Privacy & cookies

When you fill in a form

The enquiry forms on this site — the contact form, the enquiry form on a service page, and the email gate on our tour video — ask for your name and email address, along with whatever you tell us in the message. Some of them also offer optional fields: which services you're interested in, your timescale, your budget, anything else you want us to know, and where you heard about us.

Those submissions go to HubSpot, the CRM we use to keep track of who has been in touch and what about, and HubSpot emails us the details so we can reply. Nothing is written to this website's own database, and we don't send an automatic acknowledgement — the next thing you get from us is a person replying.

When you opt in to hear from us

The forms have an unticked box for marketing email. Tick it and your HubSpot record is marked as opted in, and you'll get the occasional update from us. Leave it alone and it's marked as an opt-out — we'll only reply about the thing you contacted us about. The signup box on the blog goes to HubSpot too, which emails you to confirm before adding you to the newsletter. Either way, you can unsubscribe from any email we send.

When you just read the site

We use Plausible to count visits. It sets no cookies, reads nothing from your device and builds no profile of you — it produces aggregate numbers (pages, referrers, countries, rough device type) and nothing that identifies a person. It follows you nowhere else, and it runs for everyone, because there is nothing about it to consent to.

Two things you type are recorded there too: a question asked in the box on our home page, and the address you check in our How AI sees your site experiment. They're stored as written, alongside the same aggregate numbers and not tied to you, so they show us what people want to know. Don't put anything personal in either.

We also run Google Analytics 4, loaded through Google Tag Manager. It tells us which campaigns, search terms and referrers bring people here, and which pages they go on to read. It sets cookies and keeps a record of your visit, so it waits for your consent. Until you give it, Google's tags store nothing on your device and read nothing back — no cookie, no advertising identifier, nothing that can be tied to you or recognised on another site. Google's servers still receive the request, as they do for anything loaded from them, and what reaches our reports is a modelled estimate rather than your visit.

If you accept marketing cookies, HubSpot's tracking script also runs, and the pages you visit are attached to your contact record if you go on to fill in a form. It's the one thing on the site that joins your browsing to your name, which is why it waits for consent and does nothing at all until you give it.

When you arrive from one of our ads

We advertise on Google: search ads, and remarketing, which shows our ads to people who have already been here. Accept advertising cookies and Google's tags record which pages you saw and whether you went on to fill in a form, so we can tell which ads are worth paying for. You can also be added to an audience that sees our ads on other sites for a period afterwards.

Decline and the tags stay restricted: the same pages load, nothing is stored on your device, you are not added to an audience and you are not followed to another site. While that answer stands, Google is also told to strip the advertising identifiers out of what it does receive.

When you book a call

Our "book a call" panel embeds Google's appointment scheduling. If you use it, the booking is made with Google Calendar and what you type goes to Google as well as to us. Nothing from Google is requested until you've accepted marketing cookies and opened the panel — if you'd rather not use it, email or ring us and we'll book a time directly.

When you watch a video

Our videos are hosted by Vimeo and play in their player, loaded with Vimeo's do-not-track setting on. It waits for your consent: until you accept marketing cookies nothing is requested from Vimeo at all, so they don't see your visit.

Behind the scenes

Our hosting keeps standard server logs — IP address, browser, what was requested, when — for a short period, so outages and abuse can be investigated. We don't analyse them for anything else.

What we don't collect

No accounts, no fingerprinting, no session recording, no heatmaps, and no special category data. We don't buy data about you from anyone else, we don't sell or share what we hold for anyone else's advertising, and we don't make decisions about you automatically. The Google advertising tags above are the only thing on this site that follows you beyond it, and they do nothing until you accept them.

