GDPR & DATA PROTECTION POLICY
Last updated: 30 September 2026
Inimitable Marketing Ltd is committed to protecting personal information and handling data responsibly, securely and in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and other applicable UK data protection legislation.
This policy explains the principles we follow when collecting, using, storing and sharing personal data.
1. OUR COMMITMENT
We process personal information in accordance with the core UK GDPR principles.
This means personal data will be:
- Processed lawfully, fairly and transparently
- Collected for clear and legitimate purposes
- Limited to the information genuinely required
- Kept accurate and up to date where necessary
- Retained only for as long as required
- Protected using appropriate security measures
- Managed in a way that allows us to demonstrate compliance
These principles form the foundation of UK data protection law.
2. OUR ROLE
When Inimitable Marketing determines why and how personal information is used for its own business purposes, we act as the data controller.
When we process personal information solely on behalf of a client. Dor example when operating lead generation, CRM, automation or AI lead-handling systems we may act as a data processor.
The distinction depends on who determines the purposes and means of processing.
3. PERSONAL DATA WE MAY PROCESS
Depending on the services being provided, this may include:
Contact information such as names, email addresses and telephone numbers.
Business information supplied through enquiries or onboarding.
Lead and customer information processed through advertising campaigns, landing pages, forms, CRM systems and automation platforms.
Communication records, including emails, messages and AI-assisted conversations.
Advertising and campaign information.
Website usage, analytics and cookie information where permitted.
Billing and account information required to manage our commercial relationship.
We aim to collect only information reasonably required for the relevant purpose.
4. LAWFUL PROCESSING
We will only process personal information where there is an appropriate lawful basis.
Depending on the circumstances, this may include:
Contract: Where processing is necessary to provide requested services.
Legitimate interests: Where processing is reasonably necessary for our business activities and those interests do not override an individual's rights.
Consent: Where an individual has actively agreed to a particular use of their data.
Legal obligation: Where processing is required by law.
Where processing relies on consent, that consent may be withdrawn.
5. DATA MINIMISATION
We will not intentionally collect personal information simply because it may be useful in future.
The information collected should be relevant and proportionate to the purpose for which it is required.
The ICO specifically identifies data minimisation as limiting collection to information that is actually needed.
6. DATA SECURITY
We take reasonable technical and organisational measures to protect personal information from: Unauthorised access, accidental disclosure, alteration, misuse, loss or destruction.
Measures may include controlled system access, secure passwords, appropriate authentication, reputable technology providers, encryption where appropriate and limiting access to those who genuinely require the information.
Data protection and security are considered when new systems, services and workflows are designed or introduced. This reflects the UK GDPR requirement for data protection by design and by default.
7. DATA RETENTION
Personal information will not be kept indefinitely without justification.
Retention periods will depend on:
The reason the information was collected, contractual requirements, legal obligations and whether the information remains reasonably necessary.
Information that is no longer required will be securely deleted or anonymised where appropriate.
The ICO states that organisations should be able to justify retention periods and regularly review whether information still needs to be held.
8. CLIENT DATA
Where clients provide personal information to us to deliver marketing or lead-generation services, clients remain responsible for ensuring that they have an appropriate lawful basis for collecting and using that information.
Where Inimitable Marketing acts as a processor, we will process personal information in accordance with the client's documented instructions and any applicable Data Processing Agreement.
We will not intentionally use client-controlled personal information for unrelated purposes.
9. LEAD GENERATION & AI SYSTEMS
Some Inimitable Marketing services may involve automated systems or AI-assisted communications.
Where these systems process personal information, we aim to ensure that:
Data is only used for the agreed purpose.
Access is appropriately controlled.
Automated communications comply with applicable privacy and electronic marketing requirements.
AI-assisted conversations are appropriately disclosed where required.
Uncertain or sensitive enquiries can be escalated for human review rather than relying entirely on automated responses.
Clients remain responsible for final commercial decisions, quotations and contractual commitments made to their customers.
10. THIRD-PARTY PROCESSORS
We may use trusted third-party providers to deliver our services.
These may include website platforms, advertising platforms, CRM providers, analytics systems, automation platforms, cloud services, communication providers and payment processors.
Where these providers process personal information on our behalf, we take reasonable steps to ensure appropriate contractual and security arrangements are in place.
11. INTERNATIONAL TRANSFERS
Some service providers may store or process information outside the United Kingdom.
Where international transfers occur, we will take reasonable steps to ensure an appropriate transfer mechanism or safeguard is used where required by law.
12. DATA SUBJECT RIGHTS
Individuals may have rights in relation to their personal information, including the right to:
Access information held about them, correct inaccurate information, request deletion in certain circumstances, restrict processing, object to certain processing, receive certain information in a portable format and withdraw consent where consent is being relied upon.
Requests can be made using the contact details below.
13. DATA BREACHES
Where we become aware of a personal data breach, we will assess:
What information was affected, the potential consequences, what action should be taken to contain the breach and whether notification to affected individuals or the Information Commissioner's Office is required.
Appropriate records of significant personal data incidents will be maintained.
The ICO includes records of personal data breaches among the documentation organisations may need to maintain to demonstrate compliance.
14. RECORD KEEPING & ACCOUNTABILITY
We maintain appropriate records relating to our processing activities where required.
These may include information about:
Processing purposes, categories of personal data, data recipients, retention periods, security measures, processor relationships, lawful bases and data breaches.
Documentation is an important part of demonstrating accountability under the UK GDPR.
15. PRIVACY BY DESIGN
We consider data protection when designing or changing:
Websites, lead-generation campaigns, landing pages, forms, tracking systems, CRM workflows, automation systems and AI-assisted services.
Where possible, we aim to minimise the amount of personal information collected and restrict access to what is necessary for the service.
16. POLICY REVIEW
This policy will be reviewed periodically and updated where our services, technology or legal obligations change.
The latest version will be published on our website.
17. CONTACT US
For questions about this policy or how Inimitable Marketing handles personal information, contact:
Inimitable Marketing Ltd
Email: support@inimitablemarketing.co.uk
Website: www.inimitablemarketing.co.uk
If you are unhappy with how your personal information has been handled, you may also have the right to complain to the Information Commissioner's Office (ICO).