Privacy Policy

GraftFlow is a trading brand of Clinic Flow Marketing Ltd, a company registered in England and Wales with Company Number 17085305. We provide Google Ads management, Meta Ads management, website builds and digital marketing services exclusively for UK-based tradespeople.

For the purposes of data protection law, Clinic Flow Marketing Ltd is the data controller responsible for personal data collected through graftflow.co.uk and in connection with GraftFlow services.

We collect the following categories of personal data depending on how you interact with us.

• Full name
• Phone number and WhatsApp contact details
• Email address
• Business name and trade type
• Geographic area you operate in
• Information about your current marketing activity and business goals, where you choose to share this
• Payment and billing information when you become a client, processed through our payment provider
• Technical data including IP address, browser type, device type and operating system collected automatically when you visit our website
• Usage data including pages visited, time on site, referral source and click behaviour
• Communications data including the content of emails, WhatsApp messages or form submissions you send to us

We do not collect or process sensitive personal data such as health information, racial or ethnic origin, religious beliefs or biometric data.

We collect personal data through the following means.

• When you submit the contact or enquiry form on our website
• When you call or message us directly by phone or WhatsApp
• When you email us directly
• When you book a call or consultation through any booking tool we use
• When you become a client and enter into a service agreement with us
• Automatically through cookies and tracking technologies when you visit our website
• Through Google Analytics, Google Ads and other analytics tools that collect usage data about visitors to our site
• When you interact with our social media profiles on Facebook, Instagram or LinkedIn

We use the personal data we collect for the following purposes.

• To respond to your enquiry and assess whether GraftFlow services are a good fit for your business
• To provide and deliver the marketing services you have engaged us for
• To manage your account, process your payments and issue invoices
• To communicate with you about your campaigns, performance reports and strategy
• To send service-related updates, notifications and changes to our terms or pricing
• To improve our website, services and marketing based on how visitors interact with our site
• To comply with our legal and financial obligations including tax, accounting and Companies House requirements
• To pursue or defend legal claims where necessary
• To send you marketing communications about GraftFlow services where you have given consent or where we have a legitimate interest in doing so

Under UK GDPR, we must have a lawful basis for processing personal data. We rely on the following bases.

• Contract — processing is necessary to perform the services you have engaged us to deliver or to take steps before entering into a contract at your request
• Legitimate interests — we process certain data where it is in our legitimate business interests to do so, provided this does not override your rights. This includes improving our services, managing our business operations and following up with prospective clients who have made an enquiry
• Legal obligation — we process data where necessary to comply with a legal obligation, such as tax and accounting requirements
• Consent — where we rely on consent, such as for marketing emails, you may withdraw consent at any time by contacting us at info@graftflow.co.uk

We share personal data only where necessary and only with the following categories of recipient.

• Google — for advertising campaign management, analytics and tracking through Google Ads, Google Analytics and Google Tag Manager
• Meta (Facebook and Instagram) — for advertising campaign management where Meta Ads are included in your plan
• Call tracking providers — to enable call attribution and recording where agreed
• Payment processors — to process your monthly management fee payments securely
• Accounting and invoicing software providers — to manage our financial records
• Email and communication tools — to send and receive communications with you
• Website hosting providers — who store data necessary to operate our website
• Legal advisers or debt recovery services — only where necessary to pursue or defend a legal claim or recover outstanding payments
• HMRC and other regulatory authorities — where we are legally required to disclose information

All third-party service providers we work with are required to handle your data securely and in accordance with applicable data protection law. We do not permit them to use your data for their own purposes beyond the service they provide to us.

We may also share data between GraftFlow and Clinic Flow Dental where this is necessary for operational or legal reasons, given that both brands are operated by the same legal entity, Clinic Flow Marketing Ltd.

We retain personal data only for as long as necessary for the purposes for which it was collected, or as required by law.

• Enquiry data from people who do not become clients — up to 12 months from the date of enquiry, after which it is securely deleted
• Client data including contracts, invoices, communications and campaign records — retained for 7 years from the end of the client relationship to comply with HMRC and Companies Act requirements
• Website analytics data — as configured within Google Analytics, typically 26 months unless adjusted
• Payment records — 7 years in line with financial record-keeping obligations
• Marketing consent records — retained for as long as you remain subscribed and for 2 years following unsubscription as evidence of consent

After the applicable retention period, data is securely deleted or anonymised so that it can no longer be attributed to an individual.

Under UK GDPR, you have the following rights in relation to your personal data. You can exercise any of these rights by contacting us at info@graftflow.co.uk.

