Privacy & Cookie Policy
The GP Website Company Ltd understands that your privacy is important to you and that you care about how your personal data is used. We respect and value the privacy of everyone who visits this website, www.thegpwebsitecompany.co.uk ("Our Site") and will only collect and use personal data in ways that are described here, and in a way that is consistent with our obligations and your rights under the law.
Please read this Privacy Policy carefully and ensure that you understand it. Your acceptance of this Privacy Policy is deemed to occur when you consent to cookies on Our Site, or when you submit your details via any form on Our Site.
1. Definitions and Interpretation
In this Policy the following terms shall have the following meanings:
"Account" means an account required to access and/or use certain areas and features of Our Site;
"Cookie" means a small text file placed on your computer or device by Our Site when you visit certain parts of Our Site and/or when you use certain features of Our Site. Details of the Cookies used by Our Site are set out in Part 14; and
"Cookie Law" means the relevant parts of the Privacy and Electronic Communications (EC Directive) Regulations 2003.
2. Information About Us
Our Site is owned and operated by The GP Website Company Ltd, a limited company registered in Scotland under company number SC892795. Registered address: 5 South Charlotte Street, Edinburgh, EH2 4AN. ICO registration number: ZC181624
Data Protection Officer: The Data Protection Officer.
Email address: dataprotection@thegpwebsitecompany.co.uk.
Postal address: 5 South Charlotte Street, Edinburgh, EH2 4AN.
3. What Does This Policy Cover?
This Privacy Policy applies only to your use of Our Site. Our Site may contain links to other websites. Please note that we have no control over how your data is collected, stored, or used by other websites and we advise you to check the privacy policies of any such websites before providing any data to them.
4. What Is Personal Data?
Personal data is defined by the UK GDPR and the Data Protection Act 2018 (collectively, "the Data Protection Legislation") as 'any information relating to an identifiable person who can be directly or indirectly identified in particular by reference to an identifier'.Personal data covers obvious information such as your name and contact details, but it also covers less obvious information such as identification numbers, electronic location data, and other online identifiers.
5. What Are Your Rights?
Under the Data Protection Legislation, you have the following rights, which we will always work to uphold:
a) The right to be informed about our collection and use of your personal data. This Privacy Policy should tell you everything you need to know, but you can always contact us to find out more using the details in Part 15.
b) The right to access the personal data we hold about you. Part 13 will tell you how to do this.
c) The right to have your personal data rectified if any of your personal data held by us is inaccurate or incomplete. Please contact us using the details in Part 15.
d) The right to be forgotten — the right to ask us to delete or otherwise dispose of any of your personal data that we hold. Please contact us using the details in Part 15.
e) The right to restrict (i.e. prevent) the processing of your personal data.
f) The right to object to us using your personal data for a particular purpose or purposes.
g) The right to withdraw consent. If we are relying on your consent as the legal basis for using your personal data, you are free to withdraw that consent at any time.
h) The right to data portability. If you have provided personal data to us directly, we are using it with your consent or for the performance of a contract, and that data is processed using automated means, you can ask us for a copy of that personal data.
i) Rights relating to automated decision-making and profiling. We do not use your personal data in this way.
Further information about your rights can be obtained from the Information Commissioner's Office or your local Citizens Advice Bureau. If you have any cause for complaint about our use of your personal data, you have the right to lodge a complaint with the ICO. We would welcome the opportunity to resolve your concerns first — please contact us using the details in Part 15.
6. What Data Do We Collect and How?
We do not collect any special category or sensitive personal data, personal data relating to children, or data relating to criminal convictions and/or offences.
Identity and contact information (name, job title, email address, telephone number): submitted directly by you via the sign-up form on Our Site (powered by PandaDoc).
Business information (current website URL, practice name, practice address, NHS Practice ID): submitted directly by you via the sign-up form on Our Site (powered by PandaDoc).
Technical information (IP address, browser type and version, operating system, pages visited, time and duration of visit, referral source): collected automatically via Squarespace analytics and Google Analytics when you visit Our Site.
Communication records (emails and correspondence with us): provided by you when you contact us directly.
7. How Do We Use Your Personal Data?
Under the Data Protection Legislation, we must always have a lawful basis for using personal data. The following describes how we may use your personal data and our lawful basis for doing so:
Processing your enquiry or sign-up via Our Site. Data used: identity, contact, and business information. Legal basis: legitimate interests (to respond to your enquiry and take steps to enter into a contract with you).
