Legal Privacy policy
Your data, itemised.
What we collect, why we collect it, who else touches it and how long we keep it. No hedging, no boilerplate you cannot act on. If anything here is unclear, ask and we will answer plainly.
Last updated 13 August 2026
01Who we are
Rank Media Ltd is the data controller for the personal data described in this policy. That means we decide why and how it is used, and we are the ones accountable for it.
- Registered name
- Rank Media Ltd
- Registered in
- England & Wales
- Company number
- 13428453
- Director
- Mr Ramial Aqeel
- +44 7957 599826
We have not appointed a Data Protection Officer. We are not required to. Ramial Aqeel handles all data protection questions directly, and the email above reaches him.
This policy covers the website at rankmedia.co.uk and the enquiries, calls and client work that follow from it.
02What we collect
When you fill in the audit or contact form
The form on our contact page asks for the following. Name, business name, email and website are required. Phone, spend band and message are optional in practice, though the form marks some fields required to keep enquiries useful.
- Your name, so we know who we are talking to.
- Business name, so we can look at the right company.
- Email address, so we can send the audit and reply.
- Phone number, if you give it, so we can call rather than email.
- Website address, so we can review your pages and your market.
- Monthly ad spend band, a range rather than an exact figure, so we can judge what is realistic.
- Your message, a free-text box. Whatever you type goes to us, so please do not include anything sensitive, medical, financial or confidential in it.
When you book a call
Bookings run through Calendly, embedded on our contact page. When you book, Calendly collects your name, email address, any answers you give to its questions, and your time zone, then passes the booking to us and to our calendar. Calendly also processes technical data about your device in order to run the widget. See section 05 for what that means.
When you email, call or message us
We hold the content of the message and the address, number or profile it came from, including messages sent to us on WhatsApp or LinkedIn.
When you simply browse the site
If, and only if, you allow it through the cookie banner, we run Google Analytics 4 and Google's advertising tags to measure which pages are viewed and which visits lead to an enquiry. The lawful basis is your consent, nothing loads before you give it, and refusing changes nothing about how the site works for you. You can withdraw at any time via the Cookie choices link in the footer, and the cookie policy lists every cookie involved.
We do not run heatmaps, session recording or any tool that watches individual behaviour, and we do not build a profile of you.
One thing still happens automatically, and you should know about it. Our web host processes your IP address and request as a technical necessity of serving the page to you. That is all: we self-host our typefaces, so rendering the page itself sends nothing to Google or any other third party. Section 05 has the detail.
What we do not collect
We do not ask for and do not want special category data: health, ethnicity, religion, political opinions, sex life, biometric or genetic data. We do not knowingly collect data about anyone under 18. We are a business-to-business service and our site is not aimed at children.
03Why we use it, and our lawful basis
Under the UK GDPR we must have a lawful basis for every purpose. Here is each one, spelled out.
| What we do | Data used | Lawful basis |
|---|---|---|
| Reply to your enquiry and prepare the free audit | Name, business, email, phone, website, spend band, message | Legitimate interests. You approached us about a service. Responding is what you expected and is necessary to run our business. We judged this does not override your rights, because the data is business contact data and you chose to send it. |
| Arrange and hold a discovery call | Name, email, booking answers, time zone | Legitimate interests, or steps prior to a contract at your request where you are an individual rather than a company. |
| Deliver our services once you are a client | Contact details, account access, billing details | Performance of a contract with you, or steps taken at your request before entering into one. |
| Send invoices and keep accounting records | Name, business, billing details, transaction records | Legal obligation under UK tax and company law. |
| Follow up on an enquiry that went quiet | Name, email, phone | Legitimate interests. A reasonable number of follow-ups on an enquiry you started. Tell us to stop and we stop. |
| Keep records to defend or bring a legal claim | Whatever is relevant to the matter | Legitimate interests in establishing, exercising or defending legal claims. |
| Serve the site so it renders as designed | IP address, browser and device information | Legitimate interests in presenting a working, legible website. |
| Measure site usage and advertising performance | Pages viewed, approximate location, device information, whether a visit led to an enquiry (Google Analytics 4 and Google Ads, via Google Tag Manager) | Consent. Given through the cookie banner, withdrawable at any time via the footer's Cookie choices link. Nothing loads without it. |
Where we rely on legitimate interests
You have the right to object. See section 08. If you object, we will stop unless we can show compelling grounds that override your rights, and for direct marketing we will stop without argument.
