Privacy Notice

1. Who we are (Data Controller)

GSC Strategies Limited is the data controller responsible for your personal data.

2. Personal data we collect

Information you give us

• Contact form: name, email, phone (optional), message content.
• Newsletter: email address.
• Resource downloads: first name, last name, email, phone, company name.
• Discovery call bookings: name, email, phone and any details you submit via our LeadConnector booking widget.
• Coaching engagements: business and contact details necessary to deliver the service.

Information collected automatically

• IP address, browser type and version, device and operating system.
• Pages visited, referrer URL, date and time of access.
• Cookies and similar technologies (see our Cookie Policy).

We do not knowingly collect special category data (e.g. health, racial or ethnic origin) and ask that you do not submit it via our forms.

3. How we use your data and our lawful basis

Under UK GDPR we must have a lawful basis for processing your personal data. The table below sets out, for each activity, the data we use, why we use it, and our lawful basis.

• Responding to enquiries (contact form, email, phone): name, contact details, message — to reply to and manage your request.Lawful basis: legitimate interests (responding to people who contact us) and, where you are an existing customer, performance of a contract.
• Sending our newsletter: email address — to send business growth tips, articles and occasional service updates.Lawful basis: consent. You can withdraw at any time using the unsubscribe link in any email or by contacting us.
• Resource downloads & lead nurture: name, email, phone, company name — to deliver the requested resource and send related follow-up information about our coaching services.Lawful basis: consent (delivery of the resource and follow-up marketing) and our legitimate interest in promoting our services. You can opt out at any time.
• Discovery call bookings: name, email, phone, scheduling details — to confirm and manage the meeting.Lawful basis: steps taken at your request prior to entering a contract.
• Spam, fraud and security protection (reCAPTCHA, server logs): IP address, device data, captcha tokens — to keep the site secure and prevent abuse of our forms.Lawful basis: legitimate interests (security of our website and users).
• Website analytics & performance (only with your consent): aggregated usage data via cookies — to improve content and user experience.Lawful basis: consent (managed via our cookie banner).
• Marketing measurement (Meta Pixel, only with your consent): pseudonymous identifiers — to measure ad campaign effectiveness.Lawful basis: consent (managed via our cookie banner).
• Legal & accounting obligations: contact and transaction data — to comply with tax, accounting and other statutory requirements.Lawful basis: legal obligation.

4. How long we keep your data

We only keep personal data for as long as is necessary for the purpose for which it was collected, after which it is securely deleted or anonymised.

• Contact enquiries: up to 24 months after the last meaningful contact, unless a coaching relationship begins.
• Newsletter subscribers: until you unsubscribe; then removed within 30 days from active mailing systems.
• Resource download leads: up to 24 months from download, unless you opt out earlier.
• Discovery call bookings: up to 12 months if no engagement follows.
• Coaching client records: for the duration of the engagement and 6 years afterwards (to comply with HMRC and contractual record-keeping requirements).
• Server & security logs: typically 30–90 days.
• Cookie consent records: 12 months, then re-confirmed.

5. Who we share your data with

We do not sell, rent or trade your personal data. We share it only with carefully selected processors that help us run our business, and only to the extent necessary:

• Resend (email delivery) — sends contact-form notifications and transactional emails. Hosted in the EU/US.
• Neon (database hosting) — stores form submissions, newsletter sign-ups and articles. Hosted in the EU/US.
• Google reCAPTCHA — protects forms against bots. Hosted by Google LLC (US/EU).
• LeadConnector (HighLevel) — powers our discovery call bookings and lead nurture workflows. Hosted in the US.
• Meta Platforms Ireland Ltd. (Meta Pixel) — measures advertising performance. Loaded only with your marketing-cookie consent.
• Search engines (Bing, Yandex and others) via the IndexNow protocol — receive notifications of new or updated public URLs only (no personal data).
• Professional advisers, accountants and authorities — where required to comply with our legal obligations or to establish, exercise or defend legal claims.

All processors are bound by written contracts and data-processing terms requiring appropriate technical and organisational security measures.

6. International data transfers

Some of our processors are based outside the United Kingdom, including in the United States. Where personal data is transferred outside the UK, we rely on one of the following safeguards recognised under UK GDPR:

• UK adequacy regulations (e.g. for transfers to the EEA);
• The UK International Data Transfer Agreement (IDTA) or the EU Standard Contractual Clauses with the UK Addendum; or
• The UK Extension to the EU–US Data Privacy Framework, where the recipient is certified.

You can request a copy of the relevant safeguards by contacting us at info@gscstrategies.com.

7. Your rights under UK GDPR

You have the following rights regarding your personal data:

• Right of access — to a copy of the personal data we hold about you.
• Right to rectification — to have inaccurate or incomplete data corrected.
• Right to erasure ("right to be forgotten") — subject to certain legal exceptions.
• Right to restrict processing in certain circumstances.
• Right to data portability — to receive data you have provided in a structured, machine-readable format.
• Right to object — including to direct marketing and to processing based on legitimate interests.
• Right to withdraw consent at any time, where we rely on consent.
• Right not to be subject to automated decision-making producing legal or similarly significant effects.

To exercise any of these rights, email info@gscstrategies.com. We will respond within one month (this can be extended by a further two months for complex requests, in which case we will tell you why). There is normally no fee.

8. Cookies and similar technologies

We use a small number of essential cookies to make the site work, and — only with your consent — analytics and marketing cookies. You can change your choices at any time via the "Cookie Settings" link in the footer. Full details, including cookie names, providers and durations, are in our Cookie Policy.

9. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure or destruction. These include TLS encryption in transit, access controls, logging, vetted hosting providers and regular review of our processors. No method of transmission over the internet is 100% secure, however, and we cannot guarantee absolute security.

10. Third-party links

Our site may link to other websites (for example our LinkedIn, Facebook, Instagram and X profiles, our Finance Services site, and the LeadConnector booking widget). We are not responsible for their privacy practices. Please review their privacy notices before submitting any personal data.

11. Children

Our services are aimed at business owners and are not directed at children under 18. We do not knowingly collect personal data from children. If you believe we have done so, please contact us and we will delete it.

12. Changes to this notice

We may update this privacy notice from time to time. The "Last updated" date at the top will reflect any changes. Material changes will be notified more prominently (for example via the homepage or by email to newsletter subscribers).

13. Complaints to the ICO

We hope to resolve any concerns you raise with us, but you also have the right to lodge a complaint with the UK supervisory authority: