Legal
Privacy Policy
This Privacy Policy explains what personal data Nielsen & Brown collects when you use our website, how we use it, and the rights you have over it.
We aim to keep this short and readable rather than burying you in legalese. If anything is unclear, please get in touch via the contact form on our homepage.
Who we are
For the purposes of UK GDPR and the Data Protection Act 2018, Nielsen & Brown is the data controller for personal data collected through nielsenandbrown.com.
You can contact us about anything in this policy via the contact form at nielsenandbrown.com/#contact.
What data we collect
We collect personal data in two ways:
1. When you fill in our contact form. This includes your first name, last name, email address, company name (if provided), company size (if provided), and the message you send us. We collect this so we can respond to your enquiry.
2. When you accept analytics cookies. We use Google Analytics 4 to understand how visitors use our site, in aggregate. If you accept analytics cookies, Google sets cookies on your device which may collect data such as your IP address (truncated by Google), the pages you view, how long you spend on them, the device and browser you are using, and broad location data (typically country or region). If you decline, no analytics cookies are set and only anonymous, aggregated signals are sent to Google — these cannot identify you.
We do not knowingly collect any other personal data. We do not use marketing or advertising cookies. We do not buy data from third parties or build profiles about visitors.
Why we use it and the lawful basis
We use the data you provide via the contact form to respond to your enquiry and, if you become a client, to deliver our services. The lawful basis is legitimate interests (responding to your direct request to be contacted) and, if a contract follows, contract performance.
We use analytics data to understand how our site is performing — which pages are useful, where visitors come from, how to improve the site. The lawful basis is consent (you must explicitly accept analytics cookies before any analytics data is collected about you).
Who we share it with
We do not sell your data or share it for marketing.
We do use a small number of third-party services that necessarily process some of your data on our behalf:
- EmailJS — when you submit the contact form, your submission is sent through EmailJS, which forwards it to our inbox. EmailJS is the service provider that processes the form data for transmission. Their privacy policy is available at emailjs.com/legal/privacy-policy.
- Google Analytics 4 — only if you accept analytics cookies. Google's privacy policy is available at policies.google.com/privacy.
- Google Fonts — our site loads typefaces from Google Fonts. When your browser fetches a font file, Google receives your IP address and basic browser information as part of that request. Google states that font requests are not used for advertising and are not linked to a Google account.
- GitHub Pages — our site is hosted on GitHub Pages. GitHub may collect standard web server logs (IP address, browser, page requested) for security and operational purposes. GitHub's privacy statement is available at docs.github.com.
These providers act as data processors. We have no other third parties with access to your personal data.
International transfers
Some of the providers above (notably Google and GitHub) are based in the United States. Where data is transferred outside the UK, it is covered by the UK's adequacy decisions or by the providers' standard contractual clauses for international data transfers.
How long we keep it
We keep contact form submissions for as long as is reasonably necessary to respond to your enquiry and maintain a record of the conversation. If you do not become a client, we will typically delete or anonymise your enquiry within 24 months.
If you become a client, we retain relevant correspondence and records for as long as needed to deliver our services and to meet our legal and tax obligations (typically six years after the end of the engagement, in line with UK accounting requirements).
Google Analytics data is retained for 14 months (the default retention setting we use), after which it is automatically deleted by Google.
Your rights
Under UK GDPR you have the right to:
- Be informed about how your data is used (this policy is part of that)
- Access the personal data we hold about you
- Rectify inaccurate or incomplete data
- Erase your data ("right to be forgotten") where there is no overriding reason to retain it
- Restrict how we process your data in certain circumstances
- Object to processing based on legitimate interests
- Data portability — receive your data in a structured, machine-readable format
- Withdraw consent at any time (for example, by clicking "Cookie Settings" in the footer to change your analytics preference)
- Lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk — we'd appreciate the chance to put things right first, but you don't have to come to us before going to the ICO.
To exercise any of these rights, contact us via the contact form. We will respond within one month.
Security
We take reasonable technical and organisational measures to protect personal data against loss, misuse, and unauthorised access. No system is perfectly secure, but we use providers with strong industry-standard security, transport data over HTTPS, and limit internal access to your data to those who need it to respond to you.
Changes to this policy
If we make material changes to this policy, we will update the "Last updated" date at the top and, where appropriate, draw the change to your attention.
Contact
To exercise your rights, ask a question, or raise a concern about how we handle your data, please get in touch via the contact form.