Privacy Policy | Elms Agency

This policy explains what personal data Elms Agency collects, why we collect it, and the rights you have over it. Elms Agency is a trading name of Elms Creative Solutions Limited, registered in England and Wales (company no. 14502080), registered office 1 Cobden Court, Wimpole Close, Bromley, BR2 9JF. You can reach us at hello@elmsagency.com.

It covers two different things, and our role is different in each: this website, where we are the data controller for your enquiry, booking and analytics data (see below); and Parity, our Shopify app, where the merchant using the app controls their own store's data and we act as a data processor on their instructions (see the Parity section).

What we collect

Enquiry details. When you use our contact form we collect your name, email address, the store website you enter, the budget range you select and any message you send.
Booking details. If you book a call with us, we collect the details you give us to arrange it.
Usage data. With your consent, we collect information about how the site is used through analytics tools. See our Cookie Policy.
Technical data. Our hosting provider processes standard server information such as your IP address and browser type to serve the site securely.
Business identification. We use Leadfeeder, a B2B visitor identification service, to work out which organisation a visit came from, by looking up the IP address it arrived on. It tells us a company name and public business details such as an industry, a size and a registered address. It does not tell us who you are: we learn that someone at a company looked at the site, not which person, and we make no attempt to work that out. It runs under the marketing category on our cookie banner, and stops when you switch that category off.
Unfinished enquiry forms. Our enquiry form saves each answer as you move through it, rather than only when you press send. If you stop partway and do not come back, we keep what you had already entered. We do this so that a genuine enquiry is not lost because the form was interrupted, and so we can see which questions people find difficult. If you left us a way to reach you, we may use it to follow up on the enquiry you started. If you come back to the form on the same device, we offer to reload what you had entered so you can carry on rather than start over; your answers stay with us and are only sent back to the browser that entered them.

Why we use it, and our lawful basis

To reply to your enquiry and provide our services. Lawful basis: taking steps at your request before entering a contract, and our legitimate interest in responding to you.
To measure and improve the site. Lawful basis: your consent, which you give through our cookie banner and can withdraw at any time. Analytics stays off until you turn it on.
To measure advertising. Our advertising pixel loads when you arrive and stops for good once you switch marketing off in Preferences on the cookie banner. We are telling you this plainly rather than describing it as consent, because a category that is already on when you land is not something you have agreed to. You can turn it off at any time and it will stay off.
To recognise which businesses are looking at our site, so we can tell whether a company we are already talking to is still interested, and so we know which of our pages bring the right kind of business to us. Lawful basis: our legitimate interest in understanding and following up on business interest in our services. We have weighed that against your privacy and recorded the result. What tips the balance is that this identifies a company rather than a person, and that the information involved is the kind a business already publishes about itself. As with the pixel above, it loads under a category that is on when you arrive, so we are describing it rather than calling it consent. Switch marketing off and it stops. You can also object to it at any time using the contact details below.
To follow up on an enquiry you started but did not finish. Lawful basis: our legitimate interest in responding to a potential client who approached us. Where we send marketing email, we do so only to business contacts and every message carries a one-click unsubscribe. You can tell us to stop at any time, and we will.
To keep the site secure and working. Lawful basis: our legitimate interest in a safe, reliable service.

Who we share it with

We do not sell your personal data. We share it only with the service providers that help us run the business, and only as far as they need it:

Cloudflare, our hosting provider, which also counts page views for us.
Google Analytics and Upstack, our analytics providers.
Leadfeeder, our business identification provider.
Sanity, our content platform.
Our email provider, to receive and reply to your enquiry.
Capsule, our customer relationship manager, and Transpond, its email tool.

Some of these providers may process data outside the UK. Where they do, we rely on the safeguards required by UK data protection law.

Parity: our Shopify app

Parity is a Shopify app we build and run, which lets merchants edit per-market product prices. If you are a merchant using Parity, this section explains what it stores, who it shares data with, and how to have it deleted. For this section only, you (the merchant) are the data controller of your store's data; we process it as a service provider, on your instructions, for the purposes below. Parity does not collect or store any data about your customers.

What Parity accesses in your store

The app asks to read and write two things, and Shopify shows you this before you approve installation:

Products. To show your variants and prices in the grid, and to save your price changes back to Shopify.
Markets. To list the markets and price lists you sell into, and to set fixed per-market prices.

It does not request access to customers, orders, or any other part of your store. If a future version needs a new permission, Shopify requires you to approve it before it takes effect.

What Parity stores

Data	Why
Your shop's myshopify.com domain and Shopify access token	To stay signed in and to call Shopify on your behalf, including for scheduled sales that fire when nobody is logged in.
The name, email address and locale of the staff member using the app	Shopify provides these when a staff member signs in. They are used to attribute price changes in the audit log.
Product, variant, market and price-list identifiers, and the prices you set	To show the grid, to schedule sales, and to record what changed.
An audit log of every price change: before value, after value, who made it, and when	So you can see the history and undo a change.
Scheduled sales and scheduled price changes you create	So the app can apply and revert them at the times you chose.
Your saved pricing-rule templates	So you can reuse a rule instead of rebuilding it.
Your margin settings: payment-processor rates and any manual FX rate override	To estimate margin per market. These are numbers you enter, not anything read from your payment provider.
If you connect a Google Sheet: its ID, URL, tab name, and who connected it	To push and pull prices to that sheet. Optional, and only if you set it up.

There is no row above for customers, orders, shopper names, email addresses, or payment details, because the app does not store them.

Who else sees Parity data

Parity data is not sold, and it is not shared for advertising. It reaches these services only:

Shopify, the source of your product and market data, and where price changes are written.
Railway, which hosts the app and its database.
Sentry, for error reporting, so a failed scheduled sale is noticed rather than silently swallowed. Reports include your shop domain, because "a sale failed" is not actionable without it. They deliberately exclude staff email addresses, which are stripped before an event is sent.
open.er-api.com, a public exchange-rate feed, used to estimate margins. It is asked only for a currency rate; no data about you or your store is sent to it.
Google Sheets, only if you connect a sheet. Then the prices you choose to sync are written to the spreadsheet you nominated.

How long Parity data is kept, and how to delete it

When you uninstall Parity, your session is deleted immediately, which ends the app's access to your store. Shopify then notifies the app to erase the rest, and everything else listed above is deleted at that point. Shopify allows apps up to 48 hours for this, and it is done as soon as that notification arrives.

You can also request erasure at any time by emailing hello@elmsagency.com. If you are in the UK or EU, you have the right to access, correct, export, or erase your personal data, and to complain to your data protection authority (in the UK, the ICO).

Because Parity holds no shopper data, a customer data request or customer erasure request from Shopify finds nothing to return or delete. Those requests are still received and handled.

How long we keep website enquiry and booking data

We keep enquiry and booking details only as long as we need them to respond to you and for our reasonable business records, then delete them. Analytics data is kept for the retention period set in the analytics tools. For Parity data, see the Parity section above.

Your rights

Under UK data protection law you have the right to access, correct, delete, restrict or object to our use of your personal data, and the right to data portability. Where we rely on consent, you can withdraw it at any time. To use any of these rights, email us at hello@elmsagency.com.

If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk.

Changes to this policy

We may update this policy from time to time. The date at the top shows when it last changed.

Contact

Any questions about this policy or your data: hello@elmsagency.com.