Privacy Policy
Contents
This document was drafted from a technical audit of what this website actually loads and collects. It is a strong starting point, not legal advice, and it has not been reviewed by a solicitor. Fill in every amber block below and have someone qualified check it before you rely on it.
Who we are
Retention Control is a retention marketing agency working with Shopify and DTC brands on email, SMS and lifecycle programmes. This policy explains what we do with personal data collected through this website and through enquiries.
Add the registered legal entity name and company number, and confirm the registered address. "Retention Control" appears to be a trading name — the policy should name the entity that is legally responsible as data controller.
Postal address: 30 N Gould St #60861, Sheridan, WY 82801, USA. Telephone: +1 307 430 1227.
Information we collect
When you browse the site
Our analytics tools record pages viewed, approximate location derived from IP address, device and browser type, how you arrived, and how you move through pages. Microsoft Clarity additionally records anonymised playback of interactions — clicks, scrolling and mouse movement. See our Cookie Policy for the detail.
When you give us your details
Our capture forms ask for your name, email address, store address and, where you give it, phone number, revenue band and email platform, together with your consent to be contacted. We also run a hidden anti-spam field which collects nothing about you.
When you book a call
Bookings are taken through an embedded Cal.com calendar. The name, email and any notes you enter go to Cal.com and to us.
When you become a client
We collect the contact and billing details needed to run the engagement, and we are given access to systems belonging to you — typically your ecommerce platform and email or SMS provider.
Working inside a client's Klaviyo, Omnisend, Brevo or Attentive account means handling their customers' personal data. For that data you are a processor, not a controller, and you need a data processing agreement with each client. State that position here, and make sure the DPA exists.
How we use it, and our legal basis
- To reply to enquiries and provide services — necessary to take steps at your request and to perform our contract with you.
- To send marketing emails or messages — where you have consented, or where you are an existing client and the message concerns similar services. Every message carries an unsubscribe link.
- To measure and improve the website — our legitimate interest in understanding how the site performs. See the consent note in the Cookie Policy, which affects this.
- To meet legal and accounting obligations — necessary for compliance.
- To keep the site secure — our legitimate interest in preventing abuse and attacks.
We do not sell personal data, and we do not use it to make automated decisions that produce legal or similarly significant effects.
International transfers
We are based in the United States and several of our suppliers process data there. If you are in the UK, the EEA or Switzerland, your personal data will be transferred outside your home jurisdiction when you use this site or engage us.
Name the safeguard you rely on for those transfers — typically Standard Contractual Clauses, or the UK Addendum, or a provider's certification under the EU–US Data Privacy Framework. Check which applies to each supplier above and say so.
How long we keep it
Set an actual period for each category rather than "as long as necessary". A workable starting point: enquiries that do not become clients, 24 months; marketing contacts, until they unsubscribe plus 12 months; client records, 7 years for accounting; analytics, whatever retention window is configured in GA4 and Clarity — check both, they default to 14 months and 30 days respectively.
Your rights
Depending on where you live you may have the right to ask us to: give you a copy of the personal data we hold about you; correct it if it is wrong; delete it; restrict or object to how we use it; or transfer it to another provider. Where we rely on consent, you can withdraw it at any time without affecting anything done beforehand.
If you are in California, you also have the right to know what we collect, to request deletion, and not to be discriminated against for exercising those rights. We do not sell or share personal information as those terms are defined under California law.
To exercise any of these, contact us using the details below. We will respond within one month. If you are unhappy with our response you can complain to your data protection authority — the ICO in the UK, or your national supervisory authority in the EEA.
Security
The site is served over HTTPS and sits behind a web application firewall. Access to client systems is limited to the people working on the engagement. No system is perfectly secure, and we do not claim otherwise.
Add your breach notification commitment — who you tell, and how quickly. Under UK/EU rules that is the supervisory authority within 72 hours where the breach is likely to pose a risk.
Children's data
This site and our services are aimed at businesses, not children. We do not knowingly collect personal data from anyone under 16. If you believe a child has given us their details, contact us and we will delete them.
Changes to this policy
We update this policy when what we do with data changes. The date at the top shows when it was last revised. Material changes will be flagged on the site rather than made quietly.
Contact
Add the email address that receives privacy enquiries. If you appoint a UK or EU representative, or a data protection officer, name them here.
Postal address: 30 N Gould St #60861, Sheridan, WY 82801, USA. Telephone: +1 307 430 1227.