Privacy

Who we are

Practical Reason is the trading name of Parallel Agents Ltd, a company registered in England & Wales (company no. 17123782). Our registered office is at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ. Contact: [email protected].

We are registered with the UK Information Commissioner's Office (ICO) as a data controller. Registration reference: ZC120533. You can verify this at ico.org.uk.

What data we collect

In short: what you type into our forms, payment details handled by Stripe, and basic technical data to keep the site safe.

• Contact information: name, email address, brand name and store web address, submitted through our free audit and contact forms
• Payment data: card details entered when paying for the Sprint or a monthly plan, processed directly by Stripe. We never see or store your full card number
• Usage data: pages visited and referral source, only with consent
• Technical data: browser type, device type and IP address, for security and fraud prevention (legitimate interest)

How we use your data

• To run and deliver the free audit you requested
• To deliver the Sprint and any monthly service you buy, and to process payment (Stripe)
• To respond to enquiries
• To improve the website (only with analytics consent)
• To meet our legal and tax obligations

We do not add you to a marketing list when you request an audit or send a note, and we do not follow up unless you reply or ask us to.

Legal basis for processing

In short: UK law says we need a legal reason for each way we use your data. These are ours.

• Consent (6(1)(a)): when you submit a form or accept analytics cookies
• Contract (6(1)(b)): to deliver services you have bought and process payment
• Legitimate interests (6(1)(f)): to respond to enquiries, prevent fraud and keep the site secure
• Legal obligation (6(1)(c)): to meet tax, accounting and regulatory requirements

Sub-processors

In short: these are the companies we use to run the service. Each one must protect your data to GDPR standards.

We use the following processors to deliver the service. Each is contractually bound to GDPR standards:

• Cloudflare (US/UK): website hosting, CDN and DDoS protection
• Stripe (US/Ireland): payment processing
• Google Workspace (US/Ireland): business email and document storage
• Resend (US): transactional email delivery
• Klaviyo or Mailchimp (US/Ireland): client email campaigns, where applicable
• Anthropic & Google AI (US): AI content generation, with contractual data protection commitments

International transfers are covered by UK Standard Contractual Clauses or UK adequacy decisions where applicable. These are the legal safeguards UK law requires when data leaves the UK.

Data retention

In short: how long we keep your data before we delete it.

• Enquiry and audit data: 24 months from last contact, unless you become a client
• Client data: the length of the engagement plus 7 years (UK accounting requirements)
• Payment records: 7 years (HMRC requirement)

Your rights

In short: it's your data. You can ask to see it, change it or delete it at any time.

Under UK GDPR you can access, correct, erase, restrict, port or object to our use of your data, and withdraw consent at any time. To exercise any right, email us at the address above. We respond within 30 days. You can complain to the ICO at ico.org.uk or on 0303 123 1113.

Cookies

Essential cookies (no consent needed): security and your cookie preference. Optional analytics cookies are off by default and set only if you accept them. No third-party advertising cookies are used.

Security

HTTPS across the site, encrypted data at rest, Stripe PCI-DSS Level 1 for payments, multi-factor authentication on all admin accounts and least-privilege access controls.