinite archive of full recordings or transcripts |
| Routine support and business correspondence | Review at the end of the relationship; retain only necessary contract/claim evidence for the applicable limitation period, rather than every attachment indefinitely |
| Accounting and tax records | Normally six years from the end of the company financial year they relate to, or longer where law requires |
| Security and access logs | Retained only as long as necessary for security and fault investigation. |
| Contact details held for optional marketing | Until you withdraw consent or we stop sending the communications you requested; retain minimal suppression information where necessary to honour an opt-out |
| Customer website/mailbox data and backups | Held for the relevant service and return/deletion process. Routine on-server backups are retained for seven days and include hosted mailbox contents. Routine off-server backups are retained for 21 days and cover the WordPress website only. A restricted recovery archive is retained for 30 days after the relevant service ends, subject to earlier lawful return/deletion instructions. Residual backup copies remain protected until their applicable deletion cycle completes. Website cancellation does not end separately retained paid mailbox services. |
| Temporary enquiry greeting stored in the browser | Removed when the thank-you page reads it, or when the browser’s page session ends; an expiry check also prevents use after the configured validity period |
We may keep particular records longer when necessary for a specific legal obligation or live dispute, and restrict their use accordingly. When no longer needed, information is securely deleted or anonymised under the applicable process.
Cookies and similar technologies
Cookies and browser storage can support site functionality, security and, where enabled, measurement. The rules are not limited to files called cookies.
The current enquiry journey uses session storage named gecko-enquiry-greeting to carry a first-name greeting to the thank-you page. The stored value includes an expiry time. It is not put in the page URL, and the thank-you script removes it when read. Browser-session storage may remain until the page session ends if the thank-you page is never reached; an expiry value is not the same as automatic timed deletion.
Complianz provides our cookie choices and stores your consent preferences. Statistics consent controls Google Analytics; marketing consent controls the Meta Pixel. You can accept, reject or choose between optional categories, and reopen “Your cookie choices” to change or withdraw consent. Refusing optional technologies does not prevent you from reading about our services or contacting us.
Google Analytics and the Meta Pixel are activated only after consent to their respective categories. Google Tag Manager loads the configured tags and receives the technical information needed to deliver its script; loading the manager is not permission to activate optional analytics or advertising tags.
For cookie details and the preference controls, see our Cookie Policy.
Stripe checkout is a separate service, with its own privacy and cookie information. Opening an external payment page is not an agreement to unrelated advertising on Gecko’s website.
Your rights and choices
Depending on the applicable law and the circumstances, you may have rights to access your information, correct inaccuracies, request deletion, restrict processing, receive certain data in a portable format and object to processing. These rights have conditions and exceptions; deletion does not require us to erase records we must lawfully retain.
Where we rely on consent, you can withdraw it without affecting the lawfulness of earlier processing. Use the unsubscribe link for marketing emails, reopen “Your cookie choices” for optional tracking, or contact us about recording or other consent-based processing.
Your right to object: you can object to direct marketing at any time. Where we rely on legitimate interests, you can object for reasons relating to your particular situation. Contact [email protected] to exercise this right.
Contact us using the details in section 1. We may need proportionate information to verify identity or clarify the request. We handle requests within the time limits required by applicable law and explain any lawful extension or refusal. You may also complain to the UK Information Commissioner’s Office or another competent authority where applicable.
If your request concerns information on one of our customers’ websites, normally contact that business first: it decides how the information is used. If you contact us, we will handle or refer the request in accordance with our obligations and the customer’s instructions.
Security, changes and contact
Gecko restricts administrative access to customer hosting and WordPress systems using IP-based access controls. Access is limited to authorised Gecko personnel. We use access restrictions, maintenance, monitoring and backups to protect personal information against unauthorised access, loss or misuse. No internet service can be guaranteed completely secure.
We may update this notice when our services, processing or legal obligations change. The date at the top identifies the current version. Where required, we will give additional notice before using information for a new purpose and obtain any new consent needed.
For questions, requests or complaints about this notice, contact [email protected] or write to Gecko Web Solutions Ltd at the registered office in section 1.