Privacy notice

Who we are

TRG Digital is the digital services arm of The Resource Group Limited, a company registered in England and Wales. We are the data controller for the personal data described in this notice. You can contact us about anything in it at info@trg-digital.com or by post at Bloomsbury Square, London WC1A 2RP.

This notice applies to the website at trg-digital.com and to the enquiries, newsletter sign-ups and analytics connected to it. It is written to meet the UK GDPR and the Data Protection Act 2018, and includes the disclosures required under the California Consumer Privacy Act (CCPA) for visitors in California.

What we collect, and why

We collect personal data in six situations.

• →Enquiries. When you use the Contact us form we collect your name, company, email address, phone number (if given), the services you are interested in and anything you write in the message. We use this to respond to your enquiry, prepare for a strategy call and, if you become a customer, to deliver our services.
• →Newsletter. When you subscribe to the monthly brief we collect your email address and the page you subscribed from. We use this to send you the newsletter, and we record opens and clicks so we can see what is useful. Every email includes an unsubscribe link.
• →Free website audits. When you ask for a free audit we collect your name, work email address, company and website address. We use them to run the audit, email you the report and respond if you ask to discuss it. The audit itself reads only what your website shows publicly. Each report has a private link, and we record when it is opened.
• →Contacting businesses about our services. We sometimes email people at recruitment businesses that we think would benefit from our services. For this we hold a business contact's name, job title, work email address and employer, obtained from the business data provider Apollo and from the company's own website, together with an audit of the company's public website. Every email says who we are and how to opt out, and we keep a do-not-contact list so that anyone who opts out is not emailed again.
• →First-party analytics. We run our own cookieless analytics that record the pages visited, the referring site, your approximate country and the type of device and browser. This does not identify you personally and does not use cookies or persistent identifiers.
• →Google Analytics, with your consent. If you accept analytics cookies in the consent banner, Google Analytics sets cookies and collects usage data so we can understand how the site is used. You can decline, or change your mind later, and the site works the same either way.

We do not collect special category data, and we ask you not to include any in your enquiry. We do not sell personal data, and we do not share it with third parties for their own marketing.

Lawful basis

• →Enquiries: our legitimate interest in responding to people who contact us and in winning new business, and, once you engage us, performance of a contract. We ask for your agreement on the form so that you know how we will use your details.
• →Free website audits: our legitimate interest in providing the audit you asked for and in winning new business. We ask for your agreement on the form so that you know how we will use your details.
• →Contacting businesses about our services: our legitimate interest in promoting our services to businesses likely to need them. We only email people at companies and other corporate bodies, we keep the information to business contact details, and you can object at any time by replying or using the opt-out in any email.
• →Newsletter: your consent, which you can withdraw at any time by unsubscribing.
• →First-party analytics: our legitimate interest in understanding how the website is used, carried out in a way that does not identify individuals.
• →Google Analytics: your consent, given through the cookie banner under the Privacy and Electronic Communications Regulations (PECR).

How long we keep it

• →Enquiries that do not lead to work: 24 months from your last contact with us, then deleted.
• →Customer records: for the length of our engagement and 6 years afterwards, to meet our legal and accounting obligations.
• →Newsletter subscriptions: until you unsubscribe, after which we keep a suppression record of your email address so we do not contact you again.
• →First-party analytics: 26 months, in aggregate form. Google Analytics data is retained for 14 months, and the cookies it sets expire after no more than 2 years.

Who we share it with

We use a small number of service providers to run the website and the services behind it. Each acts as a processor on our instructions and under a written agreement.

• →Vercel hosts the website and serves it from locations close to you.
• →Supabase stores enquiries, newsletter subscriptions and analytics in a database hosted in the European Union.
• →Brevo sends our newsletter and transactional email and records delivery, opens and clicks.
• →Google Analytics (Google Ireland Limited) processes usage data when you have consented to analytics cookies.
• →Apollo supplies business contact details and sends our emails to business contacts.
• →Anthropic and Google PageSpeed Insights process the public content and address of a website when we audit it. We do not send them your contact details.

Some of these providers process data in the United States. Where they do, transfers are covered by the UK International Data Transfer Agreement or Addendum, the UK extension to the EU-US Data Privacy Framework, or standard contractual clauses. We may also disclose personal data where the law requires it.

Your rights

Under the UK GDPR you have the right to:

• →ask for a copy of the personal data we hold about you;
• →ask us to correct data that is wrong or incomplete;
• →ask us to delete your data, or to restrict how we use it;
• →object to processing based on legitimate interests, including any direct marketing;
• →withdraw consent at any time where consent is the basis we rely on;
• →receive your data in a portable format where it is processed by automated means on the basis of consent or contract.

California residents have equivalent rights under the CCPA to know, delete and correct their personal information, and to opt out of its sale or sharing. We do not sell or share personal information as those terms are defined in the CCPA, and we do not discriminate against anyone for exercising their rights.

To exercise any of these rights, email info@trg-digital.com. We will respond within one month. If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk, though we would welcome the chance to resolve it with you first.

Security

The website is served over HTTPS. Access to the systems that hold personal data is limited to the people who need it, protected by authentication and logged. Our providers hold recognised security certifications and encrypt data at rest and in transit.

Changes to this notice

We will update this notice if our practices or providers change. The date at the top shows when it was last revised. Significant changes will be noted on this page.