Privacy Policy

1. Introduction

Effective date: 17 October 2026

This policy explains how we use personal information about our own business prospects, clients, and website visitors.

Personal information about a client law firm's own leads, enquiries, or prospective clients is not covered by this policy. That information is handled under our agreement with the client firm and, where we process it for the firm, we act on the firm's instructions. If you are in that position, please contact the law firm directly.

2. Who we are

GHMEDIA DIGITAL LTD is a company registered in England and Wales, company number 16282936, trading as GHMedia. Our registered office is 71-75 Shelton Street, Covent Garden, London WC2H 9JQ.

We are the controller of the personal information covered by this policy. This means we decide why and how that information is used.

We help US estate planning law firms fill their calendars with qualified, booked estate planning consultations. This policy is published at ghmedia.ai/privacy and is the privacy notice linked from our Facebook and Instagram lead forms.

This policy covers our own business prospects, our clients, and visitors to our website. Most of our prospects are in the United States, mainly people at estate planning law firms. We also deal with people in the United Kingdom and elsewhere. If you are in the United States, this notice also tells you what we do with your information.

3. Data we collect

We collect the following categories of personal information:

Lead form information. When someone submits our Facebook or Instagram lead form, we collect their name, email address, phone number, and whether they are the decision-maker at their firm.

Communications. Records of text messages, emails, and calls between us and a prospect or client, including call recordings and transcripts.

Client and payment information. Information needed to deliver our services and take payment, including billing and accounting records.

Website and advertising data. Technical data collected through our website and advertising, including IP address, device and browser information, pages viewed, and actions taken.

We do not ask for special category data, such as health, religious, or similar sensitive information, and we ask that people do not send it to us.

4. How we collect it

We collect personal information when:

Someone submits our lead form on Facebook or Instagram.

Someone contacts us directly, by phone, email, or text.

Someone becomes a client and we deliver services to them.

Someone visits our website or interacts with our advertising.

Cookies and similar technologies. We use essential cookies and similar technologies to run our website, and analytics and the Meta pixel to understand visits and measure advertising. Non-essential cookies and similar technologies are used only where the Privacy and Electronic Communications Regulations (PECR) allow, including where you have given consent through our cookie tool, where we use one. The Meta pixel and our analytics tools may set cookies or similar technologies and receive technical data such as IP address, device and browser data, pages viewed, and actions taken.

5. Purposes and lawful bases

We only use personal information for the purposes set out below, on the lawful bases shown.

Respond to a lead-form enquiry and book a call. Information: name, email, phone, decision-maker status. Lawful basis: steps taken before entering a contract, and our legitimate interests in responding to business enquiries.

Send marketing texts and emails about our services. Information: name, email, phone. Lawful basis: consent under UK GDPR, which is also the PECR permission we rely on for lead-form prospects.

Send service and reminder messages about a booked call or an existing client matter. Information: name, email, phone. Lawful basis: steps taken before, or performance of, a contract, and legitimate interests.

Record and transcribe calls. Information: call recordings, transcripts. Lawful basis: legitimate interests, in keeping an accurate record, for quality, training, and handling disputes.

Summarise and analyse messages and calls using AI tools. Information: messages, call recordings, transcripts. Lawful basis: legitimate interests, in running and improving our sales and client process. Not used to make solely automated decisions with legal or similarly significant effects.

Take payment and keep accounting records. Information: billing and payment information. Lawful basis: performance of a contract, and compliance with a legal obligation.

Run the website, keep it secure, and measure advertising. Information: technical and analytics data, pixel data. Lawful basis: legitimate interests, and consent where PECR requires it for cookies or similar technologies.

Establish, exercise, or defend legal claims. Information: any of the above, as relevant. Lawful basis: legitimate interests, or a legal obligation where it applies.

6. Marketing texts

Marketing texts and emails are electronic mail under PECR, and we only send them where PECR allows.

For individuals, this means we have your consent. Consent is given when you submit our lead form, or otherwise clearly ask us to contact you about our services. This consent is specific to GHMedia and to texts and emails about our own services. It is not consent for any other business to market to you, and we do not sell contact details to third parties.

Every marketing text and email identifies GHMedia and gives a simple way to opt out, such as replying STOP to a text or using the unsubscribe link in an email. We action opt-outs promptly and keep a suppression record so the person is not contacted again for marketing purposes.

Service messages, such as confirming a booked call, following up on an existing engagement, or dealing with a payment, are not marketing. A message that promotes our services is.

You can opt out of marketing at any time by replying STOP, using the unsubscribe link, or emailing [email protected]. Opting out of marketing does not stop service messages that are still needed to deal with a booked call, an active enquiry, or an existing client relationship.

