Privacy Policy

Last updated: 21 July 2026

1. Introduction

Attribution Metrics Limited (“Attribution Metrics”, “we”, “us” or “our”) respects your privacy and is committed to protecting your personal information.

This Privacy Policy explains how we collect, use, store and share personal information when you:

visit our website;
use one of our online tools, calculators or assessments;
contact us or submit an enquiry;
subscribe to our marketing communications;
communicate with us through email, telephone, social media or another channel;
receive business-to-business marketing communications from us;
become, or consider becoming, a client, supplier, partner or referral contact; or
otherwise interact with Attribution Metrics.

This policy also explains your rights under applicable data protection law, including the UK General Data Protection Regulation, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003.

2. Who we are

Attribution Metrics Limited is the controller responsible for the personal information described in this Privacy Policy.

Our company details are:

Company name: Attribution Metrics Limited
Company number: 16381304
Registered office: 66 Paul Street, London, England, EC2A 4NA
Website: attributionmetrics.com
Email: hello@attributionmetrics.com
Telephone: 07447 191830

Attribution Metrics Limited is registered in England and Wales.

We have not appointed a formal Data Protection Officer because we are not currently required to do so.

Questions about this policy or how we process personal information should be sent to hello@attributionmetrics.com.

3. The personal information we collect

The personal information we collect depends on how you interact with us.

3.1 Identity and contact information

This may include:

your name;
job title;
employer or business name;
business address;
email address;
telephone number;
LinkedIn profile or other professional social media details; and
your preferred method of communication.

3.2 Business and professional information

This may include:

your role, department and professional responsibilities;
information about your employer or business;
the industry in which you work;
your organisation’s approximate size, location or turnover;
the marketing, analytics, tracking or reporting technologies used by your organisation;
your organisation’s marketing channels and advertising activity;
your organisation’s business needs, challenges, goals or purchasing intentions; and
information relevant to determining whether our services may be useful to you or your organisation.

3.3 Enquiry and correspondence information

This may include:

information submitted through website forms;
emails, messages and other correspondence;
notes from telephone calls, meetings or consultations;
meeting bookings and calendar details;
proposal, quotation and contract discussions;
customer support requests; and
your communication and marketing preferences.

We may retain notes summarising conversations and interactions so that we can manage our relationship with you and provide an appropriate service.

3.4 Client and transaction information

Where you or your organisation purchases services from us, we may collect:

billing and invoicing information;
transaction and payment records;
details of services purchased;
contracts, statements of work and proposals;
account and project information;
client contacts and authorised users;
service delivery records;
reporting and performance information; and
information required for accounting, taxation, legal or compliance purposes.

We do not ordinarily store complete payment card information. Payments may be processed through banks, payment providers or accounting platforms that process payment information under their own privacy policies.

3.5 Website and device information

When you visit our website, we may collect information such as:

your IP address;
browser type and version;
device type;
operating system;
approximate geographic location;
time zone;
pages visited;
links and buttons clicked;
referring website or campaign;
date and time of visits;
time spent on pages;
website navigation and interaction information;
campaign parameters, such as UTM values;
cookie identifiers and similar online identifiers; and
information about website errors, performance and security events.

Some of this information may only be collected where you have provided the required cookie consent.

3.6 Marketing and engagement information

We may collect information about your interaction with our marketing, including:

whether a marketing email was delivered;
whether an email was opened;
whether a link was clicked;
whether you replied;
whether you unsubscribed or objected;
the campaign, advertisement or referral source associated with an enquiry;
social media advertising interactions;
website conversions;
form submissions;
booked calls; and
other actions taken after interacting with our marketing.

Email opening information may not always be accurate because email applications and privacy features can block, preload or automatically interact with tracking technologies.

3.7 Calculator, assessment and diagnostic information

If you complete a calculator, risk assessment, audit questionnaire or similar tool, we may collect:

your contact and business information;
your answers to assessment questions;
information about your organisation’s marketing activity, analytics, tracking and reporting;
marketing budget or revenue ranges;
the channels and platforms your organisation uses;
calculated scores, risk levels, estimates and recommendations;
whether you started or completed the assessment;
the date and time of completion;
the report generated for you; and
your interactions with follow-up communications.

