What I keep about you, and why.
This is Enhance New Media’s privacy notice. It covers the messages you send me, how this site measures visits, the work I do for clients, the businesses I look up and may write to, and the systems I use to do all of it, including AI. Every part of it describes something I actually do.
1. Who I am
Enhance New Media Ltd, registered in England and Wales, company number 07836060, registered office The Incuhive Space Chantry House, 38 Chantry Way, Andover, England, SP10 1LZ, is the data controller for everything on this page: it decides what is kept and why. It is my company, so on this page “I” and “me” mean Mark Barrett, acting for Enhance New Media Ltd. The company has no separate data protection officer; I answer for it myself. The company is registered with the Information Commission as a fee payer, registration number ZC267008.
To ask me anything about this notice, or to use any of the rights in section 9, email hello@enmltd.com, use the contact form, or write to Enhance New Media Ltd, The Incuhive Space Chantry House, 38 Chantry Way, Andover, England, SP10 1LZ.
2. Messages you send me
What I keep. What you type into the contact form is stored in this site’s own database, which Neon holds for me in London, so that I can reply and pick the conversation up later. That is your name, your email address, and whatever else you chose to give me (a phone number, a business name, a website, your message), together with the page you sent it from, the time, your browser’s identifying string, and a scrambled form of your network address. The scrambled address cannot be turned back into the address; it exists so that the form cannot be flooded, and it stays with the message. The form also has a hidden field that only automated software fills in; a message with that field filled is refused and nothing is stored.
The moment your message lands, this site’s private enquiry area makes a record of you and your business from it, which only I sign in to. A copy of what you typed is emailed to me by Resend and kept in my Microsoft 365 mailbox. If you email me directly, or we speak, the same applies to that correspondence and to any notes I make of a call.
Why the law allows it. To answer you and to take any steps you ask for before an agreement (UK GDPR Article 6(1)(b)), and my legitimate interest in keeping a record of what was said (Article 6(1)(f)).
How long. I keep an enquiry for two years from the last message in it, then delete it. Nothing on the site deletes it automatically yet. If we go on to work together, section 4 applies instead.
Nothing you send me is sold, passed to anyone else to use, or added to a mailing list.
3. Measuring visits
I measure how the site is used in two ways. One runs without asking. The other runs only on Accept, and so do Google Analytics and the Meta pixel, which Accept also turns on.
- Always on, without asking: site statistics. A count of which pages are opened, when, roughly where from (country, and at most a region or town), on what kind of device, in which browser and operating system (their names, never their versions), and the name of the site you came from, never the page. No cookie is used. Your device is given a short-lived number by the hosting company so that one visit is not counted twice; it is thrown away after 24 hours and cannot be turned back into you. No campaign codes, advertising identifiers or full web addresses are kept. The count is collected by Vercel, the company that hosts this site, on my behalf, and the site’s own server also counts page requests, with no code on them at all. Why the law allows it: my legitimate interest in seeing which pages are used and where something is broken (Article 6(1)(f)), and the exception for a site’s own statistics in the Privacy and Electronic Communications Regulations (Schedule A1, paragraph 5), which lets a site count without asking so long as it says so, which this does, and gives a free way to object, which is under “Objecting” below. How this site measures itself lists every field, from the same rule file the software follows.
- On Reject: nothing more. Detailed analytics, Google Analytics and the Meta pixel never load, not even their scripts. Site statistics carry on.
- On Accept: detailed analytics, with Umami. Umami is analytics software I run myself, as my own installation hosted in London, not a service that sees other websites. It records the pages you visit and in what order, the site or campaign link that brought you here (including any campaign tags in that link), your approximate location (country, region, town or city), your device, browser, operating system, screen size and language, and which links, buttons and forms you use (that a form was sent, never what you typed in it). Your network address is used to work out your location and to group your page views into a visit, and is not stored: Umami keeps a scrambled code made from it and your browser, which changes every month, so the same device looks like a new visitor in each new month. Umami sets no cookie. Nothing it records is sold, shared, or used for advertising. I keep detailed analytics for 25 months; anything older is deleted automatically every night. Why the law allows it: your consent (Article 6(1)(a)).
