Legal

Privacy & cookies

Last updated

This policy explains how Three of Us collects, uses and protects personal information when you visit threeofus.co, get in touch with us or sign up to our newsletter. We're the controller of that information under UK data protection law, including the UK GDPR and the Data Protection Act 2018.

Who we are

Three of Us is a trading name of Sustainable Gro Co Ltd, registered in England and Wales (company number [number]), with its registered office at [registered office address]. If you have any questions about this policy or your information, email us at hello@threeofus.co.

What we collect

We only collect what we need:

  • When you contact us through the website: your name and email address, plus anything else you choose to give us, such as your company, website, your answers to our questions and your message.
  • When you sign up to our newsletter: your email address.
  • When you email, call or meet us: your contact details and what we discuss.
  • When you use the website: technical information such as your IP address, browser and device type, and the pages you visit. Some of this is collected using cookies (see below).
  • When you make a choice in our cookie banner: a record of that choice, with the date and time, your IP address and browser details, so we can respect it and show what you agreed to.

How we use it

We use your information to:

  • reply to your enquiry and, if you'd like, prepare a proposal. Our lawful basis is taking steps at your request before entering into a contract, and our legitimate interest in responding to people who contact us.
  • send you our newsletter, if you've signed up. Our lawful basis is your consent, and you can unsubscribe at any time using the link in every email.
  • understand how the website is used, so we can improve it. Our lawful basis is your consent, which you give or refuse in our cookie banner.
  • remember your cookie choices and keep a record of them. Our lawful basis is our legal obligation to be able to show that we asked for your consent.
  • keep the website secure, and meet our legal and accounting obligations.

We don't sell your information, and we don't use it to make automated decisions about you.

Who we share it with

We use trusted service providers to run the website and our business, and they only process your information on our instructions:

  • Vercel, which hosts the website
  • Sanity, which manages the website's content
  • Resend, which delivers the emails sent from our contact form
  • Neon, which hosts the database where we keep records of cookie choices
  • Google, which provides website analytics (Google Analytics, loaded through Google Tag Manager)
  • YouTube and Vimeo, if you allow marketing cookies and play a video embedded on the website
  • Mailchimp (Intuit), which sends our newsletter

Some of these providers store information outside the UK. Where they do, we make sure appropriate safeguards are in place, such as the UK's adequacy regulations or the International Data Transfer Agreement.

We may also share information where the law requires it, or with our professional advisers.

How long we keep it

  • Enquiries that don't lead to working together: up to two years, in case you get in touch again.
  • Client records: for as long as we work together, then for six years to meet legal and accounting requirements.
  • Newsletter subscriptions: until you unsubscribe.
  • Analytics data: for the period set in our analytics settings, usually no more than 26 months.
  • Records of your cookie choices: for as long as we need to show what you agreed to. Your browser remembers your choice for a year, after which we'll ask again.

Cookies

Cookies are small files that a website stores on your device. When you first visit, a banner asks which cookies you're happy for us to use. Apart from necessary cookies, nothing is stored until you choose. You can change your mind at any time using “Cookie settings” at the bottom of every page.

We use:

  • Necessary cookies, which the website needs to work and which don't need your consent. c15t, c15t-sid and c15t-vendors remember your cookie choices (one year). If a client signs in to view a private page, tou_session keeps them signed in (seven days). While you fill in our contact form, your answers are also kept in your browser, not on our systems, until you send it or close the tab.
  • Measurement cookies, set by Google Analytics through Google Tag Manager, which help us understand how people use the website: _ga and _ga_ followed by an ID (up to two years). Google Tag Manager loads on every page, but tells Google's tags not to store anything until you accept these.
  • Marketing cookies. We don't currently use advertising cookies. If you allow marketing cookies, videos embedded from YouTube or Vimeo can play, and those services may set their own cookies. If you don't, you'll see a message in the video's place.

You can also block or delete cookies in your browser settings. If you block necessary cookies, some parts of the website may not work.

Your rights

You have the right to:

  • ask for a copy of the information we hold about you
  • ask us to correct it if it's wrong, or delete it
  • object to, or ask us to restrict, how we use it
  • ask us to transfer it to you or someone else
  • withdraw your consent at any time, where we rely on it

To use any of these rights, email hello@threeofus.co. We'll respond within one month. If you're unhappy with how we've handled your information, you can complain to the Information Commissioner's Office, though we'd appreciate the chance to put things right first.

Keeping it safe

We use appropriate technical and organisational measures to protect your information, and we limit access to the people who need it to do their jobs.

Changes to this policy

We may update this policy from time to time. The date at the top of this page shows when it last changed.