Vouch Digital
Privacy Policy
Vouch Digital, a trading name of Bolotin Ltd. Last updated: 10 November 2026
1. Who we are
Bolotin Ltd, trading as Vouch Digital, is responsible for the personal data described in this policy, except where we say otherwise in section 4.
- Registered office: 167-169 Great Portland Street, 5th Floor, London, W1W 5PF, United Kingdom
- Company number: 17405583 (registered in England and Wales)
- Website: https://vouchdigital.co.uk
- Privacy contact: privacy@vouchdigital.co.uk
- ICO registration number: ZC234151
We are a small business and are not required to appoint a Data Protection Officer. Please send any privacy questions to privacy@vouchdigital.co.uk.
This policy explains how we handle personal data when you visit our website, use our free online audit, enquire about our services, become a client, or otherwise deal with us. It is written to meet our obligations under the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations.
2. The short version
- We handle data about website visitors, people who enquire or use our free audit, our clients and their staff, and, on our clients' behalf, their own customers.
- We do not sell personal data, and we never will.
- We do not share personal data with data brokers or advertising networks.
- Some of our suppliers are based outside the UK. Where that happens, we use the safeguards described in section 7.
- You have rights over your data, set out in section 9, including the right to complain to the ICO.
3. What we collect
Website visitors
If you fill in a form on our website, we collect the information you give us: your name, your business name, your phone number, your email address, the type of work you mainly do (domestic or commercial), and, if you add one, your message. If you press play on a video on our website, it loads from the video's host (such as YouTube), which may set its own cookies; nothing loads from that host until you press play. Our website also records basic technical information, such as your IP address and browser type, which is generated automatically when any website is visited. If you accept cookies, the Meta pixel also records which pages you visit, whether you send an enquiry and whether you book a call (see section 10).
People who use our free online audit
If you run our free online audit, we collect the details you enter (your name, email address, phone number, business name and the search terms you choose) and the audit results, which are built from public information about your business, such as your Google Business Profile, your reviews, your website and your search rankings. If you tick the box to receive text messages, we also record that consent.
Enquirers and prospective clients
If you contact us, or we contact you about our services, we hold your name, business name, contact details and a record of our correspondence and calls.
We sometimes identify businesses that might benefit from our services using information published on public Google Business Profile listings and business websites, for example a business name, trading area, phone number, website and public review count. This is business contact information that the business has chosen to publish. We may use a research tool to collect this public information.
Clients
If you become a client, we hold your business details, the contact details of the people we deal with, records of the services we provide, correspondence and billing information. Card details are handled by Stripe and are not stored by us.
To deliver our services we may also be given manager access to your Google Business Profile, and we use your business details (such as your business name, address or service area, phone number, website, opening hours and photos) to manage your profile, build your website and create or update your listings on directories such as Bing Places, Apple Business Connect, Yell and Checkatrade.
Our clients' customers
When we run review request campaigns, we handle contact details of our clients' own customers, typically a name, a mobile number and/or an email address, and sometimes a job reference or completion date. These may come from a list the client gives us or, where the client asks us to set it up, from a connection to the client's job or invoicing software. We handle this data on our client's instructions. Section 4 explains what that means for you.
4. When we are not the responsible party
The law distinguishes between the organisation that decides how and why personal data is used (the "controller") and an organisation that only handles it on someone else's instructions (the "processor").
We are the controller for data about website visitors, people who use our free audit, enquirers, our clients and our clients' staff.
We are a processor for the customer contact data our clients give us, or ask us to collect from their own systems, so we can send review requests on their behalf. In that situation the client is the controller: it is their decision to run the campaign, their customer relationship, and their responsibility to have a lawful basis for contacting those customers. We act only on their documented instructions, under a written data processing agreement.
If you have received a review request from a business we work with and you want your data deleted or corrected, you can contact that business directly, or you can contact us at privacy@vouchdigital.co.uk and we will pass your request to them promptly and help them action it.
5. Why we use it, and our lawful basis
| What we do | Lawful basis |
|---|---|
| Responding to your enquiry | Legitimate interests: replying to someone who has contacted us |
| Running a free audit you have requested and following up about it | Legitimate interests: providing the audit you asked for and discussing the results with you |
| Providing our services to clients | Performance of a contract |
| Billing, accounting and record keeping | Legal obligation, and legitimate interests in running the business |
| Contacting businesses about our services | Legitimate interests: business-to-business marketing to relevant businesses. You can opt out at any time |
| Sending marketing messages where consent is required | Consent, which you may withdraw at any time |
| Measuring how our Facebook and Instagram adverts perform, and showing our adverts to people who have visited our website (Meta pixel), only if you accept cookies | Consent, which you can withdraw at any time using "Cookie settings" at the bottom of any page |
| Counting visits to our website and seeing which pages are useful (Ahrefs Web Analytics), only if you accept cookies | Consent, which you can withdraw at any time using "Cookie settings" at the bottom of any page |
| Keeping our website and systems secure | Legitimate interests in protecting our business and our clients |
| Dealing with legal claims or regulatory requests | Legal obligation, and legitimate interests in establishing or defending claims |
Where we rely on legitimate interests, we have considered whether our interest is outweighed by your rights and freedoms. You can ask us for details of that assessment.