The outputs of our calculators and assessments are indicative estimates based on the information provided. They do not constitute financial, legal or professional assurance.

Please do not submit confidential information, personal customer data, passwords, authentication credentials or special category personal information through an assessment unless we have specifically requested it through an approved secure process.

3.8 Social media information

When you interact with us through LinkedIn, Facebook, Instagram or another social media platform, we may receive:

your name and profile information;
your username;
your public professional information;
your comments, reactions and messages;
information you choose to share with us; and
advertising, audience or campaign information made available by the platform.

The relevant social media platform will also process your information under its own privacy policy.

3.9 Information obtained from third parties and public sources

We may obtain business contact information from:

publicly available company websites;
professional networking platforms such as LinkedIn;
Companies House and other public registers;
event, networking or membership directories;
referrals and introductions;
commercial business-information and prospecting providers;
clients, suppliers and business partners; and
information already made public by you or your organisation.

This may include your name, business email address, employer, job title, industry, location, company details and other professional information.

We do not knowingly purchase or use lists containing sensitive personal information for marketing.

4. How we use personal information

We may use personal information to:

operate and improve our website;
respond to enquiries and requests;
arrange calls, meetings and consultations;
assess whether our services are suitable for you or your organisation;
prepare proposals, quotations and contracts;
deliver analytics, attribution, tracking, reporting, advertising and consultancy services;
manage client projects and relationships;
administer contracts, invoicing and payments;
provide reports, recommendations and service communications;
operate calculators, assessments and diagnostic tools;
send requested reports or assessment results;
maintain our customer relationship management system;
manage leads, opportunities and sales activity;
send relevant business-to-business marketing;
send newsletters and other marketing where permitted;
measure email and campaign engagement;
create and manage advertising campaigns;
measure advertising performance and conversions;
create remarketing or advertising audiences where permitted;
improve our services, content, marketing and business operations;
understand how visitors use our website;
prevent fraud, misuse, unauthorised access and security incidents;
maintain records of consent, objections, suppression and opt-out requests;
comply with legal, regulatory, taxation and accounting obligations;
establish, exercise or defend legal claims; and
protect our rights, property, systems, clients and users.

We will not use personal information for a materially incompatible purpose without providing additional information and, where necessary, obtaining consent.

5. Our lawful bases

We only process personal information where we have a lawful basis.

5.1 Contract

We may process personal information where it is necessary to:

provide services under a contract;
take requested steps before entering into a contract;
prepare a proposal or quotation;
manage a client relationship; or
fulfil our contractual obligations.

5.2 Legitimate interests

We may rely on legitimate interests where the processing is reasonably necessary for our business or the legitimate interests of another organisation, provided those interests are not overridden by your rights and freedoms.

Our legitimate interests may include:

operating and growing our business;
responding to business enquiries;
managing relationships with clients, prospective clients, suppliers and partners;
identifying organisations that may benefit from our services;
conducting relevant business-to-business marketing;
maintaining accurate CRM records;
measuring and improving our marketing;
improving our services and website;
preventing fraud and protecting our systems; and
establishing, exercising or defending legal claims.

Where we rely on legitimate interests, we consider the nature of the information, the context in which it was collected, whether you would reasonably expect the processing, the likely impact on you and the safeguards available to you.

You have an absolute right to object to the use of your personal information for direct marketing.

5.3 Consent

We may rely on your consent for:

non-essential analytics cookies;
advertising, remarketing and social media tracking technologies;
marketing communications where consent is legally required;
optional newsletter subscriptions; and
other processing where we specifically ask for permission.

You may withdraw consent at any time. Withdrawing consent will not affect processing that took place before consent was withdrawn.

5.4 Legal obligation

We may process information where necessary to comply with:

taxation and accounting requirements;
company and commercial law;
data protection requirements;
court orders;
regulatory obligations; and
other legal duties.

5.5 Legal claims and vital interests

In limited circumstances, we may process information where necessary to protect someone’s vital interests or to establish, exercise or defend legal claims.

6. Business-to-business marketing

We may contact individuals at companies, limited liability partnerships, public bodies and other corporate organisations where we believe our services may be relevant to their professional responsibilities or organisation.

