This policy explains what personal information Mares & Makers collects when you use this website or work with us, why we collect it, who we share it with, and what control you have over it. We are the “data controller” for that information under the UK GDPR and the Data Protection Act 2018.
1. Who we are and how to contact us
Mares & Makers is a UK-based sole trader business providing websites, social media, marketing services and digital products to equine businesses. In this policy, “we”, “us” and “our” mean Mares & Makers.
We are the controller of the personal data described below. If you have any question about this policy, or you want to exercise any of your rights, contact us:
- Email: lilah@maresandmakers.co.uk
- Website: maresandmakers.co.uk
- Postal address: available on request by email.
We are not required to appoint a Data Protection Officer, so privacy enquiries are handled directly by the business owner.
2. The information we collect
Information you give us
- Free audit request form: your name, email address, phone number (optional), your current website address (optional) and your social media handles (optional).
- Free guide and mailing list sign-up: your email address.
- Buying a digital product: your name, email address and billing country/postcode, which you give on our payment provider’s checkout page, plus a record of what you bought, when, and that you asked for immediate access.
- Direct contact: anything you include when you email or message us, including the content of the message itself.
- Clients: if you go on to work with us, the information needed to deliver and invoice the work — for example business and billing details, brand assets, photographs you supply, and any account access you choose to share with us. When you accept a proposal we record your name and the date you accepted, and we keep the answers you give in our client onboarding form.
- Direct Debit: if you pay a monthly plan by Direct Debit, you give your bank details to GoCardless, our Direct Debit provider, when you set it up. We see your name, email, the last digits of your account and the status of each payment, but not your full bank details.
Information we collect automatically
- Technical and server log data. Our host (Cloudflare) automatically records information such as your IP address, the pages requested, the date and time, your browser type and the referring page. This is standard for any website and is used for security, abuse prevention and keeping the site running.
- Browser storage. We store a small amount of information in your own browser so the site behaves sensibly — for example remembering that you have already closed the free-guide pop-up during this visit. We do not use advertising cookies or third-party analytics tracking. Full detail is in our Cookie Policy.
What we do not collect
Card and bank details are entered directly with our payment providers (Stripe and GoCardless), never on our own pages, so we never see or store your full card number or bank account details. We do not knowingly collect special category data (such as health or ethnicity), and we ask that you do not send it to us unless it is genuinely necessary for the work.
3. Why we use it, and our lawful basis
UK data protection law requires us to have a valid lawful basis for every use of your personal data. Ours are set out below.
| What we do | Data used | Lawful basis |
|---|---|---|
| Respond to your free audit request or general enquiry, and prepare a quote or proposal | Name, email, phone, website, social handles, message content | Legitimate interests — answering people who have asked us to get in touch, and running the business. Where you are asking us to quote for work, also steps prior to entering a contract. |
| Deliver the services or digital products you have bought, and provide support | Contact and business details, project materials, order details | Performance of a contract with you. |
| Take payment, deliver your download, set up and collect Direct Debits, and send invoices and receipts | Name, email, order and payment records, Direct Debit status | Performance of a contract with you. |
| Send you the free guide and, after that, occasional marketing emails | Email address | Consent, which you give when you sign up and can withdraw at any time. |
| Invoicing, accounts and tax records | Name, contact details, transaction records | Legal obligation (tax and accounting law) and legitimate interests in keeping proper business records. |
| Keep the website secure, prevent spam and abuse, and fix faults | IP address, server logs, technical data | Legitimate interests — protecting the site and the people who use it. |
| Use your feedback, results, name or logo as a testimonial or case study | Name, business name, quote, images | Consent — we ask you first, and you can withdraw it. |
| Establish, exercise or defend legal claims | Relevant records | Legitimate interests and, where applicable, legal obligation. |
Where we rely on legitimate interests, we have considered whether that use is fair to you and whether you would reasonably expect it. You can object to that processing at any time — see Your rights.
We do not carry out automated decision-making or profiling that produces legal or similarly significant effects for you.
