Privacy Policy
Last updated 29 September 2026
Who we are
Square Owl Ltd ("Square Owl", "we", "us") is the controller of the personal data described in this policy.
- Registered address: Lancaster Buildings, 77 Deansgate, Manchester, M3 2BW
- Company number: 08844016 (registered in England and Wales)
- ICO registration number: ZA840251
- Privacy contact: privacy@squareowl.co.uk
This policy covers people who visit our website or contact us, the staff of our clients, our suppliers and freelancers, and job applicants. When we build or run websites for clients, the client is the controller of its own visitors' data and its own privacy policy applies. We act as its processor under a data processing agreement.
What we collect and why
We collect only what we need to run the business. We do not sell personal data, and we make no automated decisions that have legal or similarly significant effects on you.
| Who | What we collect | Why | Lawful basis |
|---|---|---|---|
| Website visitors | Pages viewed, device and browser type, approximate location, how you found the site | Understand how the site is used and where visitors come from | Consent (via our cookie banner) |
| People who contact us | Name, email, phone, company, job title, your message, the page or campaign that brought you to us | Reply to you, follow up on enquiries, send proposals | Legitimate interests (responding to business enquiries) |
| Clients' staff | Name, work email and phone, job title, messages, meeting notes, files shared on projects | Deliver projects, manage the account, invoice | Contract; legitimate interests |
| Suppliers and freelancers | Name, contact details, company details, bank details, contracts, invoices, time records | Engage and pay you, manage the work | Contract; legal obligation (tax and accounting records) |
| Job applicants | CV, cover letter, contact details, interview notes, references (with your permission) | Assess your application | Legitimate interests; steps before entering a contract |
We do not ask for special category data (such as health information). If you send us any, we will only keep it where we need it and have a lawful reason to.
We may send occasional marketing emails to business contacts about our services. You can opt out at any time using the link in the email or by contacting us.
Who we share data with
We share personal data only with the service providers we need to run the business. Each one acts on our instructions under a written contract that requires it to keep the data secure.
| Purpose | Providers |
|---|---|
| Email, documents and file storage | Google Workspace |
| Team messaging and project management | Slack, Asana |
| Client messaging (where a client chooses it) | |
| Accounting and time tracking | Xero, Harvest |
| Contracts and e-signature | DocuSign, eRegistrations |
| Website hosting | WP Engine, Clook |
| Transactional email from websites | Twilio SendGrid |
| Cookie consent | Cookiebot |
| Website analytics and enquiry attribution | Google Analytics, Attributer |
| Delivery partners | Freelance and agency developers, designers and copywriters working on client projects under contract, confidentiality and data processing terms |
| Professional advisers | Our accountants, lawyers and insurers, where needed |
We may also disclose data where the law requires it, for example to HMRC, or to a buyer if the business is sold. A list of the sub-processors that handle our clients' data is available to clients under our data processing agreement.
International transfers
Some of our providers and delivery partners are based outside the UK, including in the USA, the EU, India and Ukraine. When personal data leaves the UK we use one of these safeguards:
- UK adequacy regulations, for countries the UK has approved (for example, EU countries)
- The UK Extension to the EU-US Data Privacy Framework, for US providers certified under it
- The ICO's International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses, for everyone else
Contact us if you would like more detail on the safeguard used for a particular transfer.
How long we keep data
| Data | How long |
|---|---|
| Financial records (invoices, payments, contracts) | 6 years after the end of the financial year they relate to |
| Client project files and communications | 6 years after the project or contract ends |
| Enquiries that don't become work | 2 years after our last contact |
| Marketing contacts | Until you opt out, or 2 years without any engagement |
| Unsuccessful job applications | 6 months after the role is filled |
| Analytics data | 14 months (the Google Analytics setting) |
| Cookie consent records | 12 months, then you are asked again |
After these periods we delete the data or anonymise it so it no longer identifies you.
Security
We manage information security in line with ISO 27001, the international standard for information security. We protect personal data with access controls, multi-factor authentication, encryption, and confidentiality and data processing agreements with everyone who handles it for us.
Your rights
You have the right to:
- access the personal data we hold about you
- have inaccurate data corrected
- have your data deleted
- restrict or object to how we use it, including objecting to direct marketing at any time
- receive your data in a portable format
- withdraw consent at any time, where we rely on consent
To use any of these rights, email privacy@squareowl.co.uk. We will reply within one month. There is normally no charge.
Complaints
If you are unhappy with how we have handled your data, please contact us first at privacy@squareowl.co.uk so we can try to put it right. You can also complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113.
Changes to this policy
We will update this policy when the way we use personal data changes. The date at the top of this policy shows when it was last updated.
Cookies
We only set non-essential cookies, including analytics and marketing cookies, after you agree to them in our cookie banner. The banner is run by Cookiebot. You can change or withdraw your consent at any time using the link below.
The full, current list of cookies we use, and what each one does, is below. Cookiebot keeps it up to date automatically.