Privacy policy

Who we are

AIORCA LTD is a digital transformation agency registered in Scotland, company number SC884036. We are the data controller for the information described here. Contact us at euan@aiorca.co.uk.

What we collect, and why

What	When	Why
Name, business name, email address, website address, social handle	When you submit an enquiry or request a free website	To reply to you and to carry out the work you asked for
Anything you tell us in the message field, by email or on WhatsApp	When you send it	To answer you
Payment details	When you pay	Handled entirely by Stripe — we never see or store your card number
Usage data: pages viewed, approximate location, device and browser	Whenever you visit the site	To understand what people find useful

We do not buy personal data, and we do not sell or rent yours to anyone.

Our legal bases

Contract — to quote for and deliver work you have asked us to do.
Legitimate interests — to reply to enquiries, keep records of what we agreed, and keep our own systems secure.
Consent — for analytics cookies and for any marketing email. You can withdraw consent at any time.
Legal obligation — to keep accounting records.

If we emailed you first

We contact some small businesses who have not contacted us. If that is how you got here, this is exactly where your details came from and what to do about it.

Where we got them — your public Google Business Profile, and the contact details published on your own website. Nothing was bought, and nothing came from a list broker.
What we hold — your business name, website address, a business email address, the town you work in, and notes from a technical check of your public website.
Why we are allowed to — legitimate interests: offering a relevant service to a business whose published website has a fault we can evidence. We balance that against your interests, and we stop the moment you tell us to.
How to stop it — reply to the email with anything at all telling us to stop, or write to euan@aiorca.co.uk. We remove you within two working days and keep only a record of the removal itself, so you are not contacted again by mistake.
How long — if you do not reply, we delete the record within 12 months.

You have the same rights over this information as anyone else described in this policy, including the right to object to it being used at all. See Your rights below.

Who else processes it

We keep the list of suppliers short on purpose. Each of these processes data on our instructions:

Make.com — routes form submissions to us and stores the enquiry record.
Fastmail — our email.
Instantly — sends and tracks our business-to-business outreach email, and records replies and opt-outs.
Stripe — payments. Stripe is the controller of your payment data; see their own privacy notice.
Mailchimp — email lists, where you have opted in.
Google Analytics — website usage measurement.
Hosting — our own server, located in the EU.

Some of these are based outside the UK. Where that is the case, transfers are covered by the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

Automated tools and AI

We use AI tools to help draft and analyse work. Where a deliverable to you is drafted with AI assistance, a person reviews it before it reaches you — no output is sent to a client unread. We do not put client personal data into public AI chat tools, and we do not use your data to train anyone's model.

How long we keep it

Enquiries that do not become work — up to 12 months, then deleted.
Client records and anything needed for accounts — 6 years after the end of the relationship, as UK tax law requires.
Marketing list entries — until you unsubscribe.

Visit counting (Google Analytics)

If you press Accept on the cookie message, this site uses Google Analytics (property G-B86GDX3XVP) to count visits: which pages are viewed, roughly where visitors come from (town level, not your address), what device is used, and whether buttons such as "call" or "send enquiry" are pressed. It sets cookies whose names start with _ga, which last up to 13 months.

If you press No thanks, or don't choose, nothing is loaded and no analytics cookies are set. We never use this data for advertising and we don't sell or share it with anyone other than Google, who processes it for us. Google may process it outside the UK under its standard contractual safeguards.

You can change your mind at any time with the link at the bottom of every page. Choosing "No thanks" there removes the cookies.

Lawful basis: your consent (UK GDPR Article 6(1)(a); PECR regulation 6).

Your rights

You can ask us to give you a copy of your data, correct it, delete it, restrict what we do with it, or object to us using it. You can also ask for it in a portable format. Email euan@aiorca.co.uk and we will respond within one month.

If you are unhappy with how we handled your data

Tell us first — email euan@aiorca.co.uk with "Data complaint" in the subject line. We will acknowledge within 5 working days and give you a substantive response within 30 days.

You also have the right to complain directly to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113. You do not have to come to us first.