Marketing. We do not run a marketing mailing list from this website. If we ever start one, it will be consent based, the consent will be asked for separately, and every message will carry an unsubscribe link. We will not add you to anything on the strength of an audit enquiry.
04Client advertising data
This section matters if you are a client rather than a visitor, and the distinction is a real one in law.
When we manage a Google Ads account, a Google Business Profile or a website for you, we act as your data processor for the personal data inside those systems. Your enquiry forms, your call records, your customer lists, your conversion data. You remain the data controller of that data. You decide why it exists and what happens to it. We only act on your documented instructions, which are set out in the services agreement between us rather than in this policy.
For your own contact and billing details as our client, we are the controller, and this policy applies as written.
Practically, this means we may access your advertising and analytics platforms under delegated access, and we may see personal data belonging to your customers as a result. We do not use it for our own purposes, we do not sell it, and we do not move it into any other client's account. Where we appoint a sub-processor to help deliver your services, the terms of the services agreement govern that, including your right to be told about it.
If you are a customer of one of our clients and you want to exercise rights over your data, you generally need to contact that business directly, because they are the controller. Write to us anyway if that is difficult and we will point you to the right place.
05Who we share it with
We do not sell personal data. We do not trade it, rent it or share it for anyone else's marketing. The list below is the complete set of third parties involved in the data this website collects.
Calendly
Calendly LLC provides the booking widget embedded on our contact page. If you book a call, Calendly processes your name, email, answers and time zone in order to create the booking, and processes technical data about your device in order to render the widget. Calendly acts as our processor for booking data. It is a US company. See section 06.
The Calendly widget only loads when you visit the contact page. It is not present on this page or anywhere else on the site. Read Calendly's privacy notice.
Google, for measurement
If you consent through the cookie banner, Google LLC processes usage data (pages viewed, approximate location, device information, and whether a visit led to an enquiry) through Google Analytics 4, Google Tag Manager and Google Ads. This happens only after your consent, and stops if you withdraw it via the footer's Cookie choices link. Read Google's privacy policy for how Google handles it.
Typefaces
The typefaces on this site (Fraunces, Archivo and Spline Sans Mono) are served from our own server, not from Google. Loading a page of this site therefore sends no data to Google in order to render the type, and sets no cookie. The fonts are used under the SIL Open Font Licence.
Google, as an advertising platform
Where we manage Google Ads campaigns for a client, Google processes advertising data as part of running those campaigns. That relationship exists between the client and Google. It is not something this website does to you as a visitor.
Our email, calendar and hosting providers
Enquiries reach us by email and bookings land in our calendar, so the providers of those services process the data as part of storing and delivering it. Our web host processes your IP address as a technical necessity of serving pages.
Professional advisers and authorities
We may share data with our accountant, our insurers or our solicitors where they need it, and with a public authority, regulator or court where the law requires it. We do not hand over data on a casual request.
A change of ownership
If the business is sold or merged, data may transfer to the buyer, who would be bound by this policy until they lawfully told you otherwise.
06International transfers
Some of the providers above are based in the United States, or store data there. That is a transfer of personal data outside the UK, and it needs a legal safeguard.
Where data goes to the US, we rely on either the UK Extension to the EU-US Data Privacy Framework, where the provider is certified under it, or on the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment where one is needed.
You can ask us which safeguard applies to a particular provider and we will tell you. Email hello@rankmedia.co.uk.
07How long we keep it
We do not keep data indefinitely on the off chance. Each category has a period and a reason.
| Category | Period | Why |
|---|---|---|
| Enquiries that never became clients | 24 months from last contact | Enquiries often revive within a year or two. After 24 months the record has no value and we delete it. |
| Free audits we produced | 24 months from delivery | So we can answer questions about what we told you and why. |
| Calendar bookings and call notes | 24 months from the call | Same reason. Deleted on the same cycle as the enquiry. |
| Client contact records and correspondence | 6 years after the engagement ends | The limitation period for a contract claim in England and Wales is six years. |
| Invoices and accounting records | 6 years from the end of the accounting period | Required by UK tax and company law. We cannot delete these early even if asked. |
| Access to a client advertising account | Removed when the engagement ends | Our access is revoked at offboarding. The data itself stays in your account, under your control. |
| Suppression record after a request to stop contact | Indefinitely, minimal detail only | We keep just enough, usually an email address, to make sure we honour your request and do not contact you again by mistake. |
When a period expires we delete the data or anonymise it so it can no longer identify you. Backups roll off on their own cycle, so a deleted record may persist in a backup for a short period before it is overwritten. It is not restored into active use.
