Privacy Policy

1. Introduction

This Privacy Policy explains how Ironwood Brands Ltd ("we", "us", "our") collects, uses, and protects personal information when you visit our website at ironwoodbrands.com (the "Site"), apply for our services, or purchase from us.

We are committed to protecting your privacy and being transparent about what we do with your information. This policy is written to comply with the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018, and to provide the disclosures required for visitors resident in the United States, including California.

2. Who we are and how to contact us

The data controller responsible for your personal information is:

• Ironwood Brands Ltd
• Company number: 12856658
• Registered office: 85 Great Portland Street, First Floor, London, W1W 7LT, United Kingdom
• Contact for privacy matters: hello@ironwoodbrands.com

ICO registration: We are registered as a data controller with the UK Information Commissioner's Office under registration number ZC131245.

3. The information we collect

3.1 Information you give us

When you apply for our services, purchase from us, or contact us, you may provide us with:

• name and business name
• email address and, if you provide one, phone number
• information about your business, audience, and current brand position (provided through the application form and intake materials)
• payment information (processed directly by Stripe, see Section 5)
• any other information you choose to share with us in correspondence or during the engagement

3.2 Information collected automatically

When you visit the Site, a small amount of information is collected automatically:

• anonymized, aggregated analytics about how visitors use the Site, collected via Plausible Analytics (see Section 5)
• technical information necessary for the Site to function, such as your browser type and the page you are viewing

We do not use cookies or tracking technologies to identify individual visitors or to profile your behavior across other websites.

3.3 Information from payment processing

When you pay for one of our engagements, Stripe (our payment processor) collects your payment card and billing information directly. We receive a confirmation of payment and limited billing metadata from Stripe; we do not see or store your full card number, CVV, or bank account details.

3.4 Information from Brand Runway intake

When you commission Brand Runway, we collect detailed information about your practice's positioning, competitors, audience, voice, and visual identity through a structured four-step intake form. This information is stored in our intake system, visible only to the engagement lead working on your project, and is subject to the same deletion schedule as our other intake data.

3.5 Case-study consent (Brand Runway only)

If you select the Brand Runway case-study price at checkout, you enter into a separate Case-Study Consent Agreement. Under this Agreement, we may publish anonymized excerpts of your engagement deliverables for marketing purposes. Before any publication, we remove or alter all personal details, business names, locations, named clients, financial figures, and any information that could identify you, your business, or your clients. You see the anonymized material before it is published, and you may withdraw consent in writing at any time before publication. The full Agreement is at ironwoodbrands.com/case-study-consent. We record the date, time, version of the Agreement, and IP address at which acceptance was given as part of the consent record.

4. How we use your information

We use the information we collect for the following purposes:

• To deliver our services. To review applications, hold delivery calls, prepare audits and recommendations, and communicate with you during and after the engagement.
• To process payments. Through Stripe, to take the payment you have authorised and, where applicable, to collect instalment payments.
• To manage our business. For accounting, tax, record-keeping, and other administrative purposes.
• To communicate with you. To respond to your enquiries, send booking confirmations, and send transactional emails about your engagement.
• To improve the Site. Using anonymized analytics, to understand which pages are most useful and where visitors encounter difficulty.
• To meet our legal obligations. For example, retaining records required by HMRC or responding to lawful requests from regulators or law enforcement.

5. Our legal bases for processing (UK/EEA visitors)

Under UK GDPR, we must have a lawful basis for processing your personal information. The bases we rely on are:

• Contract. Where you have applied for or purchased our services, we process your information to perform the contract with you or to take steps at your request before entering into a contract.
• Legitimate interests. We rely on our legitimate interest in running and improving our business (for example, using anonymized analytics to understand Site usage) where those interests are not overridden by your rights and interests.
• Legal obligation. Where we must process your information to comply with a legal obligation, such as keeping accounting records.
• Consent. Where you have given us specific consent (for example, if you subscribe to future communications). You can withdraw consent at any time.

6. Who we share your information with

We share your personal information only with a small number of trusted third parties who help us run the business. Each one acts either as a "processor" on our instructions (meaning we remain responsible for how your information is handled) or as an independent controller for a clearly defined purpose.

6.1 Service providers we use

• Stripe, Inc. (United States). Payment processing. Stripe handles your payment card details directly and is an independent controller for that processing. See stripe.com/privacy.
• Netlify, Inc. (United States). Website hosting and form submission delivery (for application forms). Netlify processes the information on our behalf. See netlify.com/privacy.
• Microsoft Corporation (Ireland / United States). Email service (Microsoft 365). We use Microsoft 365 to send and receive email at our business domain. See privacy.microsoft.com.
• Calendly LLC (United States). Appointment scheduling. When you book a call with us, Calendly collects your name, email, and selected time. See calendly.com/privacy.
• Plausible Insights OÜ (Estonia, European Union). Privacy-focused website analytics. Plausible does not use cookies and does not collect personal identifiers. Data is aggregated and anonymized. See plausible.io/privacy.

6.2 Professional advisors

We may share information with our accountants, lawyers, or other professional advisors where necessary to obtain their advice, in each case subject to appropriate confidentiality obligations.

6.3 Legal and regulatory disclosures

We may disclose your information where required by law, court order, or request from a competent authority; to investigate or prevent fraud; or to protect the rights, property, or safety of our business, our clients, or others.

6.4 We do not sell your information

We do not sell your personal information, and we do not share it with third parties for their own marketing purposes.

7. International data transfers

Several of the service providers listed above are based in the United States. When your personal information is transferred outside the United Kingdom or the European Economic Area, we rely on appropriate safeguards to protect it, including:

• the UK International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses, where required
• the provider's certification under the UK-US Data Bridge or the EU-US Data Privacy Framework, where applicable
• any other safeguards recognized by the UK Information Commissioner's Office

If you would like details of the specific safeguards in place for a particular provider, please contact us at hello@ironwoodbrands.com.

8. How long we keep your information

We keep your personal information only for as long as we need it for the purposes set out in this policy. In general:

• Application form data (where no purchase follows): up to 12 months from submission, then deleted.
• Client records and correspondence: for the duration of the engagement, and for up to 7 years afterwards to meet our accounting, tax, and legal obligations.
• Payment and invoicing records: for at least 7 years, in line with HMRC requirements.
• Anonymized analytics data: retained in aggregate indefinitely; individual visits cannot be identified.

9. Your rights under UK GDPR

If you are in the United Kingdom or the European Economic Area, you have the following rights in respect of your personal information:

• Right of access. You can ask for a copy of the personal information we hold about you.
• Right to rectification. You can ask us to correct information that is inaccurate or incomplete.
• Right to erasure. You can ask us to delete your information in certain circumstances.
• Right to restrict processing. You can ask us to stop or limit how we use your information in certain circumstances.
• Right to data portability. You can ask us to provide your information in a structured, machine-readable format so you can transfer it elsewhere.
• Right to object. You can object to our use of your information on the basis of legitimate interests.
• Right to withdraw consent. Where we rely on consent, you can withdraw it at any time.

To exercise any of these rights, email hello@ironwoodbrands.com. We will respond within one calendar month of receiving your request. We may need to verify your identity before acting on your request.

If you are unhappy with how we have handled your information, you have the right to complain to the UK Information Commissioner's Office (ICO): ico.org.uk, 0303 123 1113. We would appreciate the opportunity to address your concerns first, so please consider contacting us before making a complaint.

10. Your rights under US state privacy laws

10.1 California residents (CCPA / CPRA)

If you are a resident of California, the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA") gives you specific rights regarding your personal information.

Categories of personal information we collect

In the past 12 months, we may have collected the following categories of personal information (as defined by the CCPA/CPRA):

• Identifiers (name, email address, IP address)
• Commercial information (records of services purchased)
• Internet or network activity (anonymized, via Plausible)
• Professional information (business name, industry)
• Inferences drawn from the above (limited to what is needed to deliver our services)

We collect this information directly from you, from your interaction with our Site, and from our service providers listed in Section 6.

Your rights under CCPA/CPRA

• Right to know. You can request details of the personal information we have collected, used, disclosed, or sold about you in the past 12 months.
• Right to delete. You can request deletion of personal information we hold about you, subject to legal exceptions.
• Right to correct. You can request correction of inaccurate personal information.
• Right to opt out of sale or sharing. We do not sell your personal information, and we do not share it for cross-context behavioral advertising, so there is nothing to opt out of.
• Right to limit use of sensitive personal information. We do not use sensitive personal information for purposes that require this right to be provided.
• Right to non-discrimination. We will not discriminate against you for exercising any of these rights.

To exercise any of these rights, email hello@ironwoodbrands.com with "CCPA Request" in the subject line. We may need to verify your identity before responding. You may designate an authorised agent to make a request on your behalf.

10.2 Other US state privacy rights

Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Delaware, Iowa, Nebraska, New Jersey, Tennessee, Montana, Indiana, New Hampshire, Maryland, and other states with comprehensive privacy laws may have rights similar to those described above, including the rights to access, correct, delete, and obtain a copy of their personal information, and to opt out of targeted advertising or the sale of personal information.

Because we do not sell personal information and do not use it for targeted advertising, there is nothing to opt out of on those grounds. To exercise any other right available under the law of your state, email hello@ironwoodbrands.com.

11. Children's privacy

Our services are directed at businesses and are not intended for children. We do not knowingly collect personal information from anyone under the age of 18. If you believe a child has provided information to us, please contact us and we will delete it.

12. Security

We take appropriate technical and organizational measures to protect your personal information against loss, misuse, unauthorised access, and disclosure. However, no method of internet transmission or electronic storage is completely secure, and we cannot guarantee absolute security.

13. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices or the law. The date at the top of the policy shows when it was last updated. For material changes, we will take reasonable steps to notify you.

14. Contact

For any privacy-related question or request, email hello@ironwoodbrands.com, or write to us at Ironwood Brands Ltd, 85 Great Portland Street, First Floor, London, W1W 7LT, United Kingdom.

This policy should be reviewed by a UK-qualified solicitor before publication. The CCPA/CPRA section reflects our current understanding but is not a substitute for US legal advice.