Privacy & Cookie Policy

The GP Website Company Ltd respects your privacy and is committed to protecting your personal information. This policy explains how we collect and use personal information about website visitors, customers, prospective customers, business contacts and recipients of our business communications.

Please read this Privacy and Cookie Policy carefully to understand how and why we use your personal information.

1. Definitions and Interpretation

In this Policy the following terms shall have the following meanings:

"Account" means an account required to access and/or use certain areas and features of Our Site;

"Cookie" means a small text file placed on your computer or device by Our Site when you visit certain parts of Our Site and/or when you use certain features of Our Site. Details of the Cookies used by Our Site are set out in Part 14; and

"Cookie Law" means the relevant parts of the Privacy and Electronic Communications (EC Directive) Regulations 2003.

2. Information About Us

Our Site is owned and operated by The GP Website Company Ltd, a limited company registered in Scotland under company number SC892795. Registered address: 5 South Charlotte Street, Edinburgh, EH2 4AN. ICO registration number: ZC181624

Data Protection Contact: The Data Protection Officer.
Email address: dataprotection@thegpwebsitecompany.co.uk.
Postal address: 5 South Charlotte Street, Edinburgh, EH2 4AN.

3. What Does This Policy Cover?

This Privacy Policy applies to website visitors, enquiries and prospective customers, existing customers, business contacts, people whose professional details are licensed from Oscar Research, email marketing and other business communications. This includes marketing and other business communications sent using related domains. Our website may contain links to other websites. Please note that we have no control over how your data is collected, stored, or used by other websites and we advise you to check the privacy policies of any such websites before providing any data to them.

4. What Is Personal Data?

Personal data is defined by the UK GDPR and the Data Protection Act 2018 (collectively, "the Data Protection Legislation") as 'any information relating to an identifiable person who can be directly or indirectly identified in particular by reference to an identifier'. Personal data covers obvious information such as your name and contact details, but it also covers less obvious information such as identification numbers, electronic location data, and other online identifiers.

5. What Are Your Rights?

Under the Data Protection Legislation, you have the following rights, which we will always work to uphold:

a) The right to be informed about our collection and use of your personal data. This Privacy Policy should tell you everything you need to know, but you can always contact us to find out more using the details in Part 15.

b) The right to access the personal data we hold about you. Part 13 will tell you how to do this.

c) The right to have your personal data rectified if any of your personal data held by us is inaccurate or incomplete. Please contact us using the details in Part 15.

d) The right to be forgotten — the right to ask us to delete or otherwise dispose of any of your personal data that we hold. Please contact us using the details in Part 15.

e) The right to restrict (i.e. prevent) the processing of your personal data.

f) The right to object to us using your personal data for a particular purpose or purposes.

g) The right to withdraw consent. If we are relying on your consent as the legal basis for using your personal data, you are free to withdraw that consent at any time.

h) The right to data portability. If you have provided personal data to us directly, we are using it with your consent or for the performance of a contract, and that data is processed using automated means, you can ask us for a copy of that personal data.

i) Rights relating to automated decision-making and profiling. We do not use your personal data in this way.

j)The right to object to direct marketing. You have the right to object at any time to our use of your personal information for direct marketing. You can use the unsubscribe link in any marketing email.

Further information about your rights can be obtained from the Information Commissioner's Office or your local Citizens Advice Bureau. If you have any cause for complaint about our use of your personal data, you have the right to lodge a complaint with the ICO. We would welcome the opportunity to resolve your concerns first — please contact us using the details in Part 15.

6. What Data Do We Collect and How?

We do not collect any special category or sensitive personal data, personal data relating to children, or data relating to criminal convictions and/or offences. We may maintain email delivery, bounce, complaint, unsubscribe and suppression records generated through our marketing communications.

Identity and contact information (name, job title, email address, telephone number): submitted directly by you via the sign-up form on Our Site (powered by PandaDoc).

Business information (current website URL, practice name, practice address, NHS Practice ID): submitted directly by you via the sign-up form on Our Site (powered by PandaDoc).

Professional information obtained from business-data providers. We license professional contact and organisational information from Oscar Research Ltd, a specialist provider of public-sector and healthcare-sector business information. This information may include names, professional roles, job titles, business email addresses, business telephone numbers, GP practices or other employing organisations, organisation addresses, organisational identifiers and related information about the person’s professional role or organisation. Oscar Research Ltd is the source from which we receive this information. Further information is available at www.oscar-research.co.uk. We use extracts downloaded from Oscar Research no more than one month before their intended use, so that we can take account of recent updates and recorded preference changes.

Technical information (IP address, browser type and version, operating system, pages visited, time and duration of visit, referral source): collected automatically via Squarespace analytics and Google Analytics when you visit Our Site.

Communication records (emails and correspondence with us): provided by you when you contact us directly.

