Privacy Policy

Last updated: 15 September 2026

1. Who we are

Proper Sites Ltd ("ProperSites", "we", "us") is the controller of the personal data collected through this website, propersites.com. We are a company registered in England and Wales under company number 17081787, with our registered office at 71-75 Shelton Street, Covent Garden, London WC2H 9JQ.

For anything to do with your personal data, contact us at privacy@propersites.com. We are registered with the Information Commissioner's Office (ICO) as a data controller under registration reference ZC192664.

2. What we collect

You give us personal data through the forms on this website. That may include:

• your name;
• your email address;
• your phone number;
• details about your business, such as its name, website address and what you need from us; and
• anything else you choose to tell us in a message, enquiry or job application.

Like most websites, our hosting provider also records basic technical information when you visit, such as your IP address, browser type and the pages you view, in server logs used for security and to keep the site running.

3. When we get your details from somewhere else

Not all the personal data we hold comes from you. If you work for a UK business, we may hold your business contact details even though you have never been in touch with us, because we contact businesses about their websites. UK GDPR requires us to tell you that, so this section does.

What we hold. Business contact details only: your name, your job title or role, your business email address, your business phone number, and the company you work for. Alongside that we hold information about the company and its website, which is business information rather than information about you. We do not collect anything about your private life and we hold no special category data.

Where we got it. From public sources and from the business itself:

• Google Maps and Google Places business listings, which is usually where a business name, phone number, address and website address come from;
• the business's own website, including any contact details, names and structured data published on it; and
• the Companies House public register, which is usually where a director's name comes from.

Where a business publishes no email address, we sometimes try a standard one at its own domain, such as info@ or hello@. We do not buy marketing lists, and we do not use a data broker or a contact-data provider to find people. Where we need to check that an address we already hold is still valid, we use Hunter.io, an email verification service; it checks addresses we already have, it does not supply new ones.

We also look at public information about the business and its website, including its public reviews, its domain registration record and archived copies of the site. That is information about the business rather than about you.

What we use it for, and our lawful basis. We use it to contact the business about problems we have found on its website, and to offer an assessment of that website and a conversation with no obligation. We may hold these business contact details in HighLevel, our CRM system described in section 6, to organise and keep track of our sales calls to the business, and your right to object below applies to those records too. Our lawful basis is legitimate interests, UK GDPR Article 6(1)(f): our interest in marketing our services to businesses likely to need them. We have carried out and written down the assessment behind that decision, and we will send you a copy if you ask for it. We only contact corporate subscribers this way, meaning limited companies and LLPs. We do not contact sole traders, ordinary partnerships or private individuals on this basis.

How to make us stop. You can object at any time and you do not have to give a reason. For direct marketing that right is absolute: if you object, we stop. Use the unsubscribe link in any email we send you, reply to it and say stop, or email privacy@propersites.com. We act on it straight away and permanently, by putting you on a suppression list that our outreach systems check before contacting anyone, so we cannot contact you again by mistake.

How long we keep it. We keep business contact details for as long as the business is an active prospect. We review the list and delete records that have gone stale, and we will delete yours sooner if you ask us to. That review is a manual one at the moment rather than an automatic deletion on a fixed timetable, which is why we do not quote you a fixed period here. If you object or unsubscribe, the suppression is permanent, and we then keep only the minimum needed to honour it, which is your email address on the suppression list.

The rest of this notice applies to this data too, including your other rights in section 8 and how to complain in section 10.

4. If you apply to work with us

If you apply for a contractor role through our careers pages, we collect what you enter on the application form. That is your name, your email address, your phone number if you give one, your LinkedIn profile, the country you would work from, and your answers to our screening questions: whether you can work UK business hours, whether you have a quiet place to call from and a headset, how reliable your internet and power are, whether you have done phone sales before and for how long, when you could start, and your confirmation that you understand the role is self-employed and that you must pass our compliance test. Anything you write in the motivation or referral boxes is stored with it. The initial application does not ask for a recording.

If you meet the initial eligibility requirements, we may invite you to record a short response. We then collect either an HTTPS audio or video link or a reasonable adjustment request and any optional contact note you provide. Please do not include medical or other special category details in an adjustment note. We store the link but do not download, transcribe or analyse the media automatically.

How we decide. Your initial answers are checked consistently against a fixed list of objective requirements published for the role. That check may reject an ineligible application. It is a rules-based eligibility check, not an AI assessment. If you believe an answer was misunderstood, email careers@propersites.com and ask for a human review; a person can change the outcome. Every eligible candidate is asked the same role-relevant questions. A person makes every progression decision. If you send a recording, we store the link but your audio or video is not analysed by AI.

Why we use it, and our lawful basis. We use it to assess your application, to contact you about it, and to take the steps you have asked us to take before we would enter into a contract with you. Our lawful bases are that the processing is necessary to take steps at your request before entering into a contract, and our legitimate interests in recruiting people for these roles. We do not ask for and do not want special category data, and you should not send us any.

Who sees it. Your application is held in our recruitment system and is visible to the people running hiring. Section 6 covers who else we share data with, section 7 covers how long we keep unsuccessful applications, and section 8 covers your rights, including asking us to delete your application at any point.

5. Why we use it and our lawful bases

Under UK GDPR we need a lawful basis for each use of your personal data. Ours are:

• Responding to enquiries and reviews. When you ask us about our services, request a free website review or book a call, we use your details to reply and follow up. We record your enquiry in our CRM systems so we can manage the conversation and avoid contacting you twice about the same thing. Today that is Frappe CRM, which we host on our own server, and we are introducing HighLevel, described in section 6. Lawful basis: our legitimate interest in responding to people who contact us, and taking steps at your request before entering into a contract.
• Contacting businesses about their website. We contact UK businesses that have not contacted us first, by email, by phone and through professional networks such as LinkedIn, to tell them what we have found wrong with their website and to offer them an assessment of it. Lawful basis: our legitimate interest in marketing our services to businesses likely to need them (UK GDPR Article 6(1)(f)). We only do this for corporate subscribers, meaning limited companies and LLPs, and not for sole traders, ordinary partnerships or private individuals. Section 3 sets out what we hold, where we got it and how to tell us to stop.
• Doing the work. If you become a client, we use your details to deliver the services we have agreed. Lawful basis: performance of a contract.
• Job applications. If you apply for a job, we use your application to consider you for the role. Lawful basis: taking steps at your request before entering into a contract, and our legitimate interest in recruiting.
• Occasional updates. If you subscribe to hear from us, we will email you the occasional tip or update. Lawful basis: consent, which you can withdraw at any time using the unsubscribe link or by emailing us.
• Keeping records and staying secure. We keep basic records for accounting and legal reasons and monitor for misuse of the site. Lawful bases: legal obligation and legitimate interest.

6. Who we share it with

We do not sell your personal data. We share it only with the service providers that help us run the business, acting on our instructions:

• our website hosting provider;
• the form-handling service that delivers your enquiry to our inbox;
• our email provider;
• HighLevel LLC (a subsidiary of GoHighLevel Inc.), which provides the GoHighLevel customer relationship management (CRM) system, and its affiliate LeadConnector LLC. We are introducing HighLevel alongside our own self-hosted CRM to receive and manage enquiries and website review requests, and to hold the business contact records described in section 3. We may also use it in future to schedule calls and to send confirmation emails or text messages, which may show the LeadConnector name;
• a telephone preference screening service, so we can check a business number against the TPS and CTPS registers before we call it; and
• Hunter.io, which checks that a business email address we already hold is still valid.

Some providers may process data outside the UK. HighLevel is based in the United States, so details stored in it, including enquiries and business contact records, may be processed there. Where that happens, we make sure an appropriate safeguard recognised by UK law is in place, such as an adequacy decision (including the UK Extension to the EU-US Data Privacy Framework) or the UK International Data Transfer Addendum to the standard contractual clauses.

We may also disclose personal data where the law requires it.

7. How long we keep it

• Enquiries that do not lead to work: up to 12 months, then deleted, including from our CRM systems.
• Business contact details we obtained from other sources: for as long as the business is an active prospect, then deleted when we review the list. Section 3 explains this, including how to make us delete yours now.
• Client records: for the length of our work together, then as long as tax and company law require, normally 6 years.
• Unsuccessful job applications: up to 6 months after the role is filled, then deleted.
• Mailing list details: until you unsubscribe.

8. Your rights

Under UK GDPR you have the right to:

• ask for a copy of the personal data we hold about you;
• ask us to correct data that is wrong;
• ask us to delete your data;
• ask us to restrict how we use it;
• object to our use of it, including for any direct marketing;
• receive the data you gave us in a portable format; and
• withdraw consent at any time, where consent is the basis we rely on.

To use any of these rights, email privacy@propersites.com. We will respond within one month.

9. Cookies, analytics and local storage

We do not run advertising cookies, and we do not sell or share your data for advertising.

Analytics. We use Cloudflare Web Analytics and PostHog (EU region) to understand how the site is used. Both are configured without cookies: PostHog runs in memory-only mode, so it stores nothing on your device and cannot recognise you across visits. We use it only to see which pages are visited and where people get stuck on our enquiry forms. We do not record your screen.

What we do store on your device. A small "theme" cookie remembers whether you chose light or dark mode. If you arrive from a marketing link, we also store the campaign details in your browser’s local storage for up to 90 days, so that if you later send us an enquiry we know where you found us. It is discarded automatically after 90 days, and you can clear it at any time in your browser settings.

If we introduce advertising or other non-essential cookies in future, we will update this policy and ask for your consent where the law requires it.

10. Complaints

If you are unhappy with how we have handled your personal data, please contact us first at privacy@propersites.com and we will do our best to put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or by calling 0303 123 1113.

11. Changes to this policy

If we change this policy, we will publish the new version on this page with a new "last updated" date.