08Your rights
The UK GDPR gives you the following rights over your personal data. All of them are free to use, and none of them require a reason unless we say so below.
- The right to be informed. To know what we do with your data. This policy is how we do that.
- The right of access. To get a copy of the personal data we hold about you, and to be told why we hold it, who we share it with and how long we keep it. Commonly called a subject access request.
- The right to rectification. To have inaccurate data corrected, and incomplete data completed.
- The right to erasure. To have your data deleted, sometimes called the right to be forgotten. It is not absolute. We must refuse where we are legally required to keep the record, invoices being the clearest example, and we may refuse where we need it for a legal claim. We will tell you which applies rather than ignore you.
- The right to restrict processing. To have us pause our use of your data while a dispute about its accuracy or our grounds is resolved. We keep it, but we do not use it.
- The right to data portability. To receive the data you gave us in a structured, commonly used, machine readable format, and to have it sent to another controller where technically feasible. This applies to data processed by automated means on the basis of consent or contract.
- The right to object. To object to processing based on legitimate interests, on grounds relating to your particular situation. We stop unless we can show compelling legitimate grounds that override your rights, or we need the data for legal claims. If you object to direct marketing, we stop. Full stop, no balancing test.
- Rights around automated decision-making. You have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. We do not make any such decisions about website visitors or enquirers. No automated system decides whether we work with you.
- The right to withdraw consent. Where we rely on consent, you can withdraw it at any time, and it is as easy to withdraw as it was to give. Withdrawing does not undo processing that was lawful before you withdrew.
- The right to complain. To the Information Commissioner's Office. See below.
How to exercise them
Email hello@rankmedia.co.uk or message us on WhatsApp. Say which right you are using, or just describe what you want in your own words and we will work it out. There is no form to fill in.
We respond within one month. If your request is complex, or you have made several, we may extend by up to two further months, and we will tell you within the first month if we do, with the reason. We may ask you to confirm your identity first, but only where we genuinely have doubt about who you are, and only enough to be sure. There is no charge, unless a request is manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse, and we will explain why.
Complaining to the ICO
If you are unhappy with how we have handled your data, please tell us first so we have the chance to fix it. You do not have to. You can go straight to the regulator, and using us first does not affect your right to complain to them.
- Regulator
- Information Commissioner's Office (ICO)
- Address
- Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
- Helpline
- 0303 123 1113
- Website
- ico.org.uk/make-a-complaint
09Security
We take appropriate technical and organisational measures to protect personal data. In practice, for a business our size, that means the site is served over HTTPS, accounts carry two-factor authentication where the provider supports it, access to client advertising accounts is delegated rather than shared by password, and the number of people who can reach any of it is one.
No transmission over the internet is completely secure. We are honest about that rather than promising something no one can deliver. If a breach occurs that is likely to result in a risk to your rights and freedoms, we will report it to the ICO within 72 hours of becoming aware, and we will tell you directly where the risk is high.
10Cookies
Analytics and advertising cookies (Google Analytics 4 and Google Ads, loaded through Google Tag Manager) are set only after you allow them through the cookie banner, and the banner's two choices carry equal weight. Refuse and nothing third-party loads at all. Calendly's booking widget, on the contact page, loads only when you choose to open it. We self-host our typefaces, so rendering a page sends no request to Google. Our cookie policy lists all of it by category, and the Cookie choices link in the footer reopens the banner so consent can be withdrawn as easily as it was given.
11Changes to this policy
We update this policy when what we do changes, and the date at the top always reflects the current version. If a change materially affects your rights, we will do more than quietly change the date. We will say so on the page, and we will tell clients directly.
Reading it again after a change is worth two minutes. That is the whole reason the date is at the top.
12Contact us
Any question about this policy, any request about your data, any complaint. One address, one number, and a person on the other end.
- +44 7957 599826
- Hours
- Monday to Friday, 9:00 to 17:30 GMT
Related
See also our cookie policy and our terms of use. If you are a client, the services agreement between us governs the work itself, and it takes precedence over this website's terms where the two overlap.