7. How Do We Use Your Personal Data?

Under the Data Protection Legislation, we must always have a lawful basis for using personal data. The following describes how we may use your personal data and our lawful basis for doing so:

Processing your enquiry or sign-up via Our Site. Data used: identity, contact, and business information. Legal basis: legitimate interests (to respond to your enquiry and take steps to enter into a contract with you).

Entering into and managing the Website Hosting and Support Agreement with you. Data used: identity, contact, and business information. Legal basis: performance of a contract.

Providing and managing your Account (when available). Data used: identity and contact information; account credentials. Legal basis: performance of a contract.

Administering Our Site and improving the user experience. Data used: technical information. Legal basis: legitimate interests (to maintain and improve Our Site).

Communicating with you about your enquiry, account, or our services. Data used: identity and contact information. Legal basis: legitimate interests or performance of a contract.

Analytics, understanding how Our Site is used. Data used: technical information (anonymised where possible). Legal basis: consent (via cookie consent banner).

Business to business marketing. We may use professional contact and organisational information to send carefully targeted communications about our specialist GP website and related services. Our lawful basis under the UK GDPR is our legitimate interest in promoting our services to organisations and professional contacts whose responsibilities or organisation indicate that those services may be relevant. In relying on legitimate interests, we limit campaigns using relevant professional or organisational criteria, use professional rather than private contact information, identify ourselves clearly and provide a straightforward way to unsubscribe. We may select business marketing recipients using factors such as professional role, organisation type, location or the apparent relevance of our services. We do not make decisions based solely on automated processing that have legal or similarly significant effects on individuals.

We will only use your personal data for the purpose(s) for which it was originally collected unless we reasonably believe that another purpose is compatible with the original purpose(s). If we need to use your personal data for an unrelated purpose, we will inform you and explain the legal basis for doing so.

8. How Long Will We Keep Your Personal Data?

Identity and contact information (enquiry, not converted to customer): 3 years from the date of last contact.

Identity and contact information (converted to customer): duration of the contract, plus 7 years thereafter (to comply with HMRC and accounting requirements).

Technical / analytics data: 26 months (in line with Google Analytics default retention).

Communication records: 3 years from the date of the last communication.

Account data (when accounts are available): duration of account, plus 7 years after closure.

Licensed business-marketing information: We retain this information only while it remains relevant, sufficiently current, lawfully usable and covered by an applicable licence. Campaign extracts are refreshed before use and are not taken from downloads more than one month old.

Marketing suppression records: If somebody unsubscribes or objects, we may retain their email address or another minimal identifier on a suppression list for as long as necessary to ensure that they are not inadvertently contacted again.

Marketing delivery and campaign records: We retain delivery, bounce, complaint and campaign records only for as long as reasonably necessary to administer our communications, investigate delivery issues and demonstrate compliance with our legal obligations.

9. How and Where Do We Store or Transfer Your Personal Data?

We store some personal information within the United Kingdom. Some of our service providers or their subcontractors may process personal information outside the United Kingdom.

Where personal information is transferred internationally, we use an appropriate lawful transfer mechanism. This may include transferring information to a country covered by UK adequacy regulations, relying on the UK Extension to the EU-US Data Privacy Framework where applicable, or using approved contractual safeguards such as the UK International Data Transfer Agreement or UK Addendum.

You can contact us if you would like further information about the safeguards relevant to a particular transfer.

The security of your personal information is important to us. We take appropriate organisational and technical measures, including:

a) limiting access to people who have a legitimate business need and who are subject to appropriate confidentiality obligations;

b) using appropriate account, access and security controls;

c) using reputable service providers; and

d) maintaining procedures for investigating and reporting personal-data breaches where legally required.

10. Do We Share Your Personal Data?

We may share your personal data with the following third-party service providers who process it on our behalf. We require all third parties to maintain appropriate security measures and to process your personal data only for specified purposes.

Squarespace, Inc. (data processor): website hosting and built-in site analytics.

Google LLC (data processor): website analytics (Google Analytics).

Zestia Ltd. (data processor): CRM and website form processing.

PandaDoc, Inc. (data processor): electronic signing of agreements.

Mailgun Technologies, Inc. and relevant Sinch group companies (data processors): email delivery, delivery reporting, bounce handling, complaint handling and unsubscribe management.

Tawk.to Inc. (data processor): live chat widget.

Tawk.to also uses browser local storage (for session tokens and tab management) and session storage (to remember the last page visited).

We do not sell your personal data to any third party. We may also be legally required to share personal data with law enforcement or regulatory authorities if required by law or court order.

If we sell, transfer, or merge parts of our business or assets, your personal data may be transferred to a third party. Any new owner of our business may continue to use your personal data in the same way(s) specified in this Privacy Policy.

