Privacy Policy

This policy explains what personal data Aurelo collects when you use aurelo.uk, get in touch, book a call, apply for a job or work with us. It also explains what we do with that data and the rights you have over it. We keep it short and specific to how we actually work.

1. Who we are

Aurelo is a website design, development and SEO studio based at 11 Pains Road, Portsmouth, PO5 1HE, United Kingdom. For the purposes of UK data protection law (the UK GDPR and the Data Protection Act 2018), Aurelo is the controller of the personal data described here.

For anything about your data, email hello@aurelo.uk.

2. What we collect

Information you give us

• Contact and enquiry forms: your name, email, phone number, company, website, budget, company revenue range, how you heard about us, your message and the page you sent it from.
• Free audit requests: the website you want audited, plus your name, email and phone number.
• Ebook downloads: your name, email and phone number.
• Newsletter: your email address and the page you signed up on.
• Job applications: your name, email, phone number, location, portfolio link, the role you applied for and your CV, plus anything you choose to include in it.
• Discovery calls: when you book through our Cal.com calendar, your name, email, the time you picked and any notes you add.
• Client work: if you hire us, your contact and billing details, and the project material you share with us, such as logins, content and files.
• Emails and calls: anything you send us directly.

Information collected automatically

• Analytics: we use Google Analytics to see which pages are visited, how people move through the site, the device and browser used, and rough location (country or city). Google Analytics uses cookies to do this.
• Advertising: we use the Meta Pixel to measure our ads on Facebook and Instagram. It records page views and when a discovery call is booked, and may link this to your Meta account if you have one.
• Server logs: our host, Netlify, records technical data such as IP address, browser and the time of each request, to keep the site running and secure.

We do not knowingly collect special category data (such as health or ethnicity). Please leave it out of your CV and messages.

3. How we use it, and our legal basis

The law requires a legal basis for each use of your data. Ours are:

• Replying to enquiries, audit and ebook requests: to take steps at your request before a possible contract, and our legitimate interest in answering people who contact us.
• Sending automatic confirmation emails: our legitimate interest in letting you know your form reached us.
• Delivering client projects and invoicing: to perform our contract with you.
• Keeping financial records: to meet our legal obligations, such as tax law.
• Reviewing job applications: our legitimate interest in hiring, and steps you ask us to take before a possible employment contract.
• Sending the newsletter: your consent, which you can withdraw at any time.
• Following up on an enquiry or audit with related ideas: our legitimate interest in growing our business. You can tell us to stop at any time.
• Analytics and advertising measurement: our legitimate interest in understanding how the site is used and whether our ads work. See our Cookie Policy for the cookies involved.
• Keeping the site secure and preventing spam: our legitimate interest in protecting our site and inbox.

We never sell your data, and we do not make decisions about you by automated means alone.

4. Who we share it with

We only share data with services that help us run Aurelo. They act on our instructions and must keep it secure:

• Netlify hosts the website.
• Supabase stores form submissions, including CVs, on servers in the EU.
• Resend sends the confirmation emails after you submit a form.
• Cloudflare runs the robot check on our forms, which keeps spam out.
• Cal.com runs our booking calendar.
• Google provides Google Analytics.
• Meta provides the Meta Pixel. Meta also uses this data for its own purposes, under its own privacy policy.
• Our email, file storage and accounting tools, which hold our correspondence, project files and invoices.
• Professional advisers such as our accountant, and authorities like HMRC where the law requires it.

If Aurelo is ever sold or merged, your data may pass to the new owner under this same policy.

5. International transfers

Some of these providers are based in, or store data in, the United States or elsewhere outside the UK. When data leaves the UK, we rely on the safeguards UK law allows, such as the UK-US Data Bridge, the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses.

6. How long we keep it

• Enquiries, audit and ebook requests: up to 2 years after we last spoke, unless you become a client.
• Client and financial records: 6 years after the project ends, as required for tax.
• Job applications and CVs: 6 months after the role is filled. If you are successful, your application becomes part of your staff record.
• Newsletter: until you unsubscribe.
• Analytics data: up to 14 months in Google Analytics.

After that, we delete or anonymise it.

7. Your rights

Under UK data protection law, you have the right to:

• get a copy of the personal data we hold about you
• have inaccurate data corrected
• have your data deleted
• restrict how we use it
• object to us using it, including for marketing, which we will always stop
• receive your data in a portable format
• withdraw consent at any time, where we rely on it

To use any of these, email hello@aurelo.uk. It is free, and we will reply within one month. We may ask you to confirm your identity first.

To unsubscribe from the newsletter, reply to any newsletter email or email us. To stop analytics and advertising cookies, block or clear them in your browser settings.

8. Security

The site runs over HTTPS, and we keep access to form submissions, CVs and client files limited to the people who need them, using accounts protected by strong passwords and two-factor authentication. No system is perfectly secure, but if a breach ever puts your data at risk, we will tell you and the ICO where the law requires it.

9. Children

Our site and services are for businesses and are not aimed at anyone under 16. We do not knowingly collect data from children.

10. Links to other sites

Our site links to other websites, such as client projects and social profiles. We are not responsible for how they handle your data, so check their own privacy policies.

11. Complaints

If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113.

12. Changes to this policy

We will update this policy when the way we handle data changes. The date at the top shows when it was last revised. If a change is significant, we will make it clear on the site or tell you directly.