Privacy policy
What we collect, why we collect it, and what you can ask us to do about it. Written to be read rather than skimmed past.
Last updated: 5 October 2026
This policy explains what personal data Northlight Reputation Ltd ("we", "us") collects when you use northlightreputation.com or engage us as a client, why we collect it, what we do with it, and the rights you have over it. We are the data controller for that information.
What we collect
Information you give us
- Enquiry details. Your name, email address, company name, the review profile link you send us, and anything you write in the message field of our forms.
- Phone number (optional). If you choose to give us one on a form. The form tells you that by doing so you agree we may call or message you about your enquiry. See Phone calls and messages below.
- Case material. Where you become a client, any material you choose to share so we can work on your case — order references, correspondence, screenshots, and similar records.
- Correspondence. Emails and messages exchanged with us, retained so we have a record of what was agreed.
- Billing information. Company details and billing addresses necessary to raise an invoice. Card payments, where applicable, are handled by our payment provider and we do not store card numbers.
Information collected automatically
- Technical data. IP address, browser type, device type, referring page and the pages you visit, collected through server logs and, where you consent, analytics cookies.
- Cookies. Described in our cookie policy. Analytics cookies are only set if you consent.
Information we obtain from public sources
Where you engage us, our work necessarily involves reviewing publicly available material on review platforms — the content of reviews, public reviewer display names and public account activity. We collect only what is necessary to assess and pursue your case, and we do not build profiles of individuals beyond that purpose.
Why we use it, and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Responding to your enquiry and preparing a free scan | Legitimate interests — responding to a request you made of us |
| Delivering our services once you are a client | Performance of a contract |
| Raising invoices and keeping financial records | Legal obligation, and performance of a contract |
| Assessing and pursuing removal cases | Legitimate interests — providing the service you engaged us for |
| Calling or messaging you on a number you gave us, about your enquiry and the services you asked about | Consent — given when you choose to enter a phone number next to the notice on the form; you can withdraw it at any time |
| Improving our website through analytics | Consent |
| Security, fraud prevention and keeping the site available | Legitimate interests |
Where we rely on legitimate interests, we have considered whether those interests are overridden by your rights, and we will explain our reasoning on request.
Phone calls and messages
You never have to give us a phone number. Our forms work with an email address alone, and most enquiries are answered in writing.
If you do give us a number, the form tells you that by doing so you agree that Northlight Reputation may call or message you on it about your enquiry and the services you have asked about. Entering the number is your consent. We will not call you about anything else, we will not call numbers we were not given this way, and we do not buy, rent or cold-call lists of numbers.
- What we use the number for. Answering questions about the free scan, discussing your case, and confirming details with you while a case is running.
- When we call. Business hours (UK), from a UK number. If you prefer WhatsApp or email, say so and we will switch.
- How we call. Calls are made through a cloud telephony provider acting as our processor. Calls are not recorded unless we tell you at the start of the call and you agree.
- Withdrawing consent. Tell the caller, reply "stop" to any message, or email info@northlightreputation.com. We will stop calling straight away; it does not affect your enquiry or your case.
- How long we keep the number. With the rest of your enquiry: up to 12 months if you do not become a client, and for the life of the engagement plus 6 years if you do.
Marketing
We do not sell your data and we do not share it with third parties for their own marketing. If we send you anything beyond a direct reply to your enquiry, it will be because you asked for it, and every message will contain a one-click unsubscribe.
Who we share it with
We share personal data only where necessary, and only with:
- Service providers who host our site, deliver our email, protect our forms from spam (Google reCAPTCHA), track which marketing brought you to us (WhatConverts, with your consent) and store our files, acting on our instructions under contract.
- Review platforms, where submitting a report on your behalf requires it — and only the material needed for that report.
- Professional advisers such as accountants and lawyers, where genuinely required.
- Authorities, where we are legally obliged to disclose.
Some of our providers are based outside the UK and EEA. Where data is transferred internationally we rely on appropriate safeguards, such as UK International Data Transfer Agreements or the equivalent standard contractual clauses.
How long we keep it
- Enquiries that do not become cases: up to 12 months, then deleted.
- Client case files: for the duration of the engagement and 6 years afterwards, so we can evidence what was done if a matter is revisited.
- Financial records: 6 years, as required by UK tax law.
- Website analytics: no more than 26 months.
Your rights
Under UK data protection law you have the right to:
- Be told what personal data we hold about you and receive a copy of it
- Have inaccurate data corrected
- Have your data erased, where there is no overriding reason for us to keep it
- Restrict or object to our processing, including profiling
- Receive your data in a portable format
- Withdraw consent at any time, where consent is the basis we rely on
To exercise any of these, email info@northlightreputation.com. We will respond within one month. There is no charge unless a request is manifestly unfounded or excessive.
If you are unhappy with how we have handled your data you may complain to the Information Commissioner's Office at ico.org.uk, though we would appreciate the chance to put it right first.
Security
We use access controls, encrypted transmission and encrypted storage, and we limit access to case material to the people working on that case. No system is perfectly secure, but we take this seriously and we will tell you promptly if a breach affects your data.
Children
Our services are for businesses. We do not knowingly collect data from anyone under 18.
Changes to this policy
If we change this policy we will update the date at the top of this page. Material changes affecting how we use data you have already given us will be notified to you directly.
How to contact us
For any question about this policy, or to exercise any of your rights, write to us at info@northlightreputation.com or by post:
Northlight Reputation Ltd
71-75 Shelton Street
Covent Garden
London WC2H 9JQ
United Kingdom
Registered in England & Wales, company number 16428871.
Questions about any of this?
Email us and a person will answer. We would rather explain it than have you guess.