Privacy Policy – Chameleon Marketing

This policy explains what personal information Chameleon Marketing collects through www.chameleonmarketing.co.uk and our related services, why we collect it, and the choices you have. We handle your information in line with the UK GDPR and the Data Protection Act 2018.

1. Who we are

The data controller is Emma Cosby, trading as Chameleon Marketing, based in Redhill, Surrey. Being the controller means we decide how and why your personal information is used.

•       Email: hello@chameleonmarketing.co.uk

•       Postal address: 31 High Street, Merstham, Redhill, RH1 3BA

This policy covers our website, discovery calls and bookings, our marketing services, the Savvy Chameleon newsletter, and our Facebook and Instagram pages (@thesavvychameleon).

2. What information we collect

We collect only what we need to respond to you, deliver our services and run the business. Depending on how you deal with us, this may include:

•       Contact details: your name, email address, phone number, and business name.

•       Enquiry and booking details: what you tell us through the contact form, by email or when booking a discovery call, including appointment times and notes you choose to share about your business.

•       Client information: where you become a client, project briefs, brand and business information, login or access details you share so we can work on your website or social media accounts, and invoicing details.

•       Order and payment details: if you buy through our website, your order details, billing address and payment confirmation. Card details are handled by our payment provider; we do not see or store full card numbers.

•       Newsletter details: your name and email address, plus whether you opened or clicked emails, if you subscribe to the Savvy Chameleon newsletter.

•       Technical and usage data: your IP address, browser and device type, pages visited, referring site and the time you visited, collected through cookies and similar technologies.

•       Social media interactions: messages, comments and profile information you send us through Facebook or Instagram.

We do not knowingly collect special category data (such as health information). Please do not include it in messages to us.

3. How and why we use your information

UK data protection law requires us to have a lawful basis for each use of your information. The table sets out ours.

What we do Information used Lawful basis

Reply to enquiries and arrange discovery calls Contact and enquiry details Legitimate interests (responding to people who contact us); or steps at your request before a contract

Provide our services to clients and manage the relationship Contact, client and project information Performance of a contract

Take orders and payments, issue invoices Order and payment details Performance of a contract

Keep financial and tax records Invoice and payment records Legal obligation

Send the Savvy Chameleon newsletter Name and email address Consent

Send occasional service updates to existing clients about similar services Contact details Legitimate interest (with a right to opt out at any time)

Understand how the website is used and improve it Technical and usage data Consent (for non-essential cookies); legitimate interests (for essential operation and security)

Keep the website secure and prevent fraud Technical data Legitimate interests

Defend or establish legal claims Any relevant information Legitimate interests / legal obligation

We do not use your information for automated decision-making or profiling that has legal or similarly significant effects on you, and we do not sell your personal information.

4. Email newsletter and marketing

We only send you marketing emails if you have asked for them by subscribing to the Savvy Chameleon newsletter, or if you are an existing client and we are promoting similar services (in which case you can opt out at any time).

You can unsubscribe at any time by clicking the unsubscribe link at the bottom of any newsletter, or by emailing hello@chameleonmarketing.co.uk. We will stop sending marketing emails promptly, although we may keep a record of your email address so we do not contact you again.

Newsletter sign-ups are processed by Brevo, our email marketing provider (see section 6).

5. Cookies and website analytics

Our website uses cookies, which are small files stored on your device. Essential cookies make the site and shopping cart work and keep it secure. With your consent, we also use analytics cookies to see how visitors use the site so we can improve it.

Our website is built on Squarespace, which sets its own cookies and collects usage data to deliver and analyse the site. Squarespace explains these in its own cookie and privacy information.

You can accept or decline non-essential cookies using the cookie banner on our site, and you can change your mind at any time. You can also block or delete cookies in your browser settings, but parts of the website may not work properly if you block essential cookies.

6. Who we share your information with

We do not sell your information. We share it only with trusted providers who help us run the business, and only as far as needed for them to do their job:

•       Squarespace: hosts our website, contact forms, online booking and shopping cart.

•       Brevo: manages our newsletter sign-ups and sends our emails.

•       Stripe: process payments for orders made through the website.

•       Google Workspace - Email, calendar and video call tools: used to communicate with you and hold calls.

•       Meta (Facebook and Instagram): if you interact with us on those platforms, Meta handles that data under its own privacy policy.

•       Professional advisers and authorities: our accountant, insurers or legal advisers, or the police, HMRC or other authorities where the law requires it.

These providers act on our instructions or under their own data protection obligations. If our business is ever sold or reorganised, your information may be transferred to the new owner, who must continue to protect it under this policy.

7. International transfers

Some of our providers, such as Squarespace and Meta, are based in or use servers in the United States or elsewhere outside the UK. Where your information is transferred abroad, we rely on safeguards recognised under UK law, such as the UK adequacy regulations (including the UK–US data bridge for certified US companies), or the UK International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses. You can contact us for more information about these safeguards.

8. How long we keep your information

We keep personal information only as long as we need it for the purposes above, then delete or anonymise it.

Enquiries that do not lead to work - up to 12 months from our last contact

Clinet records and project files - For the length of engagement, then up to 5 years afterwards

Invoices and accounting records - 6 years from end of financcial year, as required for tax purposes

Newsletter subscriptions - Until you unsubscribe or withdraw consent

Website analytics data - Up to 26 months, as set out by analytics provider

9. Security

We take reasonable steps to protect your information, including using reputable, secure platforms, strong passwords, two-factor authentication where available, and limiting access to those who need it. No online system is completely secure, so we cannot guarantee absolute security. If a data breach is likely to put your rights at risk, we will tell you and the Information Commissioner's Office (ICO) as the law requires.

10. Your rights

Under UK data protection law you have the right to:

•       Be informed about how we use your information (this policy).

•       Access a copy of the personal information we hold about you.

•       Rectification: ask us to correct information that is inaccurate or incomplete.

•       Erasure: ask us to delete your information in certain circumstances.

•       Restrict processing in certain circumstances.

•       Data portability: receive your information in a portable format where we process it by consent or contract.

•       Object to processing based on legitimate interests, and to direct marketing at any time.

•       Withdraw consent at any time where we rely on it, without affecting earlier processing.

•       Challenge automated decisions (we do not make any that significantly affect you).

To use any of these rights, email hello@chameleonmarketing.co.uk. We may need to confirm your identity first. We will normally reply within one month, and we do not charge a fee unless a request is clearly unfounded or excessive.

11. Complaints

We would like the chance to put things right first, so please contact us if you have a concern. You also have the right to complain to the UK data protection regulator, the Information Commissioner's Office (ICO), at ico.org.uk or on 0303 123 1113.

12. Children, other websites and changes to this policy

Children. Our services are aimed at business owners, not children, and we do not knowingly collect information from anyone under 13. If you believe a child has given us their information, please contact us and we will delete it.

Other websites. Our site links to other websites, including Facebook, Instagram and Squarespace. We are not responsible for their privacy practices, so please read their policies.

Changes. We may update this policy from time to time. The latest version will always be on this page, with the date it was last updated. Last updated: 29 October 2026.

13. Contact us

For any question about this policy or how we use your information, contact:

Chameleon Marketing Email: hello@chameleonmarketing.co.uk Post: 31 High Street, Merstham, Redhill, RH1 3BA