Privacy & Cookies Policy

1. Who we are

The data controller responsible for this website is:

If you have any questions about this policy or about how we use your personal information, please contact us using the email address above.

2. Information we collect

Depending on how you interact with us, we may collect information you provide directly, including your name, email address, telephone number, company or organisation, information entered into forms, correspondence and other information you choose to provide.

We may also process technical and usage information when you use our website. Depending on your privacy choices, this may include pages visited, visit dates and times, page interactions, scrolling, referring websites, outbound clicks, site searches, video interactions, file downloads, form interactions, browser and operating system information, device type, approximate location, IP address and cookie, advertising or similar device identifiers.

The exact information collected depends on the purpose of the technology and the privacy choices you make.

3. Necessary website processing

We process information where necessary to operate and secure our website, deliver functionality requested by you, prevent fraud or abuse, remember privacy choices and respond to actions you take.

Our lawful basis will normally be our legitimate interests in operating and protecting our website, performance of a contract or steps requested before entering into a contract, or compliance with a legal obligation.

Technologies that are genuinely necessary for these purposes may operate without consent. This includes the cookie or browser storage used to remember your privacy preferences.

4. Enquiries and communications

If you contact us, we use the information you provide to respond to your enquiry, provide requested information and, where appropriate, take steps towards providing products or services to you.

Our lawful basis will normally be taking steps at your request before entering into a contract and/or our legitimate interests in communicating with prospective and existing customers.

5. Aggregate statistical analytics

We use limited statistical measurement to understand how our website is used and to improve its performance, content and usability.

Where our configuration satisfies the statistical-purpose exception under PECR, this limited measurement may operate without prior opt-in consent.

It may allow us to understand information such as total page views, popular pages, general visitor journeys, time spent using pages, scrolling, referring sources, browser and device information and similar aggregate statistics.

When we rely on this exception, the measurement is not used to identify individual visitors, recognise a visitor across return visits, build an individual profile, create advertising audiences or carry out advertising.

For Google Analytics, when visitor-level analytics consent has not been provided, analytics storage is set to denied. Google Analytics may then perform limited cookieless measurement without using its normal persistent analytics identifiers.

If you object to aggregate statistical analytics through our Privacy Settings, we disable the relevant analytics collection entirely rather than merely disabling analytics cookies.

Where personal information is involved in this limited statistical processing, our lawful basis under the UK GDPR is our legitimate interest in understanding and improving our website. You may object to this statistical measurement at any time.

If a particular analytics technology or configuration does not meet the requirements of the applicable statistical-purpose exception, we will treat it as optional and will not use it until consent has been provided.

6. Visitor-level analytics

With your consent, we use Google Analytics 4 to understand individual sessions, repeat visits and visitor journeys in greater detail.

Our Google Analytics Measurement ID is: G-QYRPBZ1GM6

When visitor analytics is enabled, Google Analytics may use persistent identifiers and first-party cookies such as _ga and _ga_<identifier>. These technologies can allow the same browser or device to be recognised between visits.

Visitor-level analytics is off by default and is only enabled after you provide consent.

When you provide visitor analytics consent, we permit Google Analytics analytics storage. If you withdraw that consent, analytics storage is returned to denied and visitor-level identification stops for future activity.

If aggregate analytics remains enabled, Google Analytics may continue limited cookieless measurement. If you have also objected to aggregate analytics, Google Analytics measurement is disabled entirely.

Our lawful basis for visitor-level analytics is your consent.

7. Enhanced measurement

Google Analytics Enhanced Measurement may automatically measure website interactions including page views, scrolling, outbound link clicks, site searches, video interactions, file downloads and form interactions.

We configure Google Analytics so that personally identifying information such as names, email addresses and telephone numbers should not intentionally be sent to Analytics. Google Analytics email redaction is enabled on our property.

We also require our website implementation to avoid including personal information in Analytics event names, event parameters, page URLs or other measurement data.

8. Advertising, conversion measurement and remarketing

With your consent, we use advertising and measurement technologies provided by Google and Meta.

