What we hold, why we hold it, and how to make us stop.

Finlayson is a trading name of Web Pebble Ltd, registered in England and Wales, company number 07926157. Registered office: 26 Hertingfordbury Road, Hertford, SG14 1JX. We are the data controller for personal data collected through this website and through our own business contact.

If you run an audit, we record the domain you entered and the results produced. A domain is not personal data, but if you supply an email address to receive a report, that is.

If you contact us, we hold the message and the address you sent it from, so that we can reply and keep a record of the conversation.

For business-to-business contact, we may hold a name, job title, employer, business email address and business social profile, obtained from public sources or professional networks.

Where you contact us or ask for a report, we process your data to respond to you, which is necessary for steps taken at your request before entering a contract.

Where we contact people at businesses about services relevant to their professional role, we rely on legitimate interests. A summary of that assessment is below.

We do not sell personal data, and we do not use it for automated decision-making.

Purpose. We contact people in marketing, growth or finance roles at businesses about whether AI answer engines recommend their company. This is a genuine commercial interest and a live issue for those roles.

Necessity. Direct contact with the individual responsible is the only practical way to raise a finding that is specific to their organisation. General advertising cannot deliver a domain-specific result.

Balance. We contact people in a professional capacity at business addresses, about their own area of responsibility, in low volume, with a clear identification of who we are and an unconditional opt-out in every message. We do not contact private individuals, we do not use consumer data, and we stop on request without asking why.

Under UK PECR, business-to-business electronic marketing to corporate subscribers is permitted on this basis. Our full assessment is documented internally and is available to the ICO on request.

Reply to any message and say so, or write to us at the address below. We will stop, and we will keep the minimum record needed to make sure we do not contact you again. That suppression record is the only thing we retain about you afterwards.

Audit results are kept against the domain and the date, so a repeat request can be served without re-running. Correspondence is kept for as long as the business relationship and our record-keeping obligations require. Contact data for people who have opted out is reduced to a suppression record.

You can ask us to delete a domain's stored audits, or your personal data, at any time.

You have the right to access the personal data we hold about you, to have it corrected or erased, to restrict or object to how we use it, and to receive it in a portable form. To exercise any of these, write to us.

If you are not satisfied with how we respond, you can complain to the Information Commissioner's Office.

ico.org.uk

This site sets no advertising cookies and does not track you across other websites. Fonts are self-hosted, so loading a page does not tell a third party that you visited.