- Also on Accept: Google Analytics. It records the pages you visit, the site or link that brought you here (including any campaign tags in it), roughly where you are, your device and browser, and that an enquiry was sent, never what it said. Its cookies, _ga and _ga_932N307G7B, recognise your browser when you come back, for two years. Google uses your network address to work out roughly where you are and says it does not store it. What it records is kept in Google Analytics, where the visit-by-visit detail is deleted after at most 14 months. It is loaded through Google Tag Manager, which itself loads only after Accept. Why the law allows it: your consent (Article 6(1)(a)).
- Also on Accept: advertising, with the Meta pixel and Google. The pixel tells Meta, the company behind Facebook and Instagram, which pages you visit here, so that adverts on Facebook and Instagram can be measured and shown to people who have visited this site. The same answer lets Google Analytics use its advertising features: it adds your visit to Google’s advertising audiences, so that adverts on Google can be shown to people who have visited, and if you are signed in to Google it can connect the visit to your Google account. Its cookies, _fbp, and _fbc if you arrived from one of those adverts, are kept for 90 days, and with Meta’s own cookies they let Meta connect the visit to your Facebook or Instagram account if you have one. When you send the contact form, the pixel also sends Meta your email address, name and phone number from it, one-way hashed (scrambled so that it cannot be turned back, only matched against the same details Meta already holds), so that Meta can match the enquiry to an advert. And if you arrived from an advert on Google, Facebook, Instagram, Microsoft or LinkedIn, the advert’s click identifier is kept in a cookie, attr, for 30 days; if you then send the contact form, this site keeps that identifier with your enquiry, and a one-way hashed copy of your email address and phone number, for 90 days, so that I can tell which advert an enquiry came from. Those two are kept in this site’s own database and sent nowhere. Meta and I decide together that the pixel collects this and sends it to Meta, so for that step we are joint controllers, on the terms Meta sets for its business tools; what Meta then does with it is Meta’s, under its own privacy policy. Why the law allows it: your consent (Article 6(1)(a)).
Nothing from Umami, Google or Meta loads before Accept, and nothing at all is requested from Google or Meta after Reject. Site statistics and Umami are only ever requested from this site’s own address. On Accept, Google Analytics and the pixel load from Google’s and Meta’s own addresses.
Changing your answer
An answer given in the box can be changed here at any time, as easily as it was given. It takes effect straight away, on every page.
Checking…
Checking…
Checking…
Objecting
The law that lets me count without asking also gives you a free way to object to the site statistics, and this is it. Untick the box and your visits stop being counted, straight away and on every page. It changes nothing else about how the site works.
Checking…
Cookies
On the public pages, only the ones to do with measurement. One of them, consent_ref, is set as soon as the box is first shown, before you answer. Until you press Accept, none of them identifies you or follows you to another site.
- klaro holds the answer given in the box, so you are not asked on every page. Kept for 180 days, then you are asked again.
- consent_ref is a random reference, made when the box is first shown to you, so that there is a record that it was shown and what the answer was. It holds nothing about you. Kept for a year.
- stats_objection is set only if you object to the site statistics, and holds nothing but that. Kept for a year.
- _ga and _ga_932N307G7B are Google Analytics’ own, set only on Accept. They hold a random number that recognises your browser when you come back, and the time of your visit. Kept for two years.
- _fbp, and _fbc if you arrived from an advert on Facebook or Instagram, are the Meta pixel’s own, set only on Accept. Meta uses them to connect your visit here with an advert, and with your account if you have one. Kept for 90 days.
- attr is set only if you said yes to advertising and arrived from an advert. It holds where the visit came from and the advert’s click identifier, so that an enquiry can be matched to the advert. Kept for 30 days.
Umami sets no cookie. The private area behind the site, which only I sign in to, sets the cookies a sign-in needs, on those pages only; the sign-in code is emailed to me by Resend.
The record of your answer
I keep a record that the box was shown, what the answer was and when, and which version of the wording you saw, because I may need to show that I asked properly. It holds the random reference above, never your name or address. A scrambled form of your network address is kept with it for one day, so the record cannot be flooded, and is then removed. The record is kept for 25 months. Why the law allows it: the duty to be able to show that consent was asked for properly (Articles 6(1)(c) and 7(1)), and where you said no, my legitimate interest in being able to show the same (Article 6(1)(f)).
4. Working for clients
Your details, if you are a client or work for one. I keep the names, roles, contact details and correspondence of the people I deal with at a client, the agreement between us, and the records of the work and its invoices. Why the law allows it: to perform the agreement (Article 6(1)(b)), and the duties of a company to keep its business and tax records (Article 6(1)(c)).
Your customers’ details. Marketing work means working inside a client’s own systems: its website, its analytics, its advertising accounts and, where it gives me access, its mailboxes and customer records. The people in those systems are the client’s customers, not mine. For them the client is the controller and I act on its instructions, under its own privacy notice; I use what I see only for the client’s work, and I hand it back or delete it when the work ends, as the agreement says. If you are a client’s customer and want to use your rights, the client’s notice tells you how; if you write to me instead, I will pass your request to the client and help it answer.
How long. I keep a client’s agreement, invoices and the correspondence that supports them for six years from the end of the financial year they relate to, which is the period tax law asks for. Working files for a client’s campaigns are kept for the engagement and deleted or returned at its end, unless the agreement says otherwise.
5. Businesses I look up and may write to
I look for local businesses that seem to have no website, or a poor one, so that I can offer to build them one or to run their marketing. This section is the notice the law requires for anyone whose business I have looked up (Article 14), because I did not get these details from you.
What I hold. Facts that a business, or a public register, already publishes: its name, trading address and postcode, phone number, email address and website where they are published, what kind of business it is, whether it is a company and its company number, the size band its accounts show, the date a source last showed it operating, and its rating and number of reviews on Google, each with the date I read it. I do not copy the text of anyone’s reviews, and I do not read anyone’s LinkedIn profile.
Where it comes from. Public registers: Companies House, the Traffic Commissioners’ operator licences, the Food Standards Agency’s food hygiene ratings, the Care Quality Commission’s directory and the Charity Commission’s register; open map data published by the Overture Maps Foundation; Google’s business listings and search results, which I read through a service called SerpApi; and the business’s own website, which my software reads to see whether it works and what it is built on.
People, not just businesses. Some businesses are run by one person under their own name, and some registers name a person, such as a licence holder or a charity trustee. For them, these details are personal data, and I treat them as such. I do not email or telephone sole traders or partnerships unless they have asked me to; where my sources cannot tell me what kind of business something is, I treat it as a person’s and do not write.
What I do with it. Rules on these public facts sort the businesses, and I decide which, if any, to write to. If I write to a company, I may first build a draft homepage for it from what it already publishes, on a private link that search engines are told not to list, with any generated picture labelled as generated. I write once, by email to a published business address or by post to the registered office, saying who I am, what I saw and when, and how to say no. I read every draft and every message before anything is sent, and nothing is sent automatically.
Why the law allows it. My legitimate interest in offering my services to businesses that seem to need them (Article 6(1)(f)): one message, business facts only, an easy no, and no profiling of anyone as an individual. Email to a company is allowed without its prior consent under the Privacy and Electronic Communications Regulations, provided I say who I am and give you a way to opt out, which every message does; email to a sole trader or partnership is not, which is why I do not send it. I also do not email an address at a free webmail service such as Gmail or Hotmail, even when a company publishes it, because that mailbox belongs to a person. I have written down why I believe this interest outweighs any effect on you, in a legitimate interests assessment, and will give you a summary of it if you ask.
How long. Details about a person, such as a sole trader’s or a trustee’s, are deleted six months after I last looked them up or wrote, unless the business becomes a client or has told me no. I run that deletion by hand each month until the software does it for me. Facts about a company (its name, website, company number and rating) are not about a person; I keep them, with the date I read each one, and read them again before I rely on them. If you tell me no, I keep only your business name and the way I contacted you, with the date and your words, so that you are never contacted again.
Saying no. You can tell me to stop at any time: reply to my message, or email hello@enmltd.com, use the contact form, or write to Enhance New Media Ltd, The Incuhive Space Chantry House, 38 Chantry Way, Andover, England, SP10 1LZ. For direct marketing that right is absolute. I stop, I note the objection so it is honoured every time, and I do not contact you again.
6. The systems I use, including AI
I am one person, and I do the work of a small agency with systems I have built and run. Some of those systems use artificial intelligence, and this section says which, and what each one sees.