6. Who we share it with
We use a small number of suppliers to run the service. They act on our instructions and are not permitted to use your data for their own purposes.
| Supplier | What they do | Where |
|---|---|---|
| HighLevel Inc. (including LeadConnector) | CRM, booking calendar, receiving website form enquiries, and campaign delivery | United States |
| Cloudflare, Inc. | Website hosting, security and form handling | United States / global |
| Merchynt, Inc. (Paige) | Our free online audit tool and Google Business Profile reporting | United States |
| Twilio Inc. | SMS delivery | United States |
| Sinch (Mailgun) | Email delivery | United States / EU |
| Google LLC / Google Ireland Ltd | Business email and Google Business Profile management | United States / Ireland |
| Zapier, Inc. | Connecting clients' job or invoicing software to our CRM, where the client asks us to | United States |
| Outscraper | Collecting public business listing information for prospect research | United States |
| Stripe, Inc. / Stripe Payments Europe Ltd | Payment processing (client billing only) | United States / Ireland |
| Ahrefs Pte. Ltd. | Website analytics (visit counts), only if you accept cookies | Singapore |
When we create or update a client's listings, we submit that client's business details to the directories concerned (such as Bing Places, Apple Business Connect, Yell and Checkatrade), where they are published at the client's request.
We may also share data with our professional advisers, or with a regulator, law enforcement or a court where we are legally required to. If our business is sold or transferred, data may pass to the buyer, who would remain bound by this policy.
If you accept cookies on our website, Meta Platforms Ireland Ltd receives information about your visit through the Meta pixel (see section 10). For that data, Meta is not acting only on our instructions: it is jointly responsible with us for collecting it and sending it to Meta, and Meta alone decides how it is used after that, as described in Meta's privacy policy.
We do not sell personal data or share it with data brokers, and the only advertising network that receives data from our website is Meta, and only if you accept cookies.
7. Sending data outside the UK
Some of the suppliers listed above are based in the United States. When personal data is transferred there, we rely on the UK Extension to the EU-US Data Privacy Framework where the supplier is certified, or on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, as incorporated into our contracts with those suppliers. You can ask us for more detail about the safeguards that apply. Meta may transfer the data it receives through the Meta pixel to the United States; its privacy policy explains the safeguards it uses.
8. How long we keep it
| Data | Retention |
|---|---|
| Website form submissions, audit requests and enquiries that don't become clients | 12 months from last contact |
| Client records and correspondence | 6 years after the engagement ends |
| Accounting and tax records | 6 years, as required by law |
| Client customer contact data (where we are a processor) | Deleted or returned within 30 days of the engagement ending, or sooner if the client asks |
Copies may remain in routine backups for a limited period after deletion, until those backups are overwritten.
9. Your rights
Under the UK GDPR you have the right to:
- ask for a copy of the personal data we hold about you;
- ask us to correct data that is wrong or incomplete;
- ask us to delete data, in certain circumstances;
- ask us to restrict how we use your data, in certain circumstances;
- object to us using your data where we rely on legitimate interests;
- object to direct marketing at any time, with no exceptions;
- ask us to transfer your data to you or another organisation, where it is held electronically and processed on the basis of consent or a contract; and
- withdraw consent at any time, where we rely on it.
To exercise any of these, email privacy@vouchdigital.co.uk. We will respond within one month. There is no charge.
If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk or by calling 0303 123 1113. We would appreciate the chance to address your concern first.
10. Cookies
Cookies are small files stored on your device when you visit a website.
Strictly necessary cookies
Some cookies are needed for our website to work, for example to keep our forms and booking calendar secure and working properly. These do not require your consent. Our booking calendar is provided by our CRM supplier, HighLevel, and our free online audit is provided by Merchynt; both may set strictly necessary cookies of their own. Our website loads its fonts from Google Fonts, which means your browser connects to Google's servers.
Advertising cookies (Meta pixel), only with your consent
With your permission, we use the Meta pixel, a tool from Meta (the company behind Facebook and Instagram). It sets cookies (such as _fbp) and tells Meta which pages of our website you visit, whether you send us an enquiry and whether you book a call with us. We use this to see which of our adverts lead to enquiries and booked calls, and to show our adverts to people who have visited our website. Meta may link this to your Facebook or Instagram account if you have one.
The Meta pixel stays switched off until you click "Accept" on our cookie banner: until then it sets no cookies and sends no information about your visit to Meta (your browser still downloads the pixel's code from Meta's servers when a page loads, as it would any other file our website uses). If you click "Reject", or make no choice, it stays off. We remember your choice on your device. You can change your mind at any time using "Cookie settings" at the bottom of any page; if you withdraw consent, we stop the pixel and delete its cookies from our website. You can also control how Meta uses data for adverts in your Facebook or Instagram ad settings.
Website analytics (Ahrefs), only with your consent
If you click "Accept", we also switch on Ahrefs Web Analytics, which counts visits to our website and shows us which pages people find useful. It does not set cookies and does not identify you; your browser sends Ahrefs your IP address and basic details about the page you are viewing, which Ahrefs uses to give us totals only. If you click "Reject", or make no choice, it stays off.
We do not use analytics cookies. If we introduce any other non-essential cookies in future, we will ask for your permission first and update this policy.
You can also block or delete cookies through your browser settings, though parts of the website may then not work correctly.
11. Security
We use access controls, strong authentication and encrypted connections to protect personal data, and we limit access to the people who need it. No system is completely secure, but we take our obligations seriously and will notify you and the ICO where we are legally required to do so following a breach.
12. Children
Our services are provided to businesses and are not directed at children. We do not knowingly collect data about anyone under 18.
13. Changes to this policy
We may update this policy from time to time. The date at the top shows when it was last changed. If we make a significant change, we will tell our clients directly.
14. Contact us
Bolotin Ltd, trading as Vouch Digital
167-169 Great Portland Street, 5th Floor, London, W1W 5PF
Privacy requests: privacy@vouchdigital.co.uk
Registered in England and Wales, company number 17405583
ICO registration number ZC234151
View our Terms or contact us with any questions.