11. How Can You Control Your Personal Data?

11.1 In addition to your rights under the Data Protection Legislation set out in Part 5, when you submit personal data via Our Site, you may be given options to restrict our use of your personal data. In particular, we aim to give you strong controls on our use of your data for direct marketing purposes, including the ability to opt out of receiving emails from us by unsubscribing using the links provided in our emails and at the point of providing your details. Unsubscribing will prevent further direct marketing being sent to the affected address. It will not prevent us from sending essential communications concerning an existing contract, account, service or enquiry. We may retain a minimal suppression record to ensure that an unsubscribed address is not inadvertently added to a future campaign.

11.2 You may also wish to sign up to one or more of the preference services operating in the UK: the Telephone Preference Service (TPS), the Corporate Telephone Preference Service (CTPS), and the Mailing Preference Service (MPS). These may help to prevent you receiving unsolicited marketing.

12. Can You Withhold Information?

You may access certain areas of Our Site without providing any personal data at all. However, to use all features and functions available on Our Site — in particular to submit a sign-up enquiry — you may be required to submit certain data. You may restrict our use of Cookies. For more information, see Part 14.

13. How Can You Access Your Personal Data?

If you want to know what personal data we hold about you, you can ask us for details of that personal data and for a copy of it. This is known as a "subject access request". All subject access requests should be made in writing and sent to the email or postal addresses shown in Part 15. There is not normally any charge for a subject access request. If your request is manifestly unfounded or excessive, a fee may be charged to cover our administrative costs in responding. We will respond to your subject access request within one month of receiving it. In some cases, particularly if your request is more complex, more time may be required up to a maximum of three months. You will be kept fully informed of our progress.

14. How Do We Use Cookies?

Our Site places and accesses certain first-party Cookies on your computer or device. We also receive third-party Cookies from our analytics and CRM providers. All Cookies used by and on Our Site are used in accordance with current Cookie Law. Before non-essential Cookies are placed on your computer or device, you will be shown a cookie consent banner requesting your consent. You may deny consent to non-essential Cookies; however, certain features of Our Site may not function fully or as intended. Strictly necessary Cookies do not require your consent, but you are informed about them here.

First-party Cookies (placed directly by Our Site)

crumb — CSRF protection; required for secure form submissions. Type: strictly necessary. Duration: session.

ss_cvr — assigns an anonymous visitor ID to help us understand how the site is used. Type: analytics. Duration: 1 year.

ss_cvr_s — tracks the current visitor session. Type: analytics. Duration: session.

ss_cpvisit — counts the number of pages visited per session. Type: analytics. Duration: session.

SQ_TRAFFIC_SPLIT — used by Squarespace for traffic routing and A/B testing. Type: functional. Duration: session.

squarespace-referral-tracking — records the referral source of your visit (e.g. search engine, social media). Type: analytics. Duration: session.

Third-party Cookies

_ga (Google Analytics) — distinguishes individual users for analytics reporting. Type: analytics. Duration: 2 years.

_ga_[ID] (Google Analytics) — maintains session state for Google Analytics 4. Type: analytics. Duration: 2 years.

_gid (Google Analytics) — distinguishes users; stores and updates a unique value for each page visited. Type: analytics. Duration: 24 hours.

You can choose to enable or disable Cookies in your internet browser. Most internet browsers also enable you to choose whether you wish to disable all Cookies or only third-party Cookies. By default, most internet browsers accept Cookies, but this can be changed. For further details, please consult the help menu in your internet browser.

Our Site uses analytics services provided by Google Analytics and Squarespace. Website analytics refers to a set of tools used to collect and analyse anonymous usage information, enabling us to better understand how Our Site is used and to improve it over time. You do not have to allow us to use these Cookies; while our use of them does not pose any risk to your privacy or your safe use of Our Site, it does enable us to continually improve the experience for you.

Live Chat
tawk_uuid_[propertyId] — recognises returning visitors by assigning a unique ID. Type: functional. Duration: 6 months.

TawkConnectionTime — keeps the chat widget synchronised when a visitor has multiple tabs open. Type: functional. Duration: session.

twk_idm_key — prevents duplicate connection requests when navigating between pages. Type: functional. Duration: session.

15. How Do You Contact Us?

To contact us about anything to do with your personal data and data protection, including to make a subject access request, please use the following details:

Email address: dataprotection@thegpwebsitecompany.co.uk
For the attention of: The Data Protection Officer
Postal address: 5 South Charlotte Street, Edinburgh, EH2 4AN

16. Changes to This Privacy Policy

We may review and update this Privacy and Cookie Policy from time to time to reflect changes in our activities, services, legal obligations or applicable guidance.

The latest version will be published on our website with the date of the most recent update. If a change materially affects how we use personal information, we will take reasonable steps to bring it to the attention of affected individuals where required.

This Privacy and Cookie Policy was last updated on 8 September 2026.