Privacy policy

Herdr Ltd ("Herdr", "we", "us") is the controller of the personal data described here. We're a company registered in England and Wales (company number 17314599), with our registered office at 66 Paul Street, London EC2A 4NA. We're registered with the Information Commissioner's Office (ICO), reference ZC199794.

Questions, or want to exercise your rights? Email privacy@herdr.co.

What this policy covers

This policy explains how we handle personal data when you visit herdr.co or get in touch with us.

When we run campaigns for a client and handle that client's own customer data, the client decides how that data is used — so the client is the controller and we act as their processor under a separate agreement. That work is covered by the client's privacy notice, not this one.

The data we collect

When you submit the strategy form, we collect:

• what you give us — your first and last name, work email, website, monthly ad-spend range, what you'd like to achieve (a free-text field), and how you found us;
• what's recorded automatically with your submission — the marketing attribution values in the link you arrived through, the page you landed on and the page that referred you, a timing measurement we use to catch automated spam, a unique reference for the submission, and your browser's user-agent string.

When you use the site, our host records your IP address in server access logs. We keep these for no longer than 14 days, to keep the site secure and available.

Cookies and similar technologies — see Cookies below.

Please don't include sensitive information (such as health, ethnicity, or political views) in the free-text field. We don't ask for it and don't need it.

Why we use it, and our lawful basis

• Responding to and assessing your enquiry, and sending you a confirmation — to handle business enquiries and decide whether we can help. Lawful basis: our legitimate interests in running and growing our business. If you're a sole trader, this is also steps taken at your request before entering a contract.
• Detecting and preventing spam and abuse of the form — to keep the form and our inbox usable. Lawful basis: our legitimate interests in protecting our systems.
• Keeping the website secure and available (server logs)— lawful basis: our legitimate interests in securing our site.
• Measuring site usage and our advertising (cookies) — lawful basis: your consent, which you give or refuse through our cookie banner.
• Counting visits with cookieless analytics (Umami) — we host Umami ourselves; it stores nothing on your device and keeps only aggregate statistics. Lawful basis: our legitimate interests in understanding how the site is used.

Where we rely on legitimate interests, we've weighed our interests against your rights and recorded that assessment. You can object at any time — see Your rights.

Cookies

We only set cookies and similar technologies that aren't strictly necessary after you've agreed through our cookie banner. You can change your choice at any time from cookie settings, or control cookies in your browser.

• Strictly necessary — always on. For example, remembering your light or dark theme preference, which is stored on your device. These don't need consent.
• Analytics — set only with your consent. We use Google Analytics 4 to understand how visitors use the site.
• Advertising — set only with your consent. We use Google Ads, the Meta pixel, and the LinkedIn Insight Tag to measure and retarget our own advertising.

A full list of the cookies we use — with their provider, purpose, and lifespan — is available in our cookie settings.

Separately, we count visits with Umami, an analytics tool we host ourselves on our EU servers. It sets no cookies and stores nothing on your device — which is why the banner doesn't control it — and it keeps only aggregate statistics.

Who we share it with

We share personal data only with the providers that help us run Herdr:

• OVHcloud — hosts this website and the CRM, analytics, and workflow-automation systems we run ourselves, on servers in the EU (Germany), and holds the server access logs;
• Resend — sends our confirmation and internal notification emails;
• Google Workspace — the inbox that receives your enquiry;
• where you've consented, our analytics and advertising providers: Google, Meta, and LinkedIn.

We may also share data with our professional advisers, or where the law requires it. We don't sell your personal data.

Sending data outside the UK

Most of our processing stays in the UK and EU — including our website hosting and CRM with OVHcloud in Germany, which doesn't involve a transfer to the US.

Some providers are based in the United States: Resend (email), Google (our inbox, and — with your consent — analytics and advertising), and Meta and LinkedIn (with your consent). Where data goes to the US, it's protected by the UK Extension to the EU-US Data Privacy Framework (the "UK-US data bridge") where the provider is certified, and otherwise by the ICO's International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

How long we keep it

• Enquiries that don't lead to a working relationship: up to 24 months.
• Enquiries indicating monthly ad spend under $3,000: up to 12 months.
• If you become a client: for as long as we work together, and for 6 years afterwards, to meet our legal, tax, and record-keeping obligations.
• Server-log IP addresses: no more than 14 days.
• Analytics and advertising data: for the retention period set with each provider (our Google Analytics data is kept for 14 months).

Your rights

You have the right to:

• ask for a copy of the personal data we hold about you;
• have inaccurate data corrected, or data erased;
• restrict or object to how we use it — including objecting to processing based on our legitimate interests, and to any direct marketing;
• ask us to transfer certain data to another provider;
• withdraw your cookie consent at any time.

To exercise any of these, email privacy@herdr.co. It's free, and we'll respond within one month.

If you're unhappy with how we've handled your data, please tell us first at privacy@herdr.co — we'll acknowledge your complaint within 30 days. You can also complain to the ICO at ico.org.uk, or by calling 0303 123 1113.

Automated decisions

We don't make decisions with legal or similarly significant effects about you using automated processing alone.

Changes to this policy

We may update this policy from time to time. The date at the top shows when it last changed, and we'll flag any significant changes.

Contact

Herdr Ltd, 66 Paul Street, London EC2A 4NA — privacy@herdr.co.