We may use professional contact information collected from public sources, referrals or reputable business-information providers.

Before using personal information for business-to-business marketing, we consider:

whether the communication is relevant to the recipient’s professional role;
whether the recipient would reasonably expect to receive it;
the source and nature of the information;
the likely impact on the recipient; and
whether the recipient can easily object or opt out.

Every marketing email we send will identify Attribution Metrics and provide a way to unsubscribe or object to further marketing.

Where marketing consent is required by law, we will only send marketing where we have the necessary consent or another applicable exemption.

We maintain a suppression list containing limited information about individuals and organisations that have unsubscribed or objected. This information is retained to ensure that we do not contact them again accidentally.

You can object to marketing at any time by:

using the unsubscribe link in an email;
replying to the email and asking us to stop; or
contacting us using the details in this policy.

Service messages, contractual communications, responses to enquiries and other non-marketing communications may still be sent where necessary.

7. Escaler CRM and email marketing

We use Escaler as a customer relationship management and email marketing platform.

Information stored or processed through Escaler may include:

names and business contact details;
company and job information;
lead sources;
CRM stages, tags and status information;
records of calls, meetings and correspondence;
email campaign information;
delivery, opening and click information;
unsubscribe and suppression information;
form submissions;
calculator completion information;
assessment scores and reports;
notes about business requirements; and
details of proposals, opportunities and client relationships.

We use this information to manage enquiries, prospective clients, active clients, marketing communications and business relationships.

Escaler processes information on our behalf as a service provider. Its processing, hosting arrangements, subprocessors and security measures are governed by its contractual terms and privacy documentation.

8. Google Analytics 4

We use Google Analytics 4 to understand how visitors use our website and to measure website and marketing performance.

Depending on our configuration and your cookie choices, Google Analytics may process information such as:

pages viewed;
events and interactions;
approximate location;
device and browser information;
referral source;
campaign information;
session information;
website conversions; and
online identifiers.

Google Analytics does not provide us with your complete IP address as a standard reporting field.

Where required, Google Analytics will only operate after you have provided consent through our cookie controls.

You can withdraw or change your choice through the cookie settings available on our website.

We may use Google Analytics with other Google services, such as Google Ads, to measure campaigns, conversions and audiences.

Advertising-related functionality will only be activated where appropriate consent and platform requirements have been satisfied.

Google may process information on servers located outside the United Kingdom. Further information about Google’s processing is available through Google’s privacy and data-processing documentation.

9. Advertising and social media platforms

We may use advertising and social media platforms including:

LinkedIn;
Facebook;
Instagram;
Meta advertising services;
Google Ads;
YouTube; and
other relevant marketing platforms.

These platforms may be used to:

publish content;
communicate with prospective clients;
advertise our services;
measure campaign performance;
attribute enquiries and conversions;
create audiences;
exclude existing clients or contacts from campaigns;
retarget website visitors; and
understand how users interact with our advertisements.

Where installed, advertising technologies such as the LinkedIn Insight Tag, Meta Pixel, Google Ads tags or similar tools may collect information about your device, browser, website activity and interactions.

Advertising and remarketing technologies will only be used where permitted and, where required, after you have provided consent through our cookie controls.

Some platforms may act as independent controllers for information they collect and use for their own purposes.

Their processing is governed by their own privacy policies and account settings.

10. Cookies and similar technologies

Our website may use cookies, pixels, tags, scripts, local storage and similar technologies.

These technologies may be used for:

essential website functionality;
security and fraud prevention;
remembering preferences;
website analytics;
campaign measurement;
advertising;
social media functionality;
conversion tracking; and
remarketing.

Strictly necessary technologies may be used without consent where they are required to provide the website or a service you have requested.

Analytics, advertising and other non-essential technologies will only be used where we have obtained the consent required by law.

Our cookie banner or preference centre allows you to accept, reject or manage non-essential technologies.

More detailed information, including the technologies used, their providers, purposes and durations, may be provided in a separate Cookie Policy.