• The right to access — you can request a copy of the personal data we hold about you
• The right to rectification — you can ask us to correct inaccurate or incomplete data
• The right to erasure — you can ask us to delete your data in certain circumstances
• The right to restriction — you can ask us to limit how we use your data in certain circumstances
• The right to data portability — you can ask us to provide your data in a structured, machine-readable format in certain circumstances
• The right to object — you can object to our processing of your data where we rely on legitimate interests
• The right to withdraw consent — where we rely on consent, you can withdraw it at any time without affecting the lawfulness of processing before withdrawal

We will respond to all valid requests within one calendar month. In complex cases we may extend this by a further two months and will notify you if this is the case.

Our website uses cookies — small text files stored on your device — to enable certain functionality and to help us understand how visitors use the site.

• Strictly necessary cookies — required for the website to function correctly. These cannot be disabled.
• Analytics cookies — used to collect anonymised information about how visitors use our site, including pages visited and time spent. We use Google Analytics for this purpose.
• Advertising cookies — used to track the effectiveness of our own Google Ads and Meta Ads campaigns so we can measure which searches and ads lead to enquiries.

On your first visit to graftflow.co.uk, you will be asked to consent to non-essential cookies via a cookie banner. You can update your cookie preferences at any time by clearing your browser cookies and revisiting the site.

Refusing analytics or advertising cookies will not prevent you from using the website but may affect the accuracy of our campaign tracking.

We use the following tracking and analytics tools on our website and in our client campaigns.

• Google Analytics — to understand website visitor behaviour and improve our site
• Google Tag Manager — to manage tracking scripts efficiently
• Google Ads conversion tracking — to measure which ads and keywords lead to enquiries
• Meta Pixel — where applicable, to track the effectiveness of Facebook and Instagram advertising
• Call tracking software — to attribute phone calls to specific advertising campaigns

Data collected through these tools may be processed by Google and Meta on servers outside the UK. Please refer to Google's and Meta's own privacy policies for details of how they process this data.

We implement these tools in a manner designed to be consistent with UK GDPR requirements, including IP anonymisation within Google Analytics where applicable.

Our website contains links to third-party websites including Clinic Flow Dental, Google, Meta and other platforms. Clicking these links will take you away from graftflow.co.uk and to websites operated by third parties.

GraftFlow is not responsible for the privacy practices or content of any third-party website. We encourage you to read the privacy policies of any external websites you visit.

When we manage Google Ads or Meta Ads accounts on your behalf as a client, your advertising account data is held by Google or Meta under their respective terms of service and privacy policies. GraftFlow has access to this data solely for the purpose of managing your campaigns.

Some of the third-party tools and platforms we use may transfer and process personal data outside the United Kingdom, including in the United States and other countries. Where this occurs, we ensure that appropriate safeguards are in place in accordance with UK GDPR requirements.

Google and Meta, as recipients of data through our analytics and advertising tools, process data in accordance with the UK-US Data Bridge and other approved transfer mechanisms. You can find details of their international transfer arrangements in their respective privacy policies.

We take the security of personal data seriously and implement appropriate technical and organisational measures to protect it against unauthorised access, loss, destruction or alteration.

• All data transmitted through our website is encrypted using HTTPS and TLS protocols
• Access to client data is restricted to team members who need it to deliver services
• We use strong password policies and two-factor authentication on all systems holding personal data
• We do not store payment card details — all payment processing is handled by our payment provider

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office (ICO) within 72 hours and will notify affected individuals without undue delay where required by law.

GraftFlow services are intended for adults operating trade businesses in the United Kingdom. Our website and services are not directed at children under the age of 18 and we do not knowingly collect personal data from anyone under 18.

If you believe we have inadvertently collected data from a child, please contact us immediately at info@graftflow.co.uk and we will delete it promptly.

We may update this Privacy Policy from time to time to reflect changes in our practices, services or legal obligations. The date at the top of this page indicates when the policy was last updated.

Where changes are material, we will notify existing clients by email. For non-clients, the updated policy will be published at graftflow.co.uk/privacy.html and your continued use of our website following the update constitutes your acknowledgement of the revised policy.

If you have any questions about this Privacy Policy, wish to exercise your data rights or want to raise a concern about how we handle your personal data, please contact us.

We aim to respond to all data-related requests within one calendar month. If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection.

We would always prefer to resolve any concern directly before you escalate to the ICO, so please do contact us first and we will do our best to address your concerns fairly and promptly.