PRIVACY POLICY

JBMG Limited (“JBMG”, “we”, “us”) is a social media management and consultancy company registered in England and Wales, with its office at 104-108 Oxford Street, London, W1D 1LP, United Kingdom. We run the website at jbmg.agency.

For the personal data described in this policy we are the data controller: we decide what is collected and what it is used for. You can reach us about any of it at hello@jbmg.agency.

This policy covers the website — the pages you are reading, the newsletter form, the booking widget and the analytics that run alongside them. It does not cover work we do for clients under a signed agreement: where we manage a client’s social channels or handle data on their behalf, that is governed by the contract between us, and in most cases the client is the controller and we are their processor.

It also does not cover the platforms we link out to. If you follow us to Instagram, TikTok or LinkedIn, what happens there is between you and them.

When you join the newsletter. The email address you type into the form, and nothing else — there is no name field and we do not ask for one. It is used to send you the newsletter. Submitting the form also sends an anti-abuse token to Cloudflare along with your IP address and some technical signals about your browser, which is how we tell a person apart from a script (see section 5).

When you book a call. Our booking widget is Cal.com, embedded in the page. What you type into it — your name, your email address, anything you add about your project, and the slot you pick — goes to Cal.com and into our calendar, so that the call can happen and so we know who we are speaking to.

When you email or message us. Whatever you send, and whatever we send back. We keep the thread so we can pick up where we left off, and because a conversation about work is often the record of what was agreed.

When you simply read the site. Our analytics and advertising tools record things like the pages you look at, how you got here, roughly where in the world you are (derived from your IP address), your device and browser, and identifiers stored in cookies. Our hosting provider also keeps short-lived server logs containing your IP address and the requests you made, which is how a web server works and how we notice when the site is being attacked or is falling over.

Under the UK GDPR we have to have one, and this is which we rely on for what:

• Consent — sending you the newsletter, and setting the analytics and advertising cookies described in section 6. You can withdraw it at any time, and doing so does not affect anything done before you did.
• Contract, and steps taken before entering one — arranging and holding a call you have booked, and answering an enquiry about working together.
• Legitimate interests — keeping the site up and free of abuse (the anti-abuse check on the form, and server logs), keeping records of our correspondence, and understanding in aggregate how the site is used. We have weighed these against your interests; none of them involve building a profile of you as an individual, and you can object to any of them (section 9).
• Legal obligation — where we have to keep something, such as records connected to tax or to a contract.

We are a small team and we do not sell data, ever, to anyone. We do use other companies to run parts of the site, and your data passes through them. These are all of them:

• Vercel Inc. — hosts the website. Handles every request you make to it, and keeps short-lived logs of them.
• Cloudflare, Inc. (Turnstile) — the anti-abuse check on the newsletter form. Receives your IP address and browser signals in order to decide whether the submission is automated. Cloudflare states that Turnstile does not use this to track individuals across sites.
• n8n — the automation platform we run our own workflows on. A verified newsletter signup is passed to it as an email address, and it is what puts you on the list.
• Cal.com, Inc. — the booking widget and the scheduling behind it. Receives whatever you enter when you book a call.
• Google LLC / Google Ireland Limited — Google Analytics, which tells us how the site is used, and our email and productivity tools, which is where correspondence with us is stored.
• Meta Platforms Ireland Limited — the Meta (Facebook) Pixel, which measures how our advertising performs and allows us to show ads to people who have visited the site. Meta acts as a joint controller with us for parts of this; their own terms describe how.
• Mapbox, Inc. — the map of our office at the foot of the page. Loading it makes a request to Mapbox from your browser, which carries your IP address.

We may also disclose personal data where the law requires it, or to professional advisers under a duty of confidence.

Cookies are small files a site asks your browser to keep. Some of the ones here are ours; most belong to the companies in section 5. They fall into three groups:

• Necessary — Cloudflare Turnstile’s anti-abuse cookies, and cookies Cal.com sets when you open the booker. Without them the form and the booking widget do not work.
• Analytics — Google Analytics (cookies beginning _ga), which counts visits and tells us which pages are read. Typically stored for up to two years.
• Advertising — the Meta Pixel (cookies including _fbp), which measures our ads and can be used to show you ours elsewhere. Typically stored for up to three months.

Being straight with you: this site does not yet ask for your consent before the analytics and advertising cookies are set, and it should. We are fixing that. In the meantime, and afterwards, you can control them yourself — every browser can block or clear cookies for a site; Google publishes a Google Analytics opt-out add-on; and your Meta account’s ad settings control what Meta does with the pixel. You can also tell us at hello@jbmg.agency and we will deal with it at our end.

Several of the companies above are based in the United States or store data there. Where personal data leaves the UK we rely on the safeguards the law provides for it — the UK extension to the EU Standard Contractual Clauses, the International Data Transfer Agreement, or the UK–US Data Bridge where the receiving company is certified under it. You can ask us which applies to a particular transfer.

• Newsletter addresses — until you unsubscribe, and for a short period afterwards so that we do not add you back by mistake.
• Enquiries and correspondence — up to two years after our last exchange, unless it belongs to a contract we have to keep records of.
• Booking records — for as long as the calendar entry and its history are useful, typically two years.
• Analytics data — retained by Google for up to 14 months at the level of an individual record; aggregate reporting outlives that.
• Server logs — days to weeks, at our host’s standard retention.

Under UK data protection law you can ask us to:

• tell you what we hold about you, and give you a copy;
• correct anything that is wrong;
• delete it, where we have no good reason to keep it;
• restrict what we do with it while a question about it is open;
• hand it to you, or to someone else, in a portable format, where it was given to us by consent or under a contract;
• stop using it where we are relying on legitimate interests — and, if you object to direct marketing, we will stop, with no balancing test to argue about.

You can also withdraw consent at any time: every newsletter carries an unsubscribe link, and one email to us does the same job.

Ask by emailing hello@jbmg.agency. It costs you nothing and we will answer within one month. If you are not happy with how we have handled it you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113 — though we would rather you gave us the chance to put it right first.

This site is for people looking to hire a social media agency, and it is not directed at children. We do not knowingly collect data from anyone under 16. If you believe a child has given us their details, tell us and we will delete them.

We do not make decisions about you by automated means, and we do not profile you in any way that produces legal or similarly significant effects. The one automated judgement on this site is the anti-abuse check on the newsletter form, which decides whether a submission looks like a script — if it wrongly turns you away, email us and we will add you by hand.

When what the site does changes, this page changes with it, and the date at the top moves. If a change materially affects what we do with data we already hold, we will tell the people it affects rather than relying on them re-reading this page.

Anything at all about this policy or the data behind it: hello@jbmg.agency, or write to us at 104-108 Oxford Street, London, W1D 1LP, United Kingdom.