Privacy Policy 

 Last reviewed: 24/08/2026 

1. About this policy

Shoothill Ltd (“Shoothill”, “we”, “us”, “our”) is committed to protecting your personal data and being clear about what we do with it. This policy explains what personal data we collect through www.shoothill.com and in the course of dealing with enquiries and customers, why we collect it, what we do with it, how long we keep it, and the rights you have. 

It also explains how to complain if you are unhappy with how we have handled your personal data, and how to escalate that complaint to the Information Commissioner’s Office. That is set out in section 10. 

Shoothill Ltd is the “controller” of the personal data described in this policy, which means we are responsible for deciding how and why it is used. 

Who we are and how to contact us 

2. The personal data we collect

Information you give us 

• Your name, job title and the organisation you work for. 

• Your contact details:  email address, telephone number and postal address. 

• The content of your enquiry, message or anything else you choose to type into a form or send us. 

• Your marketing preferences, and a record of when and how you gave or withdrew consent. 

• Account credentials, where you use a part of our website that requires a login. 

Information we collect automatically 

When you visit our website we collect the following automatically. This is personal data, and we set out below the basis on which we use it. 

• Your IP address. 

• Your browser type and version, operating system and device type. 

• The pages you visit, the time and duration of your visit, and the site or search that referred you. 

• Information collected by cookies and similar technologies, see section 6. 

Information we receive from others 

We may occasionally receive contact details from business partners or from publicly available sources such as company websites and Companies House. Where we do, we satisfy ourselves that the information was obtained lawfully, and we will tell you where we got it from if you ask. 

Special category data 

We do not ask for, and do not want, special category data through this website, information about health, race or ethnic origin, religious or philosophical beliefs, political opinions, trade union membership, genetic or biometric data, sex life or sexual orientation. Please do not include information of this kind in free-text fields on our forms. 

3. Why we use your personal data, and our lawful basis

We must have a lawful basis under the UK GDPR for everything we do with your personal data. 

Where we rely on legitimate interests, we have considered whether our interest is outweighed by the effect on you, and concluded it is not. You can ask us for our reasoning, and you can object, see section 8. 

If we ever want to use your personal data for a new purpose that is not compatible with the one we collected it for, we will tell you first and, where the law requires it, ask your permission. 

4. Automated decision-making

We do not make decisions about you based solely on automated processing that have a legal effect on you or otherwise significantly affect you. We do not profile website visitors beyond the aggregated analytics described in section 6.  

5. Who we share your personal data with

We do not sell, rent or trade your personal data. We share it only as set out below. 

• Service providers acting on our instructions. These include our website hosting and infrastructure providers, our email and customer relationship management platforms, our analytics provider and our IT support suppliers. They act as our processors: they may only use your data to provide the service to us, they are bound by written contracts requiring appropriate security, and they may not use it for their own purposes.  

• Professional advisers. Our lawyers, accountants, auditors and insurers, where they need the information to advise us. 

• Where the law requires it. We will disclose personal data where required by law, a court order or a regulator, and where necessary to protect our rights or the safety of others. 

• In connection with a business transaction. If we sell or reorganise our business, personal data may be disclosed to the other party and its advisers, subject to confidentiality. 

We may share aggregated, anonymised statistics, for example the total number of visitors to a page, with others. This cannot be used to identify you and is not personal data. 

Sending data outside the UK  

All of the personal data we collect through this website is stored and processed within the United Kingdom [and the European Economic Area]. We do not transfer it outside these areas. 

6. Cookies and similar technologies

Cookies are small files placed on your device when you visit a website. We also use similar technologies such as pixels, tags and local storage. Together they let a site remember your choices, keep you logged in, and understand how the site is being used. 

When you first visit our site, our cookie banner asks for your choices. We set cookies that are strictly necessary for the site to work without asking, because we are permitted to. We set all other cookies only in line with the preferences you give us. The categories we use are: 

• Necessary. Required for the site to function: page navigation, security, and remembering your cookie choices. These cannot be switched off. 

• Preferences. Remember choices you have made, such as display settings, so the site behaves the way you expect. 

• Statistics. Help us understand how visitors use the site: which pages are read, how long people stay, where they arrive from, so we can improve it. 

• Marketing. Used to measure the effectiveness of our marketing and, where applicable, to show you relevant advertising. We set these only with your consent. 

You can change your choices at any time using the “Cookie preferences” link in the footer of every page, free of charge. You can also block or delete cookies through your browser settings, though parts of the site may then not work properly. 

Full details of the individual cookies we use, what each does and how long it lasts, are in our Cookie Policy at [www.shoothill.com/cookie-policy]. 

7. Keeping your personal data secure

We use appropriate technical and organisational measures to protect personal data against loss, misuse and unauthorised access, alteration or disclosure. These include encryption in transit and at rest, access controls limiting personal data to staff who need it, staff training, supplier due diligence, and regular review of our systems. 

No system can be completely secure. If a personal data breach occurs and it is likely to result in a risk to your rights and freedoms, we will report it to the Information Commissioner’s Office within 72 hours of becoming aware of it. Where the risk to you is high, we will tell you as well, without undue delay. 

8. Your rights

You have the following rights over your personal data. Some are qualified, meaning they do not apply in every case, for example we may need to keep certain records to meet a legal obligation even if you ask us to delete them. Where we cannot do what you have asked, we will explain why. 

• Access. Ask for a copy of the personal data we hold about you, and information about how we use it. 

• Rectification. Ask us to correct data that is inaccurate, or complete it where it is incomplete. 

• Erasure. Ask us to delete your data where we no longer have a good reason to keep it. 

• Restriction. Ask us to pause our use of your data, for example while we look into an accuracy dispute. 

• Objection. Object to our use of your data where we rely on legitimate interests. Where you object to direct marketing, we will stop, there is no balancing exercise. 

• Portability. Where we process data you gave us by consent or under a contract, by automated means, ask for it in a portable format or ask us to send it to someone else. 

• Withdrawing consent. Where we rely on your consent, withdraw it at any time. That will not affect anything we did lawfully beforehand. 

• Complaining. Complain to us, and to the