7. Call recording

We record and transcribe sales and client calls. We tell you, either at the start of the call or in the call invitation, that the call may be recorded.

If you do not want to be recorded, tell us at the start of the call. Where we can still deal with the matter without a recording, we will stop recording, or we will not continue the call as a recorded call.

We rely on legitimate interests as the lawful basis for call recording. This covers keeping an accurate record of what was discussed, quality and training, and handling any dispute that may arise. We have considered this against the interests of the people being recorded: recording is limited to business calls, people are told in advance, and they can object.

8. AI and automated processing

We use AI tools to transcribe, summarise, and analyse messages and call recordings, and to help us prioritise follow-up with prospects and clients. Where these tools are provided by third parties, those providers act on our instructions, as our processors, where the arrangement requires it.

Automated text messages used to book a call are sent automatically, but booking a call is not a decision with a legal or similarly significant effect on anyone. We do not make solely automated decisions that produce legal or similarly significant effects. We use AI outputs to support and prioritise our own decisions, not to replace them.

You can object to AI analysis of your messages or calls, and can ask for human review of an outcome that significantly affects you, by contacting [email protected].

9. Sharing and processors

We do not sell personal information.

We share personal information with providers who help us run our business, by category:

Our US-hosted customer relationship management (CRM) system.

Data storage and hosting providers.

Messaging and email providers.

Call recording and transcription providers.

AI tools used to summarise and analyse messages and calls.

Slack, for communication with clients.

Payment providers, including Stripe and Whop.

Accounting software.

Website hosting and analytics providers.

Meta, for lead forms, the Meta pixel, and advertising.

We describe these by category because the specific providers we use can change. We can provide the current names of our providers on request, by emailing [email protected].

We may also share personal information with our professional advisers, where required by law, a court, or a regulator, or if we sell or restructure our business. We do not share a prospect's information with other law firms for those firms' own marketing.

10. International transfers

We are based in the United Kingdom. Several of our providers, including our CRM, are based in the United States. The United States is not currently recognised as providing an adequate level of data protection as a whole country.

Where a US provider is certified under the UK Extension to the EU-US Data Privacy Framework (the UK-US data bridge), we rely on that certification for the transfer. Where that certification does not apply, we use an appropriate safeguard, such as the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses, together with a transfer risk assessment where required.

You can request a copy of the relevant safeguard, redacted where needed, by emailing [email protected].

11. Retention

We keep personal information only for as long as we need it for the purpose it was collected for, including any related legal, accounting, or dispute need. After that, we delete it or anonymise it.

Lead-form and marketing contact data is kept until the person opts out, or until we no longer have a genuine prospect of working with them.

Call recordings and transcripts are kept for as long as needed to administer the enquiry or client relationship, and to deal with any dispute.

Client account and payment records are kept for as long as tax and accounting law requires.

Website and pixel data is kept for the periods set by the relevant analytics and advertising tools, or sooner if we no longer need it.

You can ask us to confirm the retention period that applies to your information by emailing [email protected].

12. Security

We use appropriate technical and organisational measures to protect personal information, and we limit access to people who need it to do their jobs. We require the providers we work with to protect personal information they process for us.

No method of transmission over the internet, or method of electronic storage, is completely secure, and we cannot guarantee absolute security.

13. Your rights

Under UK GDPR, you have the right to:

Access the personal information we hold about you.

Correct inaccurate or incomplete information.

Delete your information in certain circumstances.

Restrict our use of your information in certain circumstances.

Port your information, where processing is by automated means and based on consent or contract.

Object to processing, including processing based on legitimate interests, and to direct marketing at any time.

Withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

You can object to marketing or withdraw consent by replying STOP, using the unsubscribe link, or emailing [email protected], and we will stop marketing to you. These rights are not absolute, and some apply only in certain circumstances.

To exercise any of these rights, contact us at [email protected]. We will respond within one month. We may extend this by a further two months for complex or numerous requests, may ask for information to confirm your identity, and may refuse or charge a reasonable fee for requests that are manifestly unfounded or excessive, where the law allows.

14. Complaints

If you have a concern about how we handle your personal information, please contact us first at [email protected] so we can try to resolve it.

You also have the right to complain to the UK supervisory authority:

Information Commissioner's Office

Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

ico.org.uk

If you are based outside the UK, you may also be able to complain to your local data protection supervisory authority.

15. Contact and updates

The controller of your personal information under this policy is GHMEDIA DIGITAL LTD, trading as GHMedia, registered office 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, company number 16282936.

For any question about this policy, or to exercise any of your rights, contact us at [email protected].

We may update this policy from time to time by posting a new version at ghmedia.ai/privacy with a new effective date.