Version 1.1 · Last updated 7 October 2026
We have written this policy in plain English so that anyone can understand how we treat the privacy of the data we come into contact with. We only use legal language where it is needed to name the regulations we comply with.
1. Who we are
smallific is a marketing, systems and operations consultancy. We help small and medium businesses move from chaos to clarity.
For the purposes of UK data protection law, the data controller is:
| Trading name | smallific |
| Legal status | Sole trader: Caroline Crossland, trading as smallific |
| Address | Penistone, South Yorkshire, United Kingdom (full postal address available on request) |
| hello@smallific.com | |
| ICO registration number | ZC244998 |
We are registered with the Information Commissioner’s Office as a data controller.
We have not appointed a Data Protection Officer. We are not required to, and at our scale it would not be proportionate. Caroline Crossland is personally responsible for data protection at smallific and is the point of contact for all queries.
2. What this policy covers
This policy explains what personal data we collect, why, what we do with it, and what rights you have. It applies to:
- Visitors to www.smallific.com
- People who enquire about our services
- Clients and prospective clients, and the individuals who work for them
- People we meet through networking and business development
- People who subscribe to our emails or download our resources
- Suppliers and contractors
Where we act for our clients rather than for ourselves. When we deliver work for a client, such as running their CRM, building their systems or managing their campaigns, we usually handle personal data belonging to their customers and contacts. In those situations the client is the data controller and we act as their processor. That processing is governed by the data processing agreement we sign with the client, not by this policy.
3. What we collect, why, and our lawful basis
We only collect what we actually need.
3.1 Website enquiries and contact forms
| What we collect | Name, email, phone, business name, website URL, and whatever you tell us about your business |
| How we get it | You give it to us, via our website forms, email or phone |
| Why | To respond to your enquiry, prepare any free audit requested, and decide whether we are the right fit |
| Lawful basis | Legitimate interests, Article 6(1)(f). Where a proposal follows, pre-contract steps, Article 6(1)(b) |
| Retention | 12 months from last contact if no client relationship follows |
3.2 The free online presence audit
| What we collect | Business name, website, social profiles, publicly available information about your online presence, plus your contact details |
| How we get it | From you, and from publicly accessible web sources. We use an AI tool (Anthropic’s Claude) to read your public website and public business listings and to draft the audit. Caroline reviews and completes every audit personally before it is sent to you |
| Why | To produce and send the free audit you requested |
| Lawful basis | Legitimate interests, Article 6(1)(f) |
| Retention | 12 months from delivery, unless you become a client |
3.3 Discovery calls and meetings
| What we collect | Notes on your business, challenges, priorities, budget indications and decision-making, plus contact details and role |
| Why | To understand your situation, decide whether we can help, and write a proposal if we can |
| Lawful basis | Pre-contract steps, Article 6(1)(b), and legitimate interests, Article 6(1)(f) |
| Retention | 12 months if no engagement. Engagement plus 6 years if it proceeds |
We do not record calls or meetings without telling you first and getting your agreement.
3.4 Client engagements
| What we collect | Contact details, job titles, business and billing information, correspondence, project files, meeting notes, deliverables |
| Why | To deliver the services, manage the project, invoice, and keep proper business records |
| Lawful basis | Contract, Article 6(1)(b). Legal obligation, Article 6(1)(c), for tax records. Legitimate interests, Article 6(1)(f), for records and claim defence |
| Retention | Financial records 6 years after the end of the relevant tax year. Project records 6 years after the engagement ends |
3.5 Prospects and business development
| What we collect | Business name, business contact details, sector, size, publicly reported growth signals, decision-maker names and roles, our own notes |
| How we get it | Public sources such as company websites, Companies House, published news, directories and LinkedIn, plus business cards given to us at events |
| Why | To identify businesses that may benefit from our services and approach them appropriately |
| Lawful basis | Legitimate interests, Article 6(1)(f). This is business-to-business marketing to businesses whose published activity suggests a genuine need. We have assessed the impact as low: business contact details only, in a business context, approached infrequently, and stopped immediately on request |
| Retention | 24 months from creation or last update, then reviewed |
Where we got your details, and your right to object. When we contact you for the first time we will tell you where we found your details. You can tell us to stop at any time and we will delete your record. Email hello@smallific.com. You do not need to give a reason.
3.6 Email marketing
| What we collect | Name, email, business name, and records of opens and clicks |
| Lawful basis | Consent, Article 6(1)(a), where you subscribed. For existing clients, the soft opt-in under PECR regulation 22 for similar services. Every message carries an unsubscribe link |
| Retention | Until you unsubscribe, plus a suppression record so we do not email you again by mistake |
3.7 Networking and events
| What we collect | Name, business, role, contact details from business cards and conversations, plus notes on what we discussed |
| Lawful basis | Legitimate interests, Article 6(1)(f). Ordinary business networking, where you handed us your details expecting to be contacted |
| Retention | 24 months from last contact, then reviewed |
3.8 Website usage
We do not currently use analytics or tracking cookies on this website. See our Cookie Policy for the detail. We do not track individual visitors across other websites or build behavioural profiles.
3.9 Testimonials and case studies
| What we collect | Name, role, business name, photograph or logo, testimonial wording, project details and results |
| Lawful basis | Consent, Article 6(1)(a) |
| Retention | Until you withdraw consent. Removed from anything we control within 30 days of your request. We cannot guarantee removal from third-party caches or archives |
Where a case study relates to work carried out at a reduced rate in exchange for that case study, we say so plainly wherever it is published.
3.10 Suppliers and contractors
| What we collect | Name, business contact details, payment details, records of work done |
| Lawful basis | Contract, Article 6(1)(b), and legal obligation, Article 6(1)(c) |
| Retention | 6 years after the end of the relevant tax year |
4. Special category data
We do not seek to collect special category data, meaning information about health, race or ethnicity, religion, political opinions, trade union membership, sex life, sexual orientation, or genetic or biometric data.
If it reaches us incidentally, we do not use it and we delete it as soon as we reasonably can. We do not process criminal offence data.
5. Who we share your data with
We do not sell personal data. We do not share it for anyone else’s marketing. We use these service providers, who process data on our behalf:
| Service | What it does for us | Data location |
| Notion | Client records, project management, knowledge base | USA |
| FreeAgent | Accounting and bookkeeping | UK |
| Mettle (NatWest) | Business banking | UK |
| Tally | Website forms, including the free audit request and newsletter sign-up | EU (Belgium) |
| Cal.com | Meeting scheduling and video calls | USA |
| Krystal | Website and email hosting | UK |
| Apple (iCloud) | Document and file storage, calendar, notes and contacts | USA and other countries |
| Documents and backup storage | USA | |
| MailerLite | Email newsletters and email communications | EU |
| Anthropic (Claude) | AI assistance with drafting, analysis and research, including a first draft of the free online presence audit from publicly available information | USA |
| Dub (dub.co) | Short links in our free audit emails, including the link to book your follow-up call | USA |
| n8n, self-hosted on Hetzner | Workflow automation | EU (Finland) |
| Canva | Design work | Australia |
We may also share your data with our accountant, our insurers and professional advisers, HMRC and other authorities where legally required, and a buyer or successor if the business is sold or reorganised.
5.1 Our use of AI tools
We use AI tools, principally Anthropic’s Claude, to help us draft, analyse and research. Three things matter to you:
- We do not put client confidential information or personal data into AI tools without a lawful basis and appropriate safeguards. Where we use AI on client work, that use is covered by our engagement terms and the client’s data processing agreement.
- We do not rely on AI to make decisions about people. We make no decisions about you by automated means alone, and we carry out no profiling producing legal or similarly significant effects.
- We keep client names out of our system records. The documents that describe how our systems are built, which we back up to a private online store, use codes such as “Client A” and “Contact 1” in place of names. An automatic check helps stop names, passwords and keys from being saved there. Real names are only used in systems where they are necessary – such as our CRM data and sales records, for example.
Any AI-assisted output that reaches you has been reviewed and edited by a person. AI never drafts and sends a message on its own, and nothing it writes is used unedited, in its entirety, online or offline.
6. Sending data outside the UK
Some of the services above are based outside the UK, mainly in the United States and the EU. Where personal data is transferred outside the UK we rely on UK adequacy regulations (for example for the EU, and for US companies certified under the UK Extension to the EU-US Data Privacy Framework), or on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses.
You can ask us for details of the safeguards in place for any specific transfer.
7. How we keep your data secure
- Multi-factor authentication on business accounts
- A password manager, with unique passwords for every service
- Full-disk encryption on devices used for business
- Access limited to Caroline Crossland, and to contractors only where necessary and under a confidentiality agreement
- Regular software updates and security patches
- Encrypted backups
- Reputable providers with published security standards
No system is perfectly secure. If a breach occurs that is likely to result in a risk to your rights and freedoms, we will report it to the ICO within 72 hours of becoming aware, and tell you directly if the risk to you is high.
8. How long we keep your data
| Enquiries that go nowhere | 12 months from last contact |
| Prospect records | 24 months, then reviewed |
| Networking contacts | 24 months from last contact, then reviewed |
| Client project records | 6 years after the engagement ends |
| Financial and tax records | 6 years after the end of the relevant tax year |
| Email marketing | Until you unsubscribe |
| Testimonials | Until you withdraw consent |
We review our records annually and delete anything we no longer have a reason to hold.
9. Your rights
| Be informed | To know what we do with your data, which is what this policy is for |
| Access | To get a copy of the personal data we hold about you |
| Rectification | To have inaccurate data corrected, or incomplete data completed |
| Erasure | To have your data deleted, in certain circumstances |
| Restrict processing | To have us pause our use of your data, in certain circumstances |
| Data portability | To receive data you gave us in a machine-readable format, where processed by automated means on the basis of consent or contract |
| Object | To object to processing based on legitimate interests. You have an absolute right to object to direct marketing, and we will stop immediately |
| Withdraw consent | Where we rely on consent, to withdraw it at any time |
To exercise any right, email hello@smallific.com. We will respond within one month, extendable by up to two further months for complex requests, and we will tell you if that happens. There is no charge, unless a request is manifestly unfounded or excessive. We may ask you to confirm your identity first.
10. Automated decision-making
We do not make decisions about you using automated processing alone, and we do not carry out profiling producing legal or similarly significant effects.
11. Do you have to give us your data?
No. It is voluntary. But without the information we need, we cannot respond to an enquiry, prepare a proposal or deliver a project.
12. Complaints
Please tell us first at hello@smallific.com so we can put it right.
You also have the right to complain to the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. Helpline 0303 123 1113. ico.org.uk/make-a-complaint
13. Changes to this policy
We review this policy at least annually, and whenever we change how we handle personal data. Material changes will be flagged on our website.