- Claude, made by Anthropic. I use Claude to help me read records, sort the businesses in section 5, draft outreach messages, and write reports. When I do, what is in front of me is sent to Anthropic’s servers in the United States to be processed. I use Claude on a personal subscription (Claude Max), under Anthropic’s consumer terms; for a user in the United Kingdom the contract is with Anthropic Ireland, and the processing happens in the United States. A personal subscription carries no data processing agreement, so while I am on one I give Claude only public facts about companies and the drafts I write to them: nothing that names a person, no sole trader’s details, and not the text of a message you have sent me. Claude drafts; I read and decide; nothing it writes reaches you unless I have read it. Under Anthropic’s terms it may use what is sent to it to train its models unless that is switched off in the account’s settings, and it keeps what is sent for the periods its privacy policy sets; a conversation I delete is removed from Anthropic’s systems within 30 days. Model training has been switched off on my account since 5 October 2026, so from that date what I send is not used to train Anthropic’s models. Before that date the setting was on, and Anthropic’s privacy policy says that what was sent while it was on may be kept in a de-identified form for up to five years in its model-training systems.
- ChatGPT and image models, made by OpenAI. I use OpenAI’s tools for research and to make the illustrations on this site. I have a plan to illustrate the draft homepage in section 5 with pictures generated by OpenAI from facts a business already publishes, each labelled as generated. That is designed and not yet built: no draft homepage has been made for any business and no such picture has been generated, so today OpenAI receives nothing about your business for that purpose. If that changes, this page will say so first.
- Software that reads websites and registers. My own scripts read public registers and a business’s own website, and SerpApi runs the Google searches and listing reads for me. Rules written by me, not a model, sort the results.
- The platform this site runs on. The enquiry area, the measurement, the business lookup and the private records all run on one platform, hosted by Vercel with its database at Neon in London.
No automated decisions. Nothing about you is decided by a machine alone in a way that has legal or similarly significant effects. Software sorts business listings to suggest who I might write to; I decide, and a sorting rule can be wrong, so if you think one has been, tell me and I will look.
7. Who handles your details for me, and where
These companies store or carry details on my behalf, to provide their service to me. None of them may use your details for its own purposes. Some are outside the United Kingdom, and the table says which.
| Who | What it holds or carries | Where |
|---|---|---|
| Neon | This site’s database: enquiries, the private records, the consent records and the measurement counts | Stored in London. Neon is a United States company |
| Vercel | Hosts this site and my Umami installation; collects the site statistics; stores the site’s pictures | The site runs in London. Vercel keeps the statistical count for twelve months, the reporting window of the plan this site is on, and says it may keep it longer; the short-lived number that tells one visit from another is discarded after 24 hours. Vercel’s own processing is primarily in the United States, and Vercel is a United States company |
| Resend | Sends the email that tells me a message has arrived, which carries what you typed, and my sign-in codes | United States |
| Microsoft | My mailbox and calendar (Microsoft 365), where those emails and our correspondence are kept | Stored in the United Kingdom; Microsoft is a United States company |
| Dropbox | My working files, including the lists of businesses in section 5, which can hold a sole trader’s name or a trustee’s email address | United States |
| GitHub (Microsoft) | The private repositories that hold this site’s code and my working record, including notes about businesses I may write to and draft messages | United States |
| SerpApi | Runs the Google searches and listing reads I ask for, so it receives the business names and places I search for | United States |
| Anthropic | Processes what I give Claude: public facts about companies and the messages I am drafting to them (section 6) | United States; the contract is with Anthropic Ireland under its consumer terms |
Google and Meta, only if you press Accept. They are not in the table because they are not only working for me. Google provides Google Analytics and Google Tag Manager to me, and also uses what they collect to run and improve its own services and, if you said yes to advertising, for its advertising, under its own terms. Meta receives what its pixel sends as a joint controller with me for that step, and then uses it for its own advertising, under its own privacy policy. Both are in the United States.
Transfers outside the United Kingdom. Where a company above is in the United States, the transfer relies on a safeguard UK law recognises: the company has certified under the UK Extension to the EU-US Data Privacy Framework (the UK-US data bridge), or its contract with me carries the UK’s International Data Transfer Addendum to the European standard contractual clauses, or both. Provider by provider, as each states on its own legal pages, read on 6 October 2026:
- Vercel: certified under the UK Extension to the Data Privacy Framework; and its data processing addendum, which binds every Pro-plan customer such as me, carries the UK International Data Transfer Addendum and the European clauses.