11. Automated processing and profiling

We may use limited automated processes to:

calculate assessment or risk scores;
generate calculator reports;
categorise enquiries;
assign CRM stages or tags;
measure engagement;
identify potentially relevant follow-up communications;
create advertising audiences; and
prioritise business leads.

For example, information submitted through a marketing risk assessment may be used to calculate an indicative risk level, estimated impact or recommended next step.

These processes are intended to support our marketing, reporting and service delivery.

We do not ordinarily make decisions that produce legal or similarly significant effects about individuals solely through automated processing.

Where a decision with a significant effect is made using automated processing, we will provide any additional notices and safeguards required by law.

12. Sharing personal information

We may share personal information with carefully selected third parties where necessary.

These may include:

CRM and email marketing providers, including Escaler;
website hosting and domain providers;
cloud storage and productivity providers;
analytics providers, including Google;
advertising and social media platforms;
website, software and technology providers;
calendar, meeting and communication platforms;
accounting, invoicing, banking and payment providers;
professional advisers, including accountants, solicitors and insurers;
contractors and specialist service providers working on our behalf;
business partners and referral partners where appropriate;
regulators, law enforcement bodies, tax authorities or courts;
parties involved in a business sale, restructuring, investment or acquisition; and
other parties where you have asked us to share information or have consented to the sharing.

Where a third party acts as our processor, we require it to process personal information only on our instructions, protect the information and comply with applicable data protection requirements.

We do not sell personal information to third parties.

We do not share personal information with unrelated organisations so they can independently market their products or services to you unless you have expressly agreed.

13. Client data processed through our services

When providing analytics, tracking, reporting, advertising or consultancy services, we may process personal information on behalf of our clients.

In those circumstances:

the client will usually be the controller;
Attribution Metrics will usually act as a processor;
we will process the information in accordance with the client’s documented instructions and our contract;
the client is responsible for determining the lawful basis and providing appropriate privacy information to its users, customers and contacts; and
requests relating to that information should ordinarily be directed to the relevant client.

Our client contracts may include additional data-processing provisions governing this activity.

We may also process limited client contact, billing, account and relationship information as an independent controller for our own administration, legal, accounting and business purposes.

14. International transfers

Some of our service providers and marketing platforms may process personal information outside the United Kingdom.

Where personal information is transferred to a country that has not been recognised as providing an adequate level of protection, we will take appropriate steps to protect it.

These may include:

the UK International Data Transfer Agreement;
the UK Addendum to the European Commission’s Standard Contractual Clauses;
another legally approved transfer mechanism;
contractual, technical and organisational safeguards; or
reliance on an applicable adequacy regulation.

You may contact us for further information about the safeguards used for a particular transfer.

15. How long we retain personal information

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, including legal, accounting, taxation, security and reporting requirements.

Our typical retention periods are set out below.

15.1 Enquiries and prospective clients

We will generally retain enquiry and prospect information for up to three years after the most recent meaningful interaction, unless:

a longer period is reasonably required because the opportunity remains active;
you ask us to delete it;
you object to our use of the information; or
we are legally required to retain it.

15.2 Marketing contacts

We retain active marketing information while there is a valid reason to continue the relationship or until you unsubscribe or object.

Where you unsubscribe or object, we may retain minimal information on a suppression list indefinitely, or for as long as reasonably necessary, to ensure that your preference continues to be respected.

15.3 Calculator and assessment records

We will generally retain calculator and assessment submissions for up to three years after submission or the most recent related interaction, unless the information becomes part of an active or former client relationship.

15.4 Client and contractual records

We will generally retain contracts, invoices, service records and relevant correspondence for up to seven years after the end of the client relationship, reflecting legal, contractual, taxation and accounting requirements.

15.5 Analytics information

Google Analytics event-level data will be retained according to the retention setting configured in our Google Analytics property.

Aggregated reporting information may remain available for longer.

15.6 Cookie and consent records

Cookie choices and consent records may be retained for as long as necessary to demonstrate compliance and remember your preferences.

15.7 Legal disputes

Information relevant to an actual or anticipated legal dispute may be retained until the matter is resolved and applicable limitation periods have expired.

We may securely anonymise information instead of deleting it.

Once information has been irreversibly anonymised, it is no longer personal information.

