Legal
Privacy Policy
Last updated: 18 June 2026
1. Who we are
This Privacy Policy explains how WEB MARKETING SYSTEM LTD ("HOT", "we", "us" or "our") collects, uses, shares and protects your personal data when you visit our website, contact us, or apply for a role through our forms.
We are the data controller of your personal data. Because we are established in the United Kingdom but offer our services to people in the European Union, this policy is designed to comply with both the UK GDPR and the EU General Data Protection Regulation (GDPR).
Controller: WEB MARKETING SYSTEM LTD, Company No. 09018864, 16 Whitehall, London SW1A 2DY, United Kingdom.
For any privacy question or to exercise your rights, contact us at support@gohot.io. We have not appointed a Data Protection Officer; privacy requests are handled by our team at the same address.
2. Who this policy covers
This policy applies to visitors to our website, prospective clients who contact us, and candidates who apply for a role with us.
3. The personal data we collect
Data you give us
- Contact and enquiry data — name, email address, phone number, company name, role, and anything you write in a message or contact form.
- Job-application data — name, contact details, CV/résumé, work history, and any information you include in your application or attachments.
- Communications — records of the correspondence you have with us.
Data we collect automatically
- Technical and usage data — IP address, browser and device type, operating system, referring pages, and how you interact with the site, collected through cookies and similar technologies (see our Cookie Policy).
Data from other sources
To support our marketing and lead-generation activity we may also obtain business-contact data from publicly accessible sources (such as company websites, professional networks and business directories) and from trusted data providers. Where we do, the categories of data are the same business-contact details listed above, and we inform you at the latest within one month, or at our first contact with you, as required by Article 14 of the GDPR.
4. Why we use your data and our legal basis
We only process your personal data where we have a lawful basis to do so. The table below sets out each purpose and the basis we rely on.
| Purpose | Legal basis |
|---|---|
| Respond to your enquiry and provide the services you request | Performance of a contract or pre-contractual steps (Art. 6(1)(b)) |
| Send marketing communications about our services | Your consent (Art. 6(1)(a)), or our legitimate interest in B2B direct marketing (Art. 6(1)(f)) |
| Identify and contact potential business clients (lead generation) | Our legitimate interest in growing our business (Art. 6(1)(f)) |
| Process and assess job applications | Pre-contractual steps (Art. 6(1)(b)) and our legitimate interest in evaluating candidates (Art. 6(1)(f)) |
| Keep your details for future opportunities (talent pool) | Your consent (Art. 6(1)(a)) |
| Operate, secure, analyse and improve our website | Our legitimate interest in a safe, effective website (Art. 6(1)(f)) |
| Comply with legal, tax and accounting obligations, and establish or defend legal claims | Legal obligation (Art. 6(1)(c)) and our legitimate interests (Art. 6(1)(f)) |
Where we rely on legitimate interests, those interests are growing our business, marketing our services to other businesses, keeping our website secure and improving what we offer; we balance them against your rights and you can object at any time. Where we rely on consent, you can withdraw it at any time without affecting processing already carried out.
5. Marketing communications
We send marketing only where the law allows — either with your consent or, for business contacts, on the basis of our legitimate interest. Every marketing message includes an easy way to unsubscribe, and you can opt out at any time by emailing support@gohot.io. You have an absolute right to object to direct marketing.
6. Automated decision-making and AI
We use AI-assisted tools to help us prioritise enquiries (for example, scoring how relevant a lead may be) and to support the review of job applications. These tools are assistive only: a member of our team reviews the outcome, and we do not take decisions producing legal or similarly significant effects about you based solely on automated processing within the meaning of Article 22 of the GDPR. If this ever changes, we will update this policy and provide the safeguards the law requires.
7. Who we share your data with
We do not sell your personal data. We share it only with:
- Service providers (processors) who help us run our business — such as website hosting, email delivery, marketing-automation and workflow tools, customer-relationship and analytics providers — acting on our instructions under a data-processing agreement.
- Professional advisers such as lawyers, accountants and insurers, where necessary.
- Authorities or third parties where we are required to by law, or to establish, exercise or defend legal claims.
The main third-party providers we rely on, all acting under a data-processing agreement, are:
| Provider | What they do | Where data may go |
|---|---|---|
| Website hosting (such as Vercel) | Hosting and securely serving this website | EU / US (with safeguards) |
| Sendy and Elastic Email | Sending emails, newsletters and autoresponders, and managing subscriptions | EU / US (with safeguards) |
| n8n (workflow automation) | Routing and processing your form submissions to our systems | EU |
| Google Analytics 4 | Producing aggregate website statistics — only with your consent | US (with safeguards) |
| Google Ads | Measuring advertising and conversions — only with your consent | US (with safeguards) |
We review our providers regularly and can give you the current list on request at support@gohot.io.
8. International data transfers
Some of our providers are located outside the United Kingdom and the European Economic Area (EEA), including in the United States. When we transfer your data abroad we make sure it is protected by an appropriate safeguard, such as:
- an adequacy decision (for example, the EU–US and UK–US Data Privacy Framework, where the recipient is certified); or
- the Standard Contractual Clauses approved by the European Commission, and the UK International Data Transfer Agreement or Addendum, together with additional measures where needed.
You can request a copy of the relevant safeguard by emailing support@gohot.io.
9. How long we keep your data
- Enquiry and lead data — for as long as we are in contact with you and for up to 24 months after our last interaction, unless you ask us to delete it sooner.
- Client and transaction records — for the duration of the relationship and as long as required by law (typically up to 6–7 years for accounting and tax).
- Job-application data — for up to 12 months after the recruitment process, then deleted, unless you consent to us keeping it longer in our talent pool.
- Marketing data — until you withdraw consent or unsubscribe.
- Server logs — up to 30 days, for security and troubleshooting.
- Aggregate analytics — up to 26 months (statistics only, which no longer identify you).
When data is no longer needed we securely delete or anonymise it.
10. How we keep your data secure
We apply appropriate technical and organisational measures — including encryption in transit, access controls and the use of vetted providers — to protect your personal data against loss, misuse and unauthorised access. No method of transmission over the internet is completely secure, but we work to protect your data and review our measures regularly.
11. Children's data
Our website and services are intended for businesses and professionals and are not directed at children. We do not knowingly collect personal data from anyone under the age of 16 (or the minimum age set by your country). If you believe a child has provided us with personal data, please contact us and we will delete it.
12. Your rights
Under the GDPR and UK GDPR you have the right to:
- be informed about how we use your data (this policy);
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data erased ("right to be forgotten");
- restrict how we use your data;
- object to our processing, including an absolute right to object to direct marketing;
- receive your data in a portable format (data portability);
- withdraw consent at any time, where we rely on it;
- not be subject to a decision based solely on automated processing that produces legal or similarly significant effects.
To exercise any of these rights, email us at support@gohot.io. We will respond within one month (extendable by two further months for complex requests) and may need to verify your identity first. Exercising your rights is free in most cases.
13. How to complain
We hope to resolve any concern directly, so please contact us first. You also have the right to lodge a complaint with a data-protection supervisory authority:
- in Italy, the Garante per la protezione dei dati personali — garanteprivacy.it;
- in the United Kingdom, the Information Commissioner's Office (ICO) — ico.org.uk;
- in other EU countries, your local supervisory authority.
14. Changes to this policy
We may update this Privacy Policy from time to time to reflect changes in our practices or the law. The "last updated" date at the top shows when it was last revised, and the current version is always available on this page. Where changes are significant, we will take reasonable steps to inform you.
15. Contact us
For any question about this policy or your personal data, contact WEB MARKETING SYSTEM LTD at support@gohot.io, or by post at 16 Whitehall, London SW1A 2DY, United Kingdom.