Entering into and managing the Website Hosting and Support Agreement with you. Data used: identity, contact, and business information. Legal basis: performance of a contract.
Providing and managing your Account (when available). Data used: identity and contact information; account credentials. Legal basis: performance of a contract.
Administering Our Site and improving the user experience. Data used: technical information. Legal basis: legitimate interests (to maintain and improve Our Site).
Communicating with you about your enquiry, account, or our services. Data used: identity and contact information. Legal basis: legitimate interests or performance of a contract.
Sending you marketing information about our services (only with your consent). Data used: identity and contact information. Legal basis: consent. You may withdraw consent at any time by unsubscribing from our emails.
Analytics — understanding how Our Site is used. Data used: technical information (anonymised where possible). Legal basis: consent (via cookie consent banner).
We will only use your personal data for the purpose(s) for which it was originally collected unless we reasonably believe that another purpose is compatible with the original purpose(s). If we need to use your personal data for an unrelated purpose, we will inform you and explain the legal basis for doing so.
8. How Long Will We Keep Your Personal Data?
Identity and contact information (enquiry, not converted to customer): 3 years from the date of last contact.
Identity and contact information (converted to customer): duration of the contract, plus 7 years thereafter (to comply with HMRC and accounting requirements).
Technical / analytics data: 26 months (in line with Google Analytics default retention).
Communication records: 3 years from the date of the last communication.
Account data (when accounts are available): duration of account, plus 7 years after closure.
9. How and Where Do We Store or Transfer Your Personal Data?
We store some of your personal data within the UK. However, some of our third-party service providers (Squarespace, HubSpot, and Google) are based in the United States. When your personal data is transferred to the US, we ensure it is protected to the same standard as required under UK law. Squarespace, HubSpot, and Google are certified under the UK-US Data Bridge (the UK Extension to the EU-US Data Privacy Framework), which provides an adequate level of protection for personal data transferred from the UK to the US.The security of your personal data is essential to us. To protect your data, we take the following measures:
a) Limiting access to your personal data to those with a legitimate need to know, and ensuring they are subject to duties of confidentiality;
b) Maintaining procedures for dealing with data breaches, including notifying you and/or the Information Commissioner's Office where we are legally required to do so; and
c) Using reputable, certified third-party platforms for hosting, analytics, and CRM, each of which maintain their own security certifications and programmes.
10. Do We Share Your Personal Data?
We may share your personal data with the following third-party service providers who process it on our behalf. We require all third parties to maintain appropriate security measures and to process your personal data only for specified purposes.
Squarespace, Inc. (data processor): website hosting and built-in site analytics. Based in the USA, protected via the UK-US Data Bridge.
Google LLC (data processor): website analytics (Google Analytics). Based in the USA, protected via the UK-US Data Bridge.
HubSpot, Inc. (data processor): CRM and website form processing. Based in the USA, protected via the UK-US Data Bridge.
PandaDoc, Inc. (data processor): electronic signing of agreements. Based in the USA, protected via the UK-US Data Bridge.
Tawk.to Inc. (data processor): live chat widget. Based in the USA, protected via the UK-US Data Bridge.
Tawk.to also uses browser local storage (for session tokens and tab management) and session storage (to remember the last page visited). None of it is personally identifiable; session storage clears when the tab closes, local storage clears automatically when no longer needed.
We do not sell your personal data to any third party. We may also be legally required to share personal data with law enforcement or regulatory authorities if required by law or court order.
If we sell, transfer, or merge parts of our business or assets, your personal data may be transferred to a third party. Any new owner of our business may continue to use your personal data in the same way(s) specified in this Privacy Policy.
11. How Can You Control Your Personal Data?
11.1 In addition to your rights under the Data Protection Legislation set out in Part 5, when you submit personal data via Our Site, you may be given options to restrict our use of your personal data. In particular, we aim to give you strong controls on our use of your data for direct marketing purposes, including the ability to opt out of receiving emails from us by unsubscribing using the links provided in our emails and at the point of providing your details.
11.2 You may also wish to sign up to one or more of the preference services operating in the UK: the Telephone Preference Service (TPS), the Corporate Telephone Preference Service (CTPS), and the Mailing Preference Service (MPS). These may help to prevent you receiving unsolicited marketing.
12. Can You Withhold Information?
You may access certain areas of Our Site without providing any personal data at all. However, to use all features and functions available on Our Site — in particular to submit a sign-up enquiry — you may be required to submit certain data. You may restrict our use of Cookies. For more information, see Part 14.