16. Information security

We use reasonable technical and organisational measures designed to protect personal information against:

unauthorised access;
loss or destruction;
misuse;
alteration;
accidental disclosure; and
unlawful processing.

These measures may include:

access controls;
password and account security;
multi-factor authentication where available;
secure cloud services;
data minimisation;
staff and contractor confidentiality obligations;
software and system updates;
backups;
restricted access based on business need; and
contractual controls with service providers.

No method of internet transmission or electronic storage is completely secure.

Although we take reasonable steps to protect personal information, we cannot guarantee absolute security.

17. Your data protection rights

Depending on the circumstances, you may have the following rights.

17.1 Right to be informed

You have the right to receive clear information about how we use your personal information.

17.2 Right of access

You may request confirmation of whether we process your personal information and ask for a copy of it.

17.3 Right to rectification

You may ask us to correct inaccurate information or complete information that is incomplete.

17.4 Right to erasure

You may ask us to delete your personal information in certain circumstances.

This right is not absolute. We may need to retain information where it is required for legal, accounting, contractual, security or compliance reasons.

17.5 Right to restrict processing

You may ask us to restrict the use of your personal information in certain circumstances.

17.6 Right to object

You may object to processing based on legitimate interests.

You have an absolute right to object to the use of your personal information for direct marketing.

Once you object, we will stop using your information for that purpose.

17.7 Right to data portability

Where applicable, you may request information that you provided to us in a structured, commonly used and machine-readable format or ask us to transfer it to another controller.

17.8 Rights relating to automated decision-making

You may have rights relating to decisions made solely through automated processing that produce legal or similarly significant effects.

17.9 Right to withdraw consent

Where we rely on consent, you may withdraw that consent at any time.

17.10 Right to complain

You have the right to complain to the Information Commissioner’s Office if you are concerned about how we use your personal information.

We would appreciate the opportunity to address your concerns first, so please contact us using the details in this policy.

The Information Commissioner’s Office can be contacted through its website at ico.org.uk.

18. Exercising your rights

To exercise your data protection rights, contact us using the following details:

Email: hello@attributionmetrics.com
Telephone: 07447 191830
Address: Attribution Metrics Limited, 125–129 Chertsey Road, Woking, England, GU21 5BP

Please clearly describe:

the right you wish to exercise;
the information or processing activity concerned; and
any information that will help us locate the relevant records.

We may ask for information reasonably necessary to confirm your identity and protect personal information from unauthorised disclosure.

We will usually respond within one month.

Where a request is complex or multiple requests are received, the response period may be extended where permitted by law.

There is normally no charge for exercising your rights.

We may charge a reasonable fee or refuse to act where a request is manifestly unfounded or excessive, where permitted by law.

19. Third-party websites and services

Our website, emails and reports may contain links to websites, platforms or services operated by third parties.

We do not control those third parties and are not responsible for their privacy practices.

You should review the privacy policy of the relevant organisation before providing personal information or using its services.

20. Children’s information

Our website and services are intended for businesses and professionals and are not directed at children.

We do not knowingly collect personal information from children.

If you believe a child has provided personal information to us, please contact us so that we can investigate and, where appropriate, delete it.

21. Special category information

We do not ordinarily require special category personal information, such as information about health, ethnicity, religious beliefs, political opinions, trade union membership, sexual orientation, genetics or biometrics.

Please do not provide this information unless it is genuinely necessary and we have specifically requested it through an appropriate process.

If special category information is processed, we will ensure that an appropriate lawful basis and additional legal condition apply.

22. Changes to this policy

We may update this Privacy Policy from time to time to reflect:

changes to our services;
new systems or providers;
changes to our data-processing activities;
changes to legal or regulatory requirements; or
improvements to the way we explain our practices.

The latest version will be published on our website with the updated date shown at the top.

Where changes are significant, we may take additional steps to bring them to your attention.

23. Contact us

Questions, requests or concerns relating to this Privacy Policy or our use of personal information should be sent to:

Attribution Metrics Limited
66 Paul Street
London
England
EC2A 4NA

Email: hello@attributionmetrics.com
Telephone: 07447 191830
Company number: 16381304