Privacy notice

1. Who we are

First Mention is a search and artificial intelligence visibility consultancy serving Devon and the south west of England. The business is in the course of being established and is not yet trading. This notice governs the limited processing of personal data carried out in the interim.

The data controller is Maximilian Jacob, the individual establishing First Mention, contactable at the email address given below. The controller determines the purposes for which, and the means by which, personal data is processed. Upon formal registration of the business, this notice will be updated to reflect the registered name and details.

All enquiries relating to this notice, including requests to exercise the rights set out at section 7, should be directed to . Requests are handled by correspondence and written confirmation is provided on completion.

Revisions to this notice are recorded at section 9.

2. Personal data we collect

We collect only the information submitted through the enquiry form on our homepage, together with any information you choose to include in correspondence sent to us directly.

The company name and website address provided are used in the preparation of your report, as described at section 4. Your email address is not used for that purpose; it is retained solely in order that the report may be issued to you.

Provision of this information is neither a statutory nor a contractual requirement, and you are under no obligation to provide it. The sole consequence of not providing the two required fields is that we will be unable to respond to your enquiry; no other detriment arises.

We do not request your name, telephone number, postal address or any other personal identifier. We do not collect special category data as defined in Article 9 of the UK GDPR, and you are asked not to submit such data to us.

3. Purpose and lawful basis

Personal data collected through this website is processed for a single purpose: to respond to your enquiry regarding the services offered by First Mention. Responding involves preparing a short report on the visibility of the business identified in your enquiry, which is described at section 4. The data is not used for any other purpose.

The lawful basis for this processing is legitimate interests under Article 6(1)(f) of the UK GDPR. The legitimate interest pursued is that of responding to an enquiry voluntarily submitted by the data subject. We consider this processing to be within your reasonable expectations, given that you provided the information for this specific purpose, and to have minimal privacy impact, given the limited data involved and the retention periods set out at section 5.

We do not use your personal data for direct marketing beyond responding to your enquiry. Specifically, we do not add enquirers to a mailing list, enrol them in automated email sequences, sell or licence their data, or disclose it to third parties for those parties' own marketing purposes.

4. Recipients, automated analysis and international transfers

The following processors act on our instructions in connection with the storage and transmission of the data described at section 2:

Automated analysis

To prepare your report we submit the company name and website address only to the following services. Your email address is never submitted to any of them, and is not held by any of them at any time.

Each report is reviewed by a natural person before it is issued. No decision producing legal or similarly significant effects is taken about you by automated means, and no profiling is carried out within the meaning of Article 22 of the UK GDPR.

International transfers

DataForSEO is established in Estonia, and data transferred to it remains within the European Economic Area, which is covered by an adequacy decision. Proton AG is established in Switzerland, which is also covered by an adequacy decision, and its data processing agreement restricts onward transfers to Switzerland, the European Union and countries subject to such a decision.

Transfers to the United States occur in respect of the remaining processors. Such transfers are made in reliance on the safeguards maintained by each provider, including the UK Extension to the EU-US Data Privacy Framework and, where applicable, the ICO International Data Transfer Addendum to the Standard Contractual Clauses.

A copy of, or information about where to obtain, the safeguards relied upon for these transfers is available on request by email.

We do not disclose personal data to any other party except where required to do so by law.

5. Retention

Personal data is retained only for as long as is necessary for the purpose described at section 3, in accordance with the following periods:

• Enquiry records are retained until the business commences trading, at which point we contact you in response to your enquiry.
• Where no reply is received, all associated personal data is erased within 30 days of the date on which we contacted you.
• Where you indicate that you do not wish to proceed, all associated personal data is erased without delay.
• In any event, personal data that has not given rise to a contractual relationship is erased no later than 12 months from the date of submission.

Erasure is effected across every location in which the data is held: our Formspree account, the mailbox including its deleted items, and any local copy held for backup. Removal from one location alone is not treated as erasure.

Where an enquiry results in the provision of services, retention will be governed by the applicable client agreement. Financial records are retained for six years in accordance with statutory requirements.

6. Cookies and analytics

This website sets no cookies. It deploys no advertising tags, social media pixels or third-party tracking scripts. As no non-essential cookies are set, no consent mechanism is required under the Privacy and Electronic Communications (EC Directive) Regulations 2003.

The controller reviews aggregate traffic statistics provided by Cloudflare in its capacity as hosting provider, comprising visitor counts, pages accessed, country of origin and referring source. Those statistics are compiled without the use of cookies and without tracking individuals across websites or sessions, and do not identify individual visitors.

Cloudflare additionally processes technical request data, including IP addresses, as is necessary to deliver the website and to protect it against malicious traffic.

Should any technology setting a non-essential cookie be introduced, this notice will be amended in advance and an appropriate consent mechanism implemented before that technology is deployed.

7. Your rights

Under the UK GDPR you have the right to:

• request confirmation of whether we process your personal data and, if so, obtain a copy of it, together with the supplementary information required by Article 15;
• request rectification of inaccurate or incomplete personal data;
• request erasure of your personal data;
• request restriction of processing in the circumstances set out in Article 18;
• object to processing carried out on the basis of legitimate interests, including profiling, under Article 21; and
• request the transmission of your personal data to another controller, where the conditions in Article 20 are met.

Requests should be sent to . We will respond within one month of receipt. No fee is payable and you are not required to give reasons for your request. Where a request is manifestly unfounded or excessive we may charge a reasonable fee or decline to act, and will explain our reasoning if we do so.

We do not carry out automated decision-making or profiling producing legal or similarly significant effects.

8. Complaints

If you consider that we have not handled your personal data in accordance with the law, you are entitled to lodge a complaint with the Information Commissioner's Office, the supervisory authority for data protection in the United Kingdom, at ico.org.uk/make-a-complaint or by telephone on their helpline.

You are not obliged to contact us first, though we would welcome the opportunity to address the matter directly.

9. Changes to this notice

We review this notice when our processing activities change and record the version number and date at the head of this page. Personal data already collected will not be subjected to materially different processing under a revised notice without a further lawful basis being established.