Legal
Privacy notice
Last updated: October 13, 2026
This notice explains how Scaleiko collects and uses personal information when you visit this website or ask to book a strategy call. It is written to meet the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Who we are
The data controller is Scaleiko, founded by Harrison Grace. Full company details (registered name, number and office) will be published here shortly.
To contact us about your data, use the booking form on our home page and say it is a privacy request.
What we collect
- Booking form: your name, work email, store URL, annual revenue band and email platform.
- Scheduling: if you book a time, the calendar provider collects the details you enter there (such as the time you choose and any notes) and shares them with us.
- Technical data: your IP address and browser details, used for spam protection, rate limiting and security logs.
We do not ask for special category data. Please do not include any in free-text fields.
Why we use it, and our lawful basis
| Purpose | Lawful basis (UK GDPR Art. 6) |
|---|---|
| Responding to your enquiry and arranging your strategy call | Steps you ask us to take before entering into a contract (Art. 6(1)(b)) |
| Preparing for the call, for example reviewing your public store and email signup forms | Our legitimate interests in giving you a useful call (Art. 6(1)(f)) |
| Sending you a one-off follow-up, such as the checklist we offer stores below our usual size | Legitimate interests; you can opt out at any time |
| Protecting the site against spam, fraud and abuse | Legitimate interests in keeping our services secure |
| Keeping records we are required to keep | Legal obligation (Art. 6(1)(c)) |
We do not use your details for automated decision-making or profiling, and we do not sell them. Giving us your details is voluntary, but we need them to arrange a call.
Who we share it with
We use trusted service providers (processors) who act only on our instructions:
- Website hosting and form handling: Netlify, Inc. (USA).
- Email delivery: our transactional email provider, used to send your enquiry to us and any follow-up to you.
- Spam protection: Cloudflare, Inc. (Turnstile), if enabled on the form.
- Scheduling: our online calendar provider (Cal.com or Calendly) and the video meeting service used for the call.
We may also share information if the law requires it, or with professional advisers under a duty of confidentiality.
International transfers
Some providers are based in, or process data in, the United States. Where they do, we rely on the UK Extension to the EU–US Data Privacy Framework (the "UK–US data bridge") for certified providers, or on the UK International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses.
How long we keep it
- Enquiries that do not lead to working together: up to 12 months after our last contact.
- Client records: for the length of the engagement plus 6 years, for legal and accounting purposes.
- Security logs: kept by our hosting provider for a short period, typically up to 30 days.
Your rights
You have the right to access your data, to have it corrected or erased, to restrict or object to our use of it (including objecting to any use based on legitimate interests), and to data portability. To use these rights, contact us using the details above. We will reply within one month.
You can also complain to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint, telephone 0303 123 1113. We would appreciate the chance to resolve your concern first.
Cookies
We do not use advertising or analytics cookies. See our cookie notice for details.
Changes
We will update this notice if how we use personal data changes, and show the date of the latest version at the top.