These may include Google Ads, Google advertising and conversion tags, Meta Pixel, campaign attribution, conversion measurement, advertising optimisation, audience creation and remarketing.

Advertising technologies are off by default. They are activated only after you provide advertising consent.

Information processed may include website pages visited, actions taken, advertising campaign information, conversions, referring URLs, browser and device information, IP address, cookie or device identifiers and advertising click identifiers.

Google and Meta may be able to associate information received from our website with information they already hold about a browser, device or account in accordance with their own privacy policies and terms.

Our lawful basis for these activities is your consent.

You may withdraw advertising consent at any time through our Privacy Settings.

9. Google advertising technologies

Where advertising consent has been provided, we may use Google Ads and related Google advertising technologies for campaign measurement, attribution, remarketing, audience creation and advertising optimisation.

Google advertising technologies may use first-party identifiers and cookies whose names begin with _gcl_, together with advertising click information such as a Google Click Identifier where applicable.

The following Google Consent Mode states remain denied until advertising consent has been provided:

• ad_storage
• ad_user_data
• ad_personalization

When advertising consent is withdrawn, these permissions are returned to denied for future activity.

10. Meta Pixel

Where advertising consent has been provided, we use the Meta Pixel.

The Meta Pixel allows information about activity on our website to be transmitted to Meta for purposes including advertising attribution, conversion measurement, campaign reporting, advertising optimisation, audience creation and remarketing.

Depending on the circumstances, Meta technologies may use identifiers or cookies including _fbp and _fbc.

Meta may be able to associate activity on our website with a Facebook, Instagram or other Meta account or with other information held by Meta.

The Meta Pixel and related advertising technologies are not activated until advertising consent has been provided.

If advertising consent is withdrawn, we stop sending future Pixel events and stop permitting associated advertising storage from our website.

Meta's subsequent processing is subject to its applicable privacy policy, Business Tools terms and other relevant contractual terms.

11. Cookies and similar technologies

For the purposes of this policy, "cookies" also includes similar storage and access technologies such as browser storage, tracking pixels, scripts, tags and device identifiers.

We divide these technologies into four privacy categories:

12. Main cookies and storage

Our implementation may use the following technologies.

Google and Meta may change cookie names, storage mechanisms and default durations over time. Our Privacy Settings and this policy will be reviewed where material changes occur.

13. Privacy Settings and changing your cookie choices

You can review or change your cookie and privacy choices at any time.

Use the Manage cookie preferences button below to open our Privacy Settings.

Your current choices will be displayed when Privacy Settings opens. You can then:

• object to or re-enable aggregate statistical analytics;
• give or withdraw visitor analytics consent;
• give or withdraw advertising consent; and
• review the categories of cookies and similar technologies used by this website.

A Manage cookie preferences control is also available from the footer of our website so that you can return to these settings without having to find this Privacy & Cookies Policy.

Necessary technologies cannot be disabled where they are genuinely required to operate the website, maintain security or remember your privacy choices.

If you withdraw visitor analytics consent, we stop permitting visitor-level analytics storage for future activity. If aggregate analytics remains enabled, limited cookieless statistical measurement may continue.

If you also object to aggregate analytics, we disable the relevant Google Analytics measurement entirely for future activity.

If you withdraw advertising consent, we stop future advertising and marketing tracking through technologies including Google advertising tags and Meta Pixel.

Where technically possible and appropriate, we will also remove first-party analytics and advertising cookies previously created through our website when the corresponding permission is withdrawn.

Changing or withdrawing your consent does not affect the lawfulness of processing that took place while valid consent existed.

You can also delete cookies and browser storage through your browser settings. If you delete the cookie used to remember your privacy choices, we may need to ask you for those choices again on a future visit.

14. Sharing information

Information may be processed by or shared with our website hosting and infrastructure providers, security and technical providers, email and communication providers, professional advisers, Google, Meta and other suppliers acting on our instructions or providing services used by our website.

Information may also be disclosed where required by law, to regulators, courts or law-enforcement authorities, or in connection with a proposed or completed sale, merger, restructuring or transfer of our business or assets.

We only disclose personal information where there is an appropriate purpose and legal basis.

15. Google and Meta

Google provides Google Analytics and Google advertising services used by this website. Meta provides Meta Pixel and related advertising services.

Depending on the particular service and processing involved, these organisations may act as processors, independent controllers or otherwise process information under their applicable contractual arrangements and privacy terms.

We configure our use of these services with privacy choices in mind and do not intentionally enable visitor analytics or advertising functionality before the corresponding consent has been provided.

16. International transfers

Some service providers, including Google and Meta, operate internationally and may process information outside the United Kingdom.

Where our use of a provider results in a restricted international transfer of personal information, we rely on an appropriate lawful transfer mechanism.

Depending on the circumstances, this may include UK adequacy regulations, recognised data-protection frameworks, the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses or another lawful safeguard.

17. Data retention

We keep personal information only for as long as reasonably necessary for the purposes for which it was collected, including legal, accounting, security and dispute-resolution requirements.

Our intended maximum standard retention periods are as follows.

Website and security logs: up to 12 months, unless a longer period is reasonably required to investigate a security incident, fraud, abuse or legal matter.

General enquiries and correspondence: up to 6 years from the last substantive interaction where retention remains reasonably necessary for business records or the establishment, exercise or defence of legal claims. Information that has no continuing purpose may be deleted sooner.

Customer and contractual records: up to 6 years after the end of the relevant customer or contractual relationship, or longer where a specific legal obligation requires it.

Accounting and transaction records: retained for the period required under applicable company, accounting and taxation law, normally up to 6 years or longer where legally required.

Google Analytics user-level and event-level data: configured to 14 months, being our intended maximum standard GA4 retention setting.

Where supported, the user-data retention period may reset when a consenting visitor generates new activity.

Google Analytics standard aggregated reporting data may remain available separately from user-level and event-level data in accordance with Google's platform operation.

Privacy and consent records: up to 6 years after the relevant choice, withdrawal or replacement, where reasonably necessary to demonstrate compliance or establish, exercise or defend legal claims.

The browser cookie used simply to remember your active privacy preference is intended to last no more than 12 months before renewal or replacement.

Advertising and campaign information: retained in accordance with the default retention settings of the relevant Google or Meta service unless we configure a shorter period or delete the information sooner.

Where information is anonymised so that it can no longer reasonably identify an individual, we may retain the resulting aggregate information for longer.

We periodically review whether retained personal information is still required and delete or anonymise it when it is no longer necessary.

18. Security

We use appropriate technical and organisational measures designed to protect personal information against unauthorised access, disclosure, alteration, loss and destruction.

No internet service can guarantee absolute security, but we take reasonable steps proportionate to the nature of the information and the risks involved.

19. Your data protection rights

Depending on the circumstances, you may have rights to obtain information about our processing, access personal information, correct inaccurate information, request deletion, restrict processing, receive certain information in a portable format and object to certain processing.

Where we rely on consent, you may withdraw that consent at any time.

Where we rely on legitimate interests, you may have the right to object to that processing.

You may also object at any time through our Privacy Settings to aggregate statistical technologies where we rely on the applicable statistical-purpose exception.

To exercise your rights, contact: wesleybrett@miltoncreed.com

We may need to verify your identity before completing a request.

20. Complaints

If you are concerned about how we use your personal information, please contact us first so that we can investigate.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator.

21. Third-party websites

Our website may contain links to websites operated by third parties.

We do not control the privacy practices of those websites. Their processing is governed by their own privacy notices and terms.

22. Changes to this policy

We may update this policy when our website, technologies, suppliers, processing activities or legal obligations change.

The latest version will be published on this page and the "Last updated" date will be changed accordingly.

Where a material change affects a privacy choice you have previously made, we will take appropriate steps to inform you and, where required, request consent again.