13. How Can You Access Your Personal Data?
If you want to know what personal data we hold about you, you can ask us for details of that personal data and for a copy of it. This is known as a "subject access request".All subject access requests should be made in writing and sent to the email or postal addresses shown in Part 15. There is not normally any charge for a subject access request. If your request is manifestly unfounded or excessive, a fee may be charged to cover our administrative costs in responding. We will respond to your subject access request within one month of receiving it. In some cases, particularly if your request is more complex, more time may be required up to a maximum of three months. You will be kept fully informed of our progress.
14. How Do We Use Cookies?
Our Site places and accesses certain first-party Cookies on your computer or device. We also receive third-party Cookies from our analytics and CRM providers. All Cookies used by and on Our Site are used in accordance with current Cookie Law. Before non-essential Cookies are placed on your computer or device, you will be shown a cookie consent banner requesting your consent. You may deny consent to non-essential Cookies; however, certain features of Our Site may not function fully or as intended. Strictly necessary Cookies do not require your consent, but you are informed about them here.
First-party Cookies (placed directly by Our Site)
crumb — CSRF protection; required for secure form submissions. Type: strictly necessary. Duration: session.
ss_cvr — assigns an anonymous visitor ID to help us understand how the site is used. Type: analytics. Duration: 1 year.
ss_cvr_s — tracks the current visitor session. Type: analytics. Duration: session.
ss_cpvisit — counts the number of pages visited per session. Type: analytics. Duration: session.
SQ_TRAFFIC_SPLIT — used by Squarespace for traffic routing and A/B testing. Type: functional. Duration: session.
squarespace-referral-tracking — records the referral source of your visit (e.g. search engine, social media). Type: analytics. Duration: session.
Third-party Cookies
_ga (Google Analytics) — distinguishes individual users for analytics reporting. Type: analytics. Duration: 2 years.
_ga_[ID] (Google Analytics) — maintains session state for Google Analytics 4. Type: analytics. Duration: 2 years.
_gid (Google Analytics) — distinguishes users; stores and updates a unique value for each page visited. Type: analytics. Duration: 24 hours.
hubspotutk (HubSpot) — tracks visitors across sessions and associates form submissions with a visitor record. Type: analytics. Duration: 13 months.
__hstc (HubSpot) — main tracking cookie for HubSpot analytics. Type: analytics. Duration: 13 months.
__hssc (HubSpot) — tracks session activity for HubSpot analytics. Type: analytics. Duration: 30 minutes.
__hssrc (HubSpot) — identifies whether a visitor's browser session has restarted. Type: analytics. Duration: session.
__hs_opt_out (HubSpot) — stores your cookie opt-out preference for HubSpot tracking. Type: analytics. Duration: 13 months.
You can choose to enable or disable Cookies in your internet browser. Most internet browsers also enable you to choose whether you wish to disable all Cookies or only third-party Cookies. By default, most internet browsers accept Cookies, but this can be changed. For further details, please consult the help menu in your internet browser.
Our Site uses analytics services provided by Google Analytics and Squarespace. Website analytics refers to a set of tools used to collect and analyse anonymous usage information, enabling us to better understand how Our Site is used and to improve it over time. You do not have to allow us to use these Cookies; while our use of them does not pose any risk to your privacy or your safe use of Our Site, it does enable us to continually improve the experience for you.
Live Chat
tawk_uuid_[propertyId] — recognises returning visitors by assigning a unique ID. Type: functional. Duration: 6 months.
TawkConnectionTime — keeps the chat widget synchronised when a visitor has multiple tabs open. Type: functional. Duration: session.
twk_idm_key — prevents duplicate connection requests when navigating between pages. Type: functional. Duration: session.
15. How Do You Contact Us?
To contact us about anything to do with your personal data and data protection, including to make a subject access request, please use the following details:
Email address: dataprotection@thegpwebsitecompany.co.uk
For the attention of: The Data Protection Officer
Postal address: 5 South Charlotte Street, Edinburgh, EH2 4AN
16. Changes to This Privacy Policy
We may review and update this Privacy Policy from time to time to ensure continued compliance with the law and best practice. Any changes will be immediately posted on Our Site and you will be deemed to have accepted the updated terms on your first use of Our Site following the changes. We recommend that you check this page regularly to keep up to date. This Privacy Policy was last updated on 26th June 2026.