Privacy Policy
How we handle personal data
Last updated: 1 October 2026
This policy explains what personal data Reposition collects, why we use it, how long we keep it and the choices you have. If anything is unclear, please ask us.
1. Who we are
Reposition Group Limited (company number 12038357), 3rd Floor, 86–90 Paul Street, London EC2A 4NE, is the controller of the personal data described in this policy. That means we decide how and why it is used.
Our privacy contact is Pauline Vernon. For anything about your personal data, email [email protected] with “Privacy” in the subject line, or write to us at the address above.
2. Who this policy covers
- people who visit reposition.co.uk;
- people who contact us or request a free AI Visibility Snapshot;
- the people we deal with at our clients, partners and suppliers;
- people at businesses we think may be interested in our services;
- people who apply to work with us.
When we handle personal data on a client’s behalf as part of their project, for example in their website analytics or enquiry forms, the client is the controller and their privacy policy applies. Section 7 explains this.
3. What we collect
| Who | What we collect | Where it comes from |
|---|---|---|
| Website visitors | Pages viewed, how you reached the site, device and browser type, approximate location and IP address. Analytics and advertising cookies are used only if you allow them. | Your browser, through cookies and similar technologies (see our Cookie Policy) |
| Enquiries and Snapshot requests | Name, business email, phone number, your website, your role, a budget band if you choose one, and anything you write in your message. | You, through our forms, by email, by phone or in meetings |
| Clients, partners and suppliers | Names, job titles and business contact details of the people we deal with; correspondence, meeting notes and approvals; billing contacts and payment records. | You or your organisation |
| Prospective clients | Name, job title, business contact details and information about your business. | Public sources such as your company website, LinkedIn and Companies House, or an introduction |
| Job applicants | Your CV, contact details, work history and anything you share during the application. | You, or a recruiter acting for you |
We do not ask for special category data about you, such as health information, and we ask you not to send it to us through our forms.
We do not store card details. Card and bank payments are handled by our payment providers on their own secure systems.
4. Why we use it, and our lawful basis
UK data protection law says we must have a lawful basis for each way we use personal data. These are ours:
| What we use it for | Lawful basis |
|---|---|
| Replying to your enquiry and preparing your AI Visibility Snapshot | Legitimate interests (responding to people who contact us), and steps you ask us to take before entering a contract |
| Delivering our services, managing projects and reporting to clients | Contract, and legitimate interests in running our relationship with our clients’ teams |
| Invoicing, collecting payment and keeping accounts | Contract and legal obligation |
| Understanding how the website is used so we can improve it | Consent (statistics cookies) |
| Measuring and improving our advertising | Consent (marketing cookies) |
| Contacting businesses we think could benefit from our services | Legitimate interests in promoting our business to other businesses |
| Sending insights and updates by email | Consent, or legitimate interests where you are a client or business contact. You can opt out at any time |
| Considering job applications | Legitimate interests, and steps before entering a contract |
| Protecting our site and forms from spam and misuse | Legitimate interests |
| Meeting legal, tax and regulatory duties, and dealing with legal claims | Legal obligation and legitimate interests |
Where we rely on legitimate interests, we have weighed them against your rights. You can ask us for details, and you can object at any time (see section 12).
5. Marketing
We market to businesses, not to consumers. We may email or call people at businesses in the sectors we work in about services relevant to their role. Every marketing email we send has an unsubscribe link, and you can ask us to stop at any time by emailing [email protected]. We will not call a number registered with the Telephone Preference Service or the Corporate Telephone Preference Service unless you have told us you are happy to hear from us.
We never sell personal data.
6. The AI Visibility Snapshot and our AI search work
To prepare a Snapshot or deliver AI search work, we put questions about your sector and your brand to AI assistants such as ChatGPT, Gemini and Perplexity, and we record the answers. Those questions are about businesses, not individuals, and we do not include your personal details in them.
We use AI tools to help with research, analysis and drafting. We do not put personal data into AI tools unless the task needs it, and then only into business tools whose terms stop the provider using it to train their models.
7. When we act for our clients
Our work can give us access to personal data that belongs to our clients, for example analytics, enquiry or booking data on a hotel, developer or clinic website. In that case we act as the client’s processor. We use the data only on the client’s instructions and to deliver the agreed work, we keep it secure, and we sign a data processing agreement on request.
Where a client’s data includes health information, such as patient enquiries to a clinic, we access only what the work requires. If your question is about data a business holds about you, please contact that business; we will help them respond.
8. Who we share it with
We share personal data only with people who need it to help us run our business, and only under terms that require them to keep it safe:
- Our team and subcontractors who work on your enquiry or project;
- Hosting and business systems: WP Engine (website hosting), Google Workspace (email, documents and storage), Dropbox (file storage) and Basecamp (project management);
- Analytics, advertising and security: Google Analytics, Google Ads and Google reCAPTCHA. Analytics and advertising are used only with your consent;
- Billing: Chargebee for invoicing and billing, Stripe for card and bank payments, and GoCardless for Direct Debit;
- Professional advisers such as our accountants and lawyers;
- Authorities, where the law requires it.
If we sell or restructure our business, personal data may pass to the new owner, who must use it in line with this policy.
9. International transfers
Some of our team and suppliers work outside the UK, including in Thailand, and some of our suppliers store data in the United States. When personal data is transferred outside the UK, we make sure it stays protected. Either the country is recognised by the UK as giving adequate protection, or we use the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, or the supplier is certified under the UK Extension to the EU–US Data Privacy Framework. You can ask us for details.
10. How long we keep it
| Data | How long |
|---|---|
| Enquiries and Snapshot requests that do not lead to work | 2 years from our last contact |
| Client and supplier records, contracts and invoices | 6 years after our work together ends, for tax and legal reasons |
| Prospective client details | 2 years from our last contact, or sooner if you ask us to stop |
| Unsuccessful job applications | 6 months after the role is filled |
| Website analytics | No longer than 14 months |
| Marketing opt-outs | For as long as needed to make sure we do not contact you again |
11. Keeping it secure
We limit access to personal data to the people who need it, use secure business systems, and choose suppliers who meet recognised security standards. No system is completely secure, so if something goes wrong we will act quickly and tell you and the Information Commissioner’s Office where the law requires it.
12. Your rights
You have the right to:
- ask for a copy of the personal data we hold about you;
- ask us to correct data that is wrong or incomplete;
- ask us to delete your data;
- ask us to restrict how we use it;
- object to how we use it, including an absolute right to object to direct marketing;
- ask for data you gave us in a format you can take elsewhere;
- withdraw your consent at any time, where we rely on consent.
We do not make decisions about you based solely on automated processing.
To use any of these rights, email [email protected] with “Privacy” in the subject line. We will reply within one month, and there is usually no charge. We may ask you to confirm your identity first.
13. Complaints
If you are unhappy with how we have handled your data, please tell us first so we can put it right. You can also complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113.
14. Cookies
Our Cookie Policy explains the cookies on this site and how to change your settings.
15. Children
Our website and services are for businesses. They are not aimed at children, and we do not knowingly collect personal data from anyone under 18.
16. Changes to this policy
We may update this policy when our services or the law change. The date at the top shows when it last changed. If we make a significant change that affects you, we will tell you.