Legal

Privacy Policy

How Evolv Agency collects, uses, and protects personal data — and the rights you have over it.

This privacy policy explains how Evolv Optimisation Ltd ("Evolv", "we", "us") handles personal data in connection with our website (evolvagency.io), our marketing, and our generative search optimisation services. We are committed to protecting your privacy and handling your data in line with the UK GDPR, the Data Protection Act 2018 and, where relevant, the Privacy and Electronic Communications Regulations (PECR).

1. Who we are

Evolv Optimisation Ltd is a company registered in England and Wales, trading as Evolv Agency. We are the data controller for personal data processed through our website, marketing activity, enquiries and our own client relationships.

When we process personal data on behalf of a client while providing services, we generally act as that client's data processor. In those circumstances, the client is responsible for the relevant privacy information and for determining the purpose and means of the processing.

2. What personal data we collect and where it comes from

Depending on how you interact with us, we may collect:

  • Contact and enquiry data — name, email address, company, job title, and the content of messages you send us via forms, email, or when booking a call.

  • Client relationship data — information provided in the course of delivering services, including contacts within client organisations and materials shared for the engagement.

  • Website usage data — how you interact with our site, collected via analytics (see Cookies below).

  • Technical data — IP address, browser type, and device information, collected automatically when you visit.

  • Business prospect data — business contact details such as name, job title, company, business email address and publicly available professional information.

We collect this information directly from you, from our clients, automatically through our website, and from publicly available professional sources and business-data providers, including Apollo. We use Apollo sparingly and only where we consider the contact and our services to be relevant.

3. How we use your data

We use personal data to:

  • Respond to enquiries and provide information you request;
  • Deliver and manage our services to clients;
  • Send relevant B2B communications about our services, where permitted by law;
  • Improve our website and understand how it is used;
  • Meet our legal and regulatory obligations.

4. Lawful basis for processing

Under the UK GDPR, we rely on the following lawful bases:

  • Contract — where processing is necessary to provide services to a client.
  • Legitimate interests — for responding to business enquiries, running and improving our website, and B2B marketing to relevant contacts, balanced against your rights.
  • Consent — for certain marketing communications and non-essential cookies, which you can withdraw at any time.
  • Legal obligation — where we must process data to comply with the law.

Where we carry out B2B marketing, we use limited business contact data where we have a legitimate interest in promoting services relevant to the recipient. We take account of the recipient's reasonable expectations and provide a clear, simple way to opt out in every marketing message. We do not use personal email addresses for unsolicited electronic marketing where consent is required, unless another lawful PECR route applies.

5. Sharing and processors

We do not sell your personal data. We share it only with trusted third-party service providers ("processors") who help us operate, and only as necessary:

  • Vercel, Render and Cloudflare for website hosting, infrastructure and content delivery;
  • Google Analytics for website analytics, where you consent to analytics cookies;
  • HubSpot for CRM, forms, meetings and scheduling;
  • Apollo for limited B2B prospecting and contact research;
  • Professional advisers where required.

6. Data retention

We keep personal data only for as long as necessary for the purpose for which it was collected, including to meet legal, accounting and reporting requirements. We normally retain:

enquiry and business prospect data for up to 24 months after our last meaningful interaction, unless you ask us not to contact you; client relationship, contract and financial records for up to six years after the end of the relevant financial year or engagement, where required for legal, tax or accounting purposes; and personal data processed for a client, only for the period and purposes set out in our agreement with that client.

7. Your rights

Under the UK GDPR, you have the right to:

Access — request a copy of the personal data we hold about you; Rectification — ask us to correct inaccurate data; Erasure — ask us to delete your data in certain circumstances; Restriction — ask us to limit how we use your data; Portability — receive your data in a portable format; Object — object to processing based on legitimate interests or for direct marketing; Withdraw consent — where we rely on consent, at any time.

To exercise any of these rights, contact us using the details below. We will respond within one month.

8. Cookies

Our website uses cookies and similar technologies to function and to help us understand how the site is used. Essential cookies are necessary for the site to work. Analytics cookies, including those used by Google Analytics, are set only if you consent through our cookie banner. You can change or withdraw your preference at any time using the "Cookie settings" link in the footer of the website.

9. International data transfers

Some of our service providers, including Vercel, Cloudflare, Google, HubSpot and Apollo, may process data outside the UK. Where this happens, we use the safeguards required by UK data-protection law, such as an adequacy regulation or approved contractual safeguards, including the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, as appropriate.

10. How we protect your data

We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or misuse, including access controls, encryption in transit, and working only with reputable service providers.

11. Changes to this policy

We may update this policy from time to time. The date at the top shows when it was last revised. Material changes will be communicated where appropriate.

12. Contact and complaints

For any questions about this policy or to exercise your rights, contact us:

Evolv Optimisation Ltd Email: privacy@evolvagency.io

If you are not satisfied with how we handle your data, you have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority, at ico.org.uk.