Privacy & Cookie Policy

1. Who we are

Align & Scale is a fractional marketing consultancy based in Hertfordshire, United Kingdom, operated by James Gurnett as a sole trader. For the purposes of UK data protection law, James Gurnett, trading as Align & Scale, is the data controller for personal data collected through this website.

2. What we collect

2.1 Information you give us

• Enquiry and contact forms: your name, work email address, phone number (if you provide one), company name, and whatever you write in the message field.
• Free SEO Audit Tool: the website address you submit for analysis, plus your first name and work email address when you unlock the full report.
• Marketing bottleneck quiz and other tools: your answers, plus your name and email if you choose to receive the results.
• Bookings and calls: the details you enter when scheduling a call with us.
• Purchases and downloads: order details and billing information when you buy a service or download a resource through the site.
• Newsletter sign-ups: your name and email address.

2.2 Information collected automatically

• Device and browser data: IP address (usually truncated or anonymised by our analytics providers), browser type and version, operating system, screen size, and language.
• Usage data: pages viewed, time on page, scroll depth, clicks, referring URL, entry and exit pages, and which tools you used.
• Session recordings and heatmaps: Microsoft Clarity records anonymised interaction data such as mouse movement, clicks and scrolling, so we can see where pages confuse people. Form field contents are masked by default.
• Campaign data: UTM parameters and click identifiers such as Google's gclid and Microsoft's msclkid, so we can tell which advert or post brought you here.
• Cookie and local storage identifiers: the random IDs listed in section 4.

2.3 Information from other sources

• Advertising and social platforms (Google Ads, LinkedIn, Meta) give us aggregated campaign performance data and, in some cases, non-identifying audience insights.
• If you interact with us on LinkedIn or by email, that correspondence may be recorded in our CRM.
• For SEO and competitor research we use third-party data tools that work with publicly available website data, not personal data about you.

3. Why we use it, and our lawful basis

Where we rely on legitimate interests, our interest is running and growing a marketing consultancy. We have balanced this against your rights and only process data that a reasonable person would expect a business to process in this context. You can object at any time (see section 10).

4. Cookies and tracking technologies

A cookie is a small text file stored on your device. We also use similar technologies such as local storage, session storage, pixels and JavaScript tags. Everything below is loaded either by Squarespace, which hosts this site, or through Google Tag Manager (container GTM-W4LLKPFJ), which is the single place we manage our marketing and analytics tags.

4.1 Strictly necessary

These are required for the site to work. They cannot be switched off through this site.

4.2 Analytics

These help us understand how the site is used. They are set only where you have consented.

4.3 Advertising and remarketing

These let us measure which adverts produce enquiries, and show relevant adverts to people who have visited the site. They are set only where you have consented.

4.4 Functional and CRM

5. The tools and platforms we use

In the interests of being straight with you, here is the complete list of third parties that receive data about your visit, what each one is for, and where to read their own privacy terms.

6. Conversion tracking and ad measurement

Because we are a marketing consultancy, our own site is measured properly. Here is exactly how that works, in plain terms.

Event-based conversions

When you submit a form, unlock the SEO report or complete a purchase, our tag manager fires a single event containing the type of action, which page or tool it came from, and a randomly generated event ID. That event is passed to Google Analytics 4, Google Ads, LinkedIn and Meta so each platform can record the conversion once and only once.

Enhanced conversions

Where you have submitted an email address or phone number and consented to advertising cookies, that value is hashed in your browser using SHA-256 before it is sent to Google. Google uses the hash to match the conversion to an ad click, then discards it. Google receives a one-way fingerprint, not your readable email address or phone number.

Click identifiers

If you arrive from a Google advert, the URL carries a gclid. We store it against your contact record in HubSpot so that if you later become a client we can report which campaign generated that revenue. LinkedIn and Meta traffic is tagged with UTM parameters instead.

Offline conversion imports

When a contact in our CRM becomes a client, we send that milestone back to Google Ads as an offline conversion. This upload uses the click identifier only, so Google learns that a particular ad click eventually converted. It does not include your name, contact details or any commercial terms.

7. Who we share data with

We share personal data only with:

• The processors listed in section 5, each under a data processing agreement.
• Our professional advisers, such as our accountant, where required for accounting or legal purposes.
• Payment and invoicing providers, if you buy a service from us.
• Authorities and regulators, where we are legally required to disclose.
• A buyer or successor, if the business is sold or restructured. You would be told beforehand.

Where we act as a processor rather than a controller, which is the case when we manage marketing accounts on behalf of a client, that client is the controller and their own privacy policy governs the data.

8. International transfers

Some of our providers are based in, or process data in, the United States. Where personal data leaves the UK it is protected by one or more of the following safeguards:

• The UK Extension to the EU-US Data Privacy Framework, where the provider is certified.
• The UK International Data Transfer Agreement, or the EU Standard Contractual Clauses with the UK Addendum.
• Additional technical measures such as encryption in transit and at rest.

Our HubSpot CRM data is stored in the European Union.

9. How long we keep data

10. Your rights

Under UK GDPR you have the right to:

• Be informed about how your data is used, which is what this page is for.
• Access a copy of the personal data we hold about you.
• Rectification of data that is inaccurate or incomplete.
• Erasure of your data, where there is no overriding reason for us to keep it.
• Restrict processing in certain circumstances.
• Data portability, receiving your data in a structured, machine-readable format.
• Object to processing based on legitimate interests, and to direct marketing at any time.
• Withdraw consent at any time, without affecting processing that already happened.

Email james@align-scale.com to exercise any of these. We will respond within one month. There is no charge unless a request is manifestly unfounded or excessive.

11. How to control cookies

In your browser

Every major browser lets you block or delete cookies. Blocking strictly necessary cookies may stop parts of this site working.

• Google Chrome
• Mozilla Firefox
• Safari
• Microsoft Edge

Opt out of specific tools

• Google Analytics: install the Google Analytics Opt-out Browser Add-on.
• Google Ads personalisation: change your settings at My Ad Center.
• Microsoft Clarity: Clarity honours the Global Privacy Control signal, and you can opt out via Microsoft's advertising choices page.
• LinkedIn: manage advertising preferences in your LinkedIn ad settings.
• Meta: manage ad preferences in your Meta Accounts Center.
• HubSpot: unsubscribe using the link in the footer of any marketing email we send.

Do Not Track and Global Privacy Control

Our site does not currently respond to browser Do Not Track signals, as there is no agreed standard for how sites should interpret them. Several of the providers listed above honour Global Privacy Control independently.

12. Children

Our services are aimed at businesses. This site is not directed at children and we do not knowingly collect personal data from anyone under 18. If you believe a child has given us their data, email us and we will delete it.

13. Changes to this policy

We review this policy whenever we add, change or remove a tracking tool, and at least once a year. The date at the top of this page shows the last review. Material changes will be highlighted on the site.

14. Contact and complaints

For anything to do with your data, or if you think we have got something wrong, contact us first. We would rather fix it directly.

You also have the right to complain to the UK's supervisory authority, the Information Commissioner's Office: ico.org.uk/make-a-complaint, helpline 0303 123 1113.