Privacy Policy
1. Who we are
Bolotin Ltd, trading as Get More Stars, is responsible for the personal data described in this policy, except where we say otherwise in section 4.
- Registered office: 167–169 Great Portland Street, 5th Floor, London, W1W 5PF, United Kingdom
- Company number: 17405583 (registered in England and Wales)
- Website: https://getmorestars.co.uk
- Email: [email protected]
- ICO registration number: ZC234151
We are a small business and are not required to appoint a Data Protection Officer. Please send any privacy questions to [email protected].
This policy explains how we handle personal data when you visit our website, enquire about our services, become a client, or otherwise deal with us. It is written to meet our obligations under the UK GDPR and the Data Protection Act 2018.
2. The short version
- We handle data about website visitors, people who enquire, our clients and their staff — and, on our clients' behalf, their own customers.
- We do not sell personal data, and we never will.
- We do not share personal data with data brokers or advertising networks.
- Some of our suppliers are based outside the UK. Where that happens, we use the safeguards described in section 7.
- You have rights over your data, set out in section 9, including the right to complain to the ICO.
3. What we collect
Website visitors
If you fill in a form on our site, we collect the information you give us: your name, email address, phone number if you provide one, and the content of your message. Our website also records basic technical information such as your IP address and browser type, which is generated automatically when any website is visited.
Enquirers and prospective clients
If you contact us, or we contact you about our services, we hold your name, business name, contact details, and a record of our correspondence.
We sometimes identify businesses that might benefit from our services using information published on public Google Business Profile listings and business websites — for example, a business name, trading address, phone number and public review count. This is business contact information that the business has chosen to publish.
Clients
If you become a client, we hold your business details, the contact details of the people we deal with, records of the services we provide, correspondence, and billing information. Card details are handled by Stripe and are not stored by us.
Our clients' customers
When we run review request campaigns, we handle contact details of our clients' own customers — typically a name, a mobile number and/or an email address, and sometimes a job reference or completion date. We handle this data on our client's instructions. Section 4 explains what that means for you.
4. When we are not the responsible party
The law distinguishes between the organisation that decides how and why personal data is used (the "controller") and an organisation that only handles it on someone else's instructions (the "processor").
We are the controller for data about website visitors, enquirers, our clients, and our clients' staff.
We are a processor for the customer contact data our clients give us so we can send review requests on their behalf. In that situation the client is the controller: it is their decision to run the campaign, their customer relationship, and their responsibility to have a lawful basis for contacting those customers. We act only on their documented instructions, under a written data processing agreement.
If you have received a review request from a business we work with and you want your data deleted or corrected, you can contact that business directly, or you can contact us at [email protected] and we will pass your request to them promptly and help them action it.
5. Why we use it, and our lawful basis
| What we do | Lawful basis |
|---|---|
| Responding to your enquiry | Legitimate interests — replying to someone who has contacted us |
| Providing our services to clients | Performance of a contract |
| Billing, accounting and record keeping | Legal obligation, and legitimate interests in running the business |
| Contacting businesses about our services | Legitimate interests — B2B marketing to relevant businesses. You can opt out at any time |
| Sending marketing messages where consent is required | Consent, which you may withdraw at any time |
| Keeping our site and systems secure | Legitimate interests in protecting our business and our clients |
| Dealing with legal claims or regulatory requests | Legal obligation, and legitimate interests in establishing or defending claims |
Where we rely on legitimate interests, we have considered whether our interest is outweighed by your rights and freedoms. You can ask us for details of that assessment.
6. Who we share it with
We use a small number of suppliers to run the service. They act on our instructions and are not permitted to use your data for their own purposes.
| Supplier | What they do | Where |
|---|---|---|
| HighLevel Inc. (GoHighLevel) | CRM, campaign delivery, website and data hosting | United States |
| LeadConnector / Twilio Inc. | SMS delivery | United States |
| Sinch (Mailgun) | Email delivery | United States / EU |
| Google LLC / Google Ireland Ltd | Business Profile integration and business email | United States / Ireland |
| Stripe, Inc. / Stripe Payments Europe Ltd | Payment processing (client billing only) | United States / Ireland |
We may also share data with our professional advisers, or with a regulator, law enforcement or a court where we are legally required to. If our business is sold or transferred, data may pass to the buyer, who would remain bound by this policy.
We do not sell personal data, and we do not share it with advertising networks or data brokers.
7. Sending data outside the UK
Some of the suppliers listed above are based in the United States. When personal data is transferred there, we rely on the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, as incorporated into our contracts with those suppliers. You can ask us for more detail about the safeguards that apply.
8. How long we keep it
| Data | Retention |
|---|---|
| Enquiries that don't become clients | 12 months from last contact |
| Client records and correspondence | 6 years after the engagement ends |
| Accounting and tax records | 6 years, as required by law |
| Client customer contact data (where we are a processor) | Deleted or returned within 30 days of the engagement ending, or sooner if the client asks |
Copies may remain in routine backups for a limited period after deletion, until those backups are overwritten.
9. Your rights
Under the UK GDPR you have the right to:
- ask for a copy of the personal data we hold about you;
- ask us to correct data that is wrong or incomplete;
- ask us to delete data, in certain circumstances;
- ask us to restrict how we use your data, in certain circumstances;
- object to us using your data where we rely on legitimate interests;
- object to direct marketing at any time, with no exceptions;
- ask us to transfer your data to you or another organisation, where it is held electronically and processed on the basis of consent or a contract; and
- withdraw consent at any time, where we rely on it.
To exercise any of these, email [email protected]. We will respond within one month. There is no charge.
If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk, or by calling 0303 123 1113. We would appreciate the chance to address your concern first.
10. Cookies
Cookies are small files stored on your device when you visit a website. Our site uses two kinds.
Essential cookies are needed to make the site and its forms work — for example, to maintain your session, to keep forms secure, and to remember your cookie preferences. These are set automatically and do not require your consent.
Analytics cookies help us understand how many people visit the site and which pages they use, so we can improve it. We use Google Analytics for this. These cookies are only set if you accept them.
When you first visit our site, you will see a banner asking you to choose. Selecting "Accept all" allows analytics cookies; selecting "Accept essential" means only the necessary ones are set. Nothing non-essential loads before you choose. You can change your mind at any time by clearing your cookies and reloading the site.
You can also block or delete cookies through your browser settings, though parts of the site may then not work correctly.
Google Analytics is provided by Google. Data collected through it may be transferred outside the UK, subject to the safeguards described in section 7.
11. Security
We use access controls, strong authentication and encrypted connections to protect personal data, and we limit access to the people who need it. No system is completely secure, but we take our obligations seriously and will notify you and the ICO where we are legally required to do so following a breach.
12. Children
Our services are provided to businesses, and are not directed at children. We do not knowingly collect data about anyone under 18.
13. Changes to this policy
We may update this policy from time to time. The date at the top shows when it was last changed. If we make a significant change, we will tell our clients directly.
14. Contact us
Bolotin Ltd, trading as Get More Stars
167–169 Great Portland Street, 5th Floor, London, W1W 5PF
Email: [email protected]
Registered in England and Wales, company number 17405583
Menu
Links
© Get More Stars, a trading name of Bolotin Ltd
Company Number: 17405583
167-169 Great Portland Street, 5th Floor, London, W1W 5PF