4. Who we share it with
We do not sell your personal data and we do not share it for anyone else’s marketing. We do use a small number of trusted suppliers who process data on our behalf, under contracts requiring them to keep it secure and use it only on our instructions:
| Supplier | What they do for us | Where |
|---|---|---|
| Cloudflare | Hosts the website and the contact form endpoint; provides security and server logging | Global network, including the USA |
| Resend | Delivers the notification email that tells us you have submitted an enquiry | USA |
| CallMeBot | Optional WhatsApp alert so we see new enquiries quickly | EU / global |
| IONOS | Provides our business email and domain | UK / EU |
| Google Fonts | Serves the typefaces used on this site; your IP address is visible to Google when the fonts load | USA |
| Stripe | Takes card and wallet payments for digital products and confirms each order to us | UK / EU / USA |
| GoCardless | Sets up and collects Direct Debits for monthly plans | UK / EU |
| Monzo | Our business bank account — receives bank transfers and payouts | UK |
| Email marketing provider (MailerLite) | Sends the free guide follow-ups and any mailing-list emails, if and when you subscribe | EU / USA |
| Accountant and bookkeeping software | Invoicing, accounts and tax | UK |
We may also disclose personal data where we are legally required to — for example to HMRC, a regulator, or in response to a valid court order — and to professional advisers where necessary. If the business is ever sold or transferred, your data may pass to the buyer on the same terms as this policy.
5. Marketing emails
If you give us your email address to receive the free guide, you are also consenting to receive occasional emails from us with tips, offers and news about Mares & Makers products and services. We tell you this at the point you sign up.
You can stop those emails at any time — use the unsubscribe link in any email, or email lilah@maresandmakers.co.uk and we will remove you. Withdrawing consent does not affect emails already sent, and does not stop us replying to your enquiries or contacting you about work we are doing for you.
We keep a suppression record of unsubscribed addresses so that we do not accidentally email you again.
6. How long we keep it
- Enquiries that do not become work: up to 24 months from your last contact with us, then deleted.
- Client records and project files: for the length of the engagement and then up to 6 years, covering the limitation period for contract claims.
- Invoices, receipts and accounting records: at least 6 years after the end of the relevant tax year, as tax law requires.
- Mailing-list subscribers: until you unsubscribe or ask us to delete you. We review the list periodically and remove long-inactive addresses.
- Server and security logs: retained by our host for a short period, typically no more than 30 days.
When a retention period ends we delete the data or anonymise it so it can no longer identify you.
7. Transfers outside the UK
Some of our suppliers are based outside the UK, including in the United States. Where personal data is transferred outside the UK we make sure it is protected by an appropriate safeguard recognised under UK data protection law — normally the UK International Data Transfer Agreement, or the UK Addendum to the European Commission’s Standard Contractual Clauses, together with a transfer risk assessment. You can ask us for details of the safeguard used for any particular supplier.
8. How we keep it safe
We use appropriate technical and organisational measures to protect your data, including HTTPS encryption across the whole website, access controls, strong unique passwords with two-factor authentication on business accounts, limiting access to those who need it, and keeping software up to date. No system is completely secure, but if a personal data breach happens that is likely to result in a risk to your rights and freedoms, we will report it to the Information Commissioner’s Office within 72 hours and tell you directly where the law requires it.
9. Your rights
Under UK data protection law you have the right to:
- Be informed about how we use your data — which is what this policy is for.
- Access a copy of the personal data we hold about you.
- Rectification — have inaccurate or incomplete data corrected.
- Erasure — ask us to delete your data where there is no good reason for us to keep it.
- Restrict processing — ask us to pause how we use your data while a concern is resolved.
- Data portability — receive data you gave us in a common machine-readable format, where processing is based on consent or contract and carried out by automated means.
- Object — to processing based on our legitimate interests, and at any time to direct marketing. We will always stop marketing on request.
- Withdraw consent at any time where we rely on consent.
To exercise any of these, email lilah@maresandmakers.co.uk. It is free, and we will respond within one month. If a request is unusually complex we may extend that by up to two further months and will tell you if so. We may ask you to confirm your identity before releasing personal data.
10. Complaints
If you are unhappy with how we have handled your personal data, please tell us first so we can put it right. You also have the right to complain to the UK supervisory authority:
Information Commissioner’s Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Helpline: 0303 123 1113 · ico.org.uk/make-a-complaint
11. Children
This website and our services are aimed at people running or starting a business and are not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us their data, email us and we will delete it.
12. Changes to this policy
We may update this policy from time to time — for example if we start using a new supplier or offer a new service. The current version is always on this page, with the date it was last updated shown at the top. If we make a significant change we will make that clear on the website or tell subscribers by email.
Contact us about privacy
Email lilah@maresandmakers.co.uk with “Privacy” in the subject line.
See also our Cookie Policy and Terms & Conditions.