UK GDPR requires a lawful basis for each use of your data. Ours:

• Answering your enquiry — steps towards a contract, and our legitimate interest in running an agency people can contact. You asked us a question; we need your details to answer it.
• Marketing email — your consent, given by ticking the box, withdrawable from the unsubscribe link in every email or by telling us.
• Client work — performance of our contract with you, plus our legal obligations to keep accounting records.
• Cookieless analytics and server logs — our legitimate interest in knowing whether the site works and keeping it secure. Because Plausible stores nothing on your device, this doesn't need consent under PECR.
• Google Analytics, and advertising — your consent, given on the banner and withdrawable there at any time. They are two separate choices, so you can let us measure the site without agreeing to be advertised to.
• Spam protection on our forms — our legitimate interest in not being buried in automated submissions.
• Cookies that aren't strictly necessary, and the third-party embeds — your consent, through the cookie banner.

The site needs a couple of strictly necessary cookies to work — a session cookie and a CSRF token that stops someone forging a form submission on your behalf — plus one from Cookiebot recording what you chose on the banner, so you're not asked again on every page.

Anything beyond that waits for you. Non-essential scripts are held back until you accept them, and everything Google-related starts from denied and stays there unless you say otherwise.

Three things are not requested at all until you accept marketing cookies, because each one means a call to someone else's server: the tour video (hosted by Vimeo), the booking form (Google Calendar) and HubSpot's tracking script. The video and the booking form show a short note in their place instead, and you can accept from there.

Google Analytics and our Google Ads tags are handled differently. They load with the page and then sit in a restricted mode — nothing stored on your device, no identifier — until your answer on the banner reaches them. That is how Google's consent mode is built, and it means your acceptance takes effect the moment you give it rather than from your next page load. Accept and they run normally. Decline and they stay restricted.

Nothing else on the site is held back, and you can still reach us by email or phone without accepting anything.

The table below comes from a live scan of this site, so it lists whatever is currently set.

We don't sell, rent or trade personal data. The only third parties involved are the suppliers who run parts of this site for us, each under a contract that limits them to doing what we've asked:

• Enquiries that didn't go anywhere — the email stays in our inbox and the contact stays in HubSpot while we're talking, then both get cleared out after two years.
• Client records — for the length of the relationship, then seven years for the parts HMRC requires us to keep.
• Mailing list — until you unsubscribe, and we remove inactive subscribers periodically anyway.
• Cookie consent — the choice you make on the banner is stored for twelve months, then you're asked again. Cookiebot also keeps a record of it, as our evidence that you were asked.
• Server logs — a short rolling window set by our host.
• Plausible analytics — aggregate counts with no personal data in them, kept indefinitely.
• Google Analytics — Google deletes the visit-level data after fourteen months at the most; the aggregate reports built from it stay.
• Advertising audiences — if you've consented, you drop out of a remarketing audience on Google's own schedule, within a year at the outside.

Some of the suppliers above are based in the United States. Where personal data reaches them, the transfer relies on the UK's approved safeguards — the UK extension to the EU–US Data Privacy Framework where the supplier is certified under it, and the International Data Transfer Addendum to the EU standard contractual clauses where it isn't.

If you'd like to know which safeguard applies to a particular supplier, ask us and we'll tell you.

Under UK GDPR you can ask us to:

• Show you what personal data we hold about you, and a copy of it.
• Correct anything that's wrong or incomplete.
• Delete it, where we've no continuing reason to keep it.
• Restrict what we do with it while a dispute is sorted out.
• Stop using it for a purpose you object to — including marketing, which we'll always honour.
• Move it, in a portable format, to you or someone else.

You can also withdraw consent at any time, for the things we rely on consent for. Withdrawing it doesn't undo what was done while it was in force.

Email emma.browne@mutual.agency and we'll respond within a month. It's free, and we won't ask you to justify the request.

If we get it wrong, you're entitled to complain to the Information Commissioner's Office — ico.org.uk/make-a-complaint, or 0303 123 1113. We'd rather you gave us the chance to fix it first, but that's your call.

When we change how we handle personal data, this page changes with it and the date at the top moves. If a change is significant and we hold your email address, we'll email you about it.

This page was last updated on 6 October 2026.