Greenhouse Communications Privacy Policy

Change Control

Version:	1.1
Date Approved:	July 2026
Title of Policy Holder:	Head of Operations
Date Issued:	July 2026
Review Date:	July 2027

Version	Type	Date	History
1.0	NEW	02/11/2023	Creation of this new website specific privacy policy
1.1	REVISED	17/07/2026	Updated for the new greenhouse.agency website: named processors (HubSpot, Mailchimp, Cloudflare, Google, LinkedIn), consent-based analytics, international transfers, and specific retention periods

Policy: Privacy Policy (Website)

1. Our contact details

Name: Greenhouse Communications

Address: 3rd Floor, St Thomas Court, Bristol, BS1 6JG

Phone Number: 0117 214 1250

E-mail: info@greenhouse.agency

2. The type of personal information we collect

We will collect and process the following information:

• Contact Information: Name, email address, organisation, and other similar contact details.

• Device Information: Information about your device, such as its IP address and browser type, used for security and — only with your consent — analytics.

• Cookies and Tracking Technologies: Information collected through cookies and similar technologies. Optional cookies are set only if you opt in through our cookie banner — see our Cookies Policy for the full list and retention periods.

• Other Information: Any other information you voluntarily provide to us, such as the content of your message via the Contact Us form, or details provided when subscribing to our newsletter.

3. How we get the personal information and why we have it

Most of the personal information we process is provided to us directly by you for one of the following reasons:

• Subscribing to our newsletter;

• Using our Contact Us form.

We may also receive personal information indirectly, from the following sources in the following scenarios:

• Google Analytics — website usage data, only where you have consented to analytics cookies.

• Mailchimp — engagement data related to our newsletter, such as whether an email was opened.

• HubSpot — engagement data connecting your website visits to your enquiry, only where you have consented to analytics cookies.

We use the information that you have given us in order to:

• respond to your enquiries and deal with your requests;

• send you our email newsletter, where you have subscribed (with double opt-in) — you can unsubscribe at any time using the link in every email;

• understand how our website is used so that we can improve it, only where you have consented to analytics cookies;

• keep the website secure — we use IP addresses and device information to block automated abuse and disruptive use;

• report on our work in aggregate (so that no individuals are identified) for marketing and strategic development purposes.

Where we propose using your personal information for any other use we will ensure that we notify you first.

We may share this information with third parties, including the following third-party service providers who process personal information on our behalf:

• HubSpot (EU data centre) – customer relationship management: enquiries submitted via our Contact Us form (name, email address, organisation and message) are stored in HubSpot. With your consent to analytics cookies, HubSpot also connects your website visits to your enquiry.

• Mailchimp – delivery of our email newsletter and management of subscriptions, including your consent preferences.

• Cloudflare – website hosting, security and bot protection (Cloudflare Turnstile): your IP address and device information are processed when you visit the site or submit a form, to distinguish genuine visitors from automated abuse.

• Google Analytics (via Google Tag Manager) – website usage analytics, only where you have consented to analytics cookies.

• LinkedIn – measurement of the effectiveness of our LinkedIn presence (LinkedIn Insight tag), only where you have consented to analytics cookies.

Some of these providers process personal information outside the UK — for example, Mailchimp, Google and LinkedIn process data in the United States. Where this happens, the transfer is protected by UK-approved safeguards, such as the UK Extension to the EU–US Data Privacy Framework or the International Data Transfer Agreement / standard contractual clauses.

Under the UK General Data Protection Regulation (UK GDPR), the lawful bases we rely on for processing this information are:

• Your consent — for the newsletter and for analytics cookies. You are able to remove your consent at any time: use the unsubscribe link in any newsletter, the “Manage cookies” button in the website footer for cookies, or the contact details in this policy.

• Our legitimate interests — responding to your enquiries, keeping the website secure, and promoting our services to organisations that have contacted us.

• We have a legal obligation — where we must keep or disclose information to comply with the law.

4. How we store your personal information and how long we keep it

Your information is securely stored on our IT systems and those of the service providers listed above.

We have put in place measures to protect the security of your information. Details of these measures are available upon request.

Third parties will only process your personal information on our instructions and where they have agreed to treat the information confidentially and to keep it secure.

We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal information on our instructions, and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

We keep your personal information only for as long as necessary for the purposes we collected it for. Specifically:

• Enquiries (Contact Us form): kept in our CRM for up to 24 months from our last contact with you, then deleted.

• Newsletter subscriptions: kept until you unsubscribe, after which your address is retained only on a suppression list so we don’t email you again.

• Analytics data: retained in Google Analytics for 14 months, then deleted automatically.

• Cookies: see the retention table in our Cookies Policy.

Where a legal, accounting or reporting requirement obliges us to keep information for longer, we will. In some circumstances, we may anonymise your personal information so that it can no longer be associated with you, in which case we may use such information without further notice to you.

5. Your data protection rights

Under data protection law, you have rights including:

Your right of access – You have the right to ask us for copies of your personal information.

Your right to rectification – You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.

Your right to erasure – You have the right to ask us to erase your personal information in certain circumstances.

Your right to restriction of processing – You have the right to ask us to restrict the processing of your personal information in certain circumstances.

Your right to object to processing – You have the right to object to the processing of your personal information in certain circumstances.

Your right to data portability – You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.

You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.

Please contact us using the contact details in this policy if you wish to make a request.

6. How to complain

If you have any concerns about our use of your personal information, you can make a complaint to us via the details found in the ‘our contact details’ section.

You can also complain to the ICO if you are unhappy with how we have used your data.

The ICO’s address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Helpline number: 0303 123 1113

ICO website: https://www.ico.org.uk