- Resend: certified under the UK Extension; its data processing addendum, which binds on accepting its terms, carries the UK Addendum to the European clauses.
- Dropbox: Dropbox, Inc. is certified under the UK Extension.
- GitHub and Microsoft: both certified under the UK Extension, with the European clauses behind them.
- Neon: your details are stored in London, so there is no transfer for storage. Neon is part of Databricks, which is certified under the UK Extension and names Neon in that certification.
- SerpApi: what I send SerpApi is the name of a company and the town or postcode I am searching, which are not anyone’s personal details, so no transfer of personal data takes place. If I ever search for a sole trader or a named person through it, I will put SerpApi’s data processing agreement in place first and name the safeguard here.
- Anthropic: my contract is with Anthropic Ireland under its consumer terms (section 6), and Anthropic’s privacy policy says its transfers to the United States rely on adequacy decisions or the standard contractual clauses. As a consumer subscriber I have no data processing agreement with Anthropic, which is why I give Claude nothing that names a person.
- Google and Meta (only on Accept): Google LLC and Meta Platforms, Inc. are both certified under the UK Extension to the Data Privacy Framework.
I can tell you which safeguard applies to any of them, and show you the page it comes from, if you ask.
Companies House and the other public registers in section 5 are sources, not recipients: I read from them and send them nothing about you. Google’s search results are read through SerpApi, which sends Google nothing about you; the only thing Google receives about you from me is Google Analytics, on Accept.
8. How long I keep things
Everything above, in one place. Where a period is still to be confirmed it is marked.
| What | How long |
|---|---|
| An enquiry that does not lead to work | Two years from the last message, then deleted (not yet automatically) |
| A client’s agreement, invoices and supporting correspondence | Six years from the end of the financial year they relate to |
| A client’s campaign working files | The engagement, then returned or deleted |
| Site statistics: single visits and page requests | 48 hours, then only daily totals remain, which cannot be turned back into a visit |
| Detailed analytics (Umami), if you said yes | 25 months, purged nightly |
| Google Analytics, if you said yes | The visit-by-visit detail at most 14 months; Google’s report totals longer |
| An advert’s click identifier and the hashed email address and phone number kept with an enquiry, if you said yes to advertising | 90 days, then removed from the enquiry automatically |
| The Meta pixel, if you said yes | As long as Meta’s own privacy policy says; it is Meta’s to keep |
| The record of your consent choice | 25 months; its scrambled address for one day |
| Cookies | klaro 180 days; consent_ref and stats_objection one year; on Accept, _ga and _ga_932N307G7B two years, _fbp and _fbc 90 days, attr 30 days |
| Details about a person in a business I looked up (a sole trader, a partner, a named licence holder or trustee) | Six months from the last look-up or contact, then deleted by a monthly run |
| Facts about a company I looked up | Kept, each with the date it was read, and read again before I rely on it |
| Your objection to being contacted | For as long as the business exists, so it is honoured |
9. Your rights, and how to use them
Under UK data protection law you can:
- ask for a copy of what I hold about you, and where it came from;
- have it corrected if it is wrong;
- have it deleted;
- ask me to stop using it while a question about it is settled;
- object to how I use it, and for direct marketing I then stop, without exception;
- have what you gave me sent to you, or to another company, in a form a computer can read, where I hold it with your consent or to take steps you asked for;
- withdraw your consent at any time, for Umami, Google Analytics and advertising with the switches in section 3.
To use any of them, email hello@enmltd.com, use the contact form, or write to Enhance New Media Ltd, The Incuhive Space Chantry House, 38 Chantry Way, Andover, England, SP10 1LZ. There is no charge, and I answer within one month. I may ask you to confirm who you are first, so that I do not give your details to someone else.
If you are unhappy with how I have handled your details, tell me first if you are willing, and I will answer within 30 days. You can also complain to the Information Commission, still widely known as the ICO, the UK’s data protection regulator: ico.org.uk, telephone 0303 123 1113, or by post to Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.
10. Children
This site is for businesses and the people who run them. It is not aimed at anyone under 18, and I do not knowingly collect anything about a child. If you believe a child has sent me something, tell me and I will delete it.