Effective date and last reviewed: 22 September 2026
Makeitaplan Limited is committed to protecting personal data. This notice explains what we collect, why we use it, who receives it, how long we keep it and your rights.
1. Controller and Data Protection Officer
Makeitaplan Limited is the controller. Data Protection Officer: Gemma Cutler.
Email: enquiries@makeitaplan.com
Postal address: Makeitaplan Ltd, 47 Brook Road, Horsham, West Sussex RH12 5FS
Telephone: +44 (0) 203 6579 666
2. Scope and children
This notice covers website visitors, prospective clients, client contacts, suppliers and people who contact us. The site and our consultancy services are directed to organisations and adults. We do not knowingly collect children's personal data through this site. Please contact the DPO if you believe a child has provided personal data.
3. Personal data we collect
- Identity and contact data: name, work role, organisation, postal address, email address and telephone number.
- Enquiry and relationship data: form content, correspondence, preferences, feedback, project requirements and service history.
- Contract, transaction and finance data: quotations, orders, invoices, payments and limited bank information needed for business accounting. We do not collect payment-card details through this website.
- Technical and usage data: IP address, browser/device information, pages, interactions, referral source, approximate location and consent choices where analytics is enabled.
- Marketing data: records of communication preferences, consent, objection or opt-out where relevant.
We do not intend to collect special-category or criminal-offence data through the website. Please do not include such data in the enquiry form unless necessary and agreed with us.
4. How we collect data
We collect data directly when you contact us, submit the Beacon form, request or receive services, communicate with us or provide feedback. Essential security tools collect limited technical data. Google Analytics and Microsoft Clarity collect usage data only with consent. We may receive business-contact data from your organisation, public professional sources, software partners or referrals.
5. Purposes and lawful bases
| Purpose | Data used | Lawful basis |
|---|---|---|
| Respond to enquiries, assess requirements and take steps before a contract. | Identity, contact and enquiry data. | Steps at your request before a contract; legitimate interests in responding to organisational enquiries. |
| Provide consultancy, implementation, migration, training and support. | Contact, project, contract and service data. | Contract; legitimate interests in administering business-to-business services. |
| Manage billing, accounting, tax, disputes and records. | Transaction, finance, contract and correspondence data. | Contract; legal obligation; legitimate interests in debt recovery and legal claims. |
| Operate, secure, troubleshoot and improve the website. | Technical, usage and security data. | Legitimate interests in secure and effective services; consent where PECR requires it. |
| Measure website use with Google Analytics and Microsoft Clarity. | Technical and usage data. | Consent. |
| Send relevant business marketing where used. | Business contact and preference data. | Consent where PECR requires it; otherwise legitimate interests, subject to your absolute right to object. |
| Protect rights, prevent fraud and comply with regulators or law. | Relevant data. | Legal obligation; legitimate interests in security and legal claims. |
Where we rely on legitimate interests, we balance our interests against your rights. Ask the DPO about a specific assessment.
6. Recipients and service providers
We share only necessary data with staff, contractors and professional advisers; Beacon CRM/Beacon Products Ltd and hCaptcha for enquiries; Google Analytics and Microsoft Clarity where consented; GitHub and Cloudflare for hosting, delivery and security; accounting, banking, insurance and IT suppliers; software partners involved in requested services; and public authorities where required.
Processors must use data only under our written instructions and apply confidentiality and security requirements. Some providers act as separate controllers for limited purposes, and their privacy notices also apply.
7. International transfers
Some providers may process personal data outside the UK. Before a restricted transfer, we use a lawful UK mechanism such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to EU Standard Contractual Clauses, or another permitted safeguard or exception. Where required, we complete a transfer risk assessment or data protection test and apply supplementary measures. Contact the DPO for information about relevant safeguards.
8. Security and automated processing
We use proportionate technical and organisational measures including access controls, secure hosting and transport, least privilege, supplier review, backups, confidentiality and incident procedures. We notify affected people and regulators where legally required.
hCaptcha uses automated risk assessment to distinguish genuine form submissions from spam or abuse. This may affect whether a form can be submitted, but it is a security decision rather than a decision producing legal or similarly significant effects. Google Analytics and Microsoft Clarity create usage measurements after consent. We do not make solely automated decisions about individuals that produce legal or similarly significant effects.
9. Retention
| Record | Typical retention |
|---|---|
| General or unsuccessful enquiries | Up to 24 months after last meaningful contact. |
| Client contracts, projects and support records | Contract duration plus 6 years, unless a claim or legal obligation requires longer. |
| Invoices, tax and accounting records | At least 6 years after the relevant financial year. |
| Marketing records | Reviewed at least every 24 months and retained until opt-out or no longer relevant; a minimal suppression record may be retained to honour an objection. |
| Consent record | Until site data is cleared or the consent version changes. |
| Analytics data | The configured provider retention period, reviewed periodically and limited to what is necessary. |
| Complaints and rights requests | Normally 6 years after closure where needed to demonstrate compliance or manage claims. |
We may keep data longer for a live complaint, investigation, litigation hold or legal requirement. Active data is deleted or anonymised when no longer needed. Deleted data may remain in encrypted, access-restricted disaster-recovery backups until those backups rotate out under our backup schedule.
10. Marketing and cookies
You can object to direct marketing at any time by contacting us or using any unsubscribe option provided. We do not sell personal data. Optional analytics and marketing technologies remain off until you consent. Change choices through Cookie settings in the footer. See our Cookie Policy.
11. Your rights
Subject to legal conditions and exemptions, you may request access, correction, erasure, restriction or portability, object to processing, withdraw consent, and challenge relevant automated decisions.
Rights requests are normally free. We may request information to verify identity or clarify the request. We respond without undue delay and usually within one month. The statutory period may be paused while we reasonably await verification or clarification and may be extended where law permits for complex or multiple requests; we will explain any extension or refusal.
12. Data-protection complaints
Complain by email to enquiries@makeitaplan.com, through our electronic contact form, by post to the DPO, or by telephone. We will acknowledge receipt within 30 days, make appropriate enquiries, keep you informed of progress where necessary and provide an outcome without undue delay.
If dissatisfied, you may complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or 0303 123 1113. We would appreciate the opportunity to respond first, but this does not restrict your right to approach the regulator.
13. Changes
We review this notice regularly and update the date above. Material changes may also be communicated directly where appropriate. Please tell us if your personal data changes.