1. Introduction & Data Controller

Tonic SEO ("we", "us", or "our") is committed to protecting and respecting your privacy. For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, the Data Controller is Tonic SEO, located at 14A The Village, Ryhope, Sunderland, Tyne and Wear, SR2 0NQ, United Kingdom.

If you have any questions about this Privacy Policy or how we handle your personal data, please contact our Data Protection Officer at privacy@tonic-seo.com.

---

2. Lawful Bases for Processing

We only process your personal data when we have a valid lawful basis to do so under Article 6 of the UK GDPR:

• Consent: You have given clear consent for us to process your personal data for a specific purpose (e.g., subscribing to our SEO newsletter).
• Contract: The processing is necessary for a contract we have with you, or because you have asked us to take specific steps before entering into a contract (e.g., reserving a discovery consultation).
• Legitimate Interests: The processing is necessary for our legitimate business interests, provided those interests do not override your fundamental rights and freedoms (e.g., protecting our website from spam using CAPTCHAs).

---

3. Types of Personal Data We Collect

We may collect, use, store, and transfer the following types of personal data when you interact with our website:

• Identity Data: Full name and corporate role (collected when submitting client reviews or enquiry forms).
• Contact Data: Email address, phone number, and mailing address.
• Booking Data: Appointment date, time, and chosen consultation format (Virtual via Microsoft Teams vs. In Person at our Sunderland office).
• Technical Data: Internet protocol (IP) address, browser type and version, time zone setting, operating system, and platform.

---

4. Your Rights Under UK Law

Under the UK GDPR, you have the following rights regarding your personal data:

• Right of Access (Subject Access Request): You have the right to request copy of the personal data we hold about you.
• Right to Rectification: You have the right to request that we correct any inaccurate or incomplete personal data.
• Right to Erasure ("Right to be Forgotten"): You can request that we delete your personal data under certain conditions.
• Right to Object: You have the right to object to our processing of your personal data for direct marketing or legitimate interest grounds.

To exercise any of these rights, please email us. We respond to all valid requests within one calendar month, free of charge.

---

5. Data Retention Periods

We only retain your personal data for as long as necessary to fulfill the purposes we collected it for:

• Consultation Bookings: Held for 12 months following the scheduled appointment to facilitate client onboarding.
• Contact Form Enquiries: Re-verified and deleted after 6 months if no ongoing commercial contract is established.
• Newsletter Subscriptions: Maintained until you explicitly opt out using the unsubscribe link.

---

6. Supervisory Authority

If you are unhappy with how we process your personal data, you have the right to lodge a complaint at any time with the supervisory authority in the UK: The Information Commissioner's Officer (ICO). They can be contacted via their website at https://ico.org.uk.