Privacy Policy

1. Who We Are

For the purposes of UK data protection law, we are the data controller for the personal data we collect about you directly (e.g., when you visit our website or enquire about our services).

When you use our CRM platform, you are the data controller for the personal data you store in your account, and we act as your data processor.

2. What Data We Collect

2.1 Website Visitors

When you visit our website, we may collect:

• Technical data: IP address, browser type, device information, pages visited, time spent
• Analytics data: How you found us, what you clicked on, scroll behaviour
• Cookies: See Section 7 for details

2.2 Enquiries and Leads

When you contact us or fill in a form, we collect:

• Name and contact details (email, phone)
• Business name and role
• Details of your enquiry
• Any other information you choose to share

2.3 Clients

When you become a client, we additionally collect:

• Billing information (address, payment details via Stripe)
• Contract and project details
• Communications history
• Platform usage data

2.4 Platform Users

If you use the NotLuck CRM platform, we process:

• Account credentials and login activity
• Platform configuration and settings
• Usage data (features used, actions taken)
• Any data you upload or create within the platform

3. How We Use Your Data

We use your data for the following purposes:

4. Your Data in the CRM Platform

4.1 You Control Your Data

When you use the NotLuck CRM platform, you are the data controller for any personal data you store in your account. This includes your contacts, leads, customers, and any other data you upload or create.

You are responsible for:

• Ensuring you have the right to store and process that data
• Complying with data protection laws in your use of the platform
• Responding to data subject requests from your contacts
• Having appropriate privacy notices for your own customers

4.2 We Act as Your Processor

We process your platform data only to provide and support the service. We will:

• Process data according to your instructions
• Keep your data secure
• Not use your data for our own purposes
• Help you comply with data subject requests where feasible
• Delete or return your data when you close your account

4.3 Account Access by NotLuck

Your NotLuck CRM account is hosted on a secure, enterprise-grade platform. As your service provider, our authorised team members have administrative capability to access your account for the purposes of:

• Setup and configuration
• Technical support and troubleshooting
• Service delivery and optimisation
• Investigating issues you report

By subscribing to the platform, you consent to this access as necessary for service delivery. If you require a record of account access for compliance purposes, please contact us and we will accommodate where reasonably possible.

4.4 Sub-Processors

The NotLuck CRM platform uses the following sub-processors:

These providers have their own privacy policies and data processing agreements. By using features that rely on these services, your data may be processed outside the UK.

5. Data Sharing

We may share your personal data with:

• Service providers: Who help us deliver our services (see sub-processors above)
• Professional advisors: Accountants, lawyers, where necessary
• Legal authorities: If required by law or to protect our rights

We do not share your data with third parties for their marketing purposes.

6. Data Retention

6.1 Website and Marketing Data

6.2 Client Data

6.3 Platform Data

You can request deletion of your data at any time, subject to our legal obligations.

7. Cookies

7.1 What Are Cookies?

Cookies are small text files stored on your device when you visit our website. They help us understand how you use our site and improve your experience.

7.2 Cookies We Use

7.3 Third-Party Services

We use the following third-party services that may set cookies:

• Google Analytics 4: Website analytics. Google Privacy Policy
• LeadConnector (HighLevel): CRM, chat widget, and marketing tracking. HighLevel Privacy Policy

7.4 Managing Cookies

You can control cookies through your browser settings. Blocking essential cookies may affect site functionality.

We use a cookie consent banner on first visit. You can change your preferences at any time by clearing your cookies and revisiting the site.

8. Your Rights

Under UK data protection law, you have the right to:

You can also withdraw consent for marketing at any time.

To exercise any of these rights, email us at hello@notluck.co.uk. We will respond within 30 days.

9. Data Security

We take appropriate technical and organisational measures to protect your data, including:

• Encrypted connections (HTTPS/TLS)
• Secure password policies
• Access controls and authentication
• Regular security reviews
• Staff training on data protection

No system is 100% secure. If you believe your data has been compromised, please contact us immediately.

10. International Transfers

Some of our service providers are based outside the UK (primarily USA). Where we transfer data internationally, we ensure appropriate safeguards are in place, such as:

• Standard Contractual Clauses
• Adequacy decisions
• Binding Corporate Rules

11. Children

Our services are not directed at children under 18. We do not knowingly collect data from children. If you believe we have collected data from a child, please contact us immediately.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by:

• Updating the "Last Updated" date
• Posting a notice on our website
• Emailing clients directly (for material changes)

13. Complaints

If you're unhappy with how we've handled your data, please contact us first at hello@notluck.co.uk. We'll do our best to resolve your concern.

If you're not satisfied with our response, you have the right to complain to the Information Commissioner's Office (ICO):

14. Contact Us

For any questions about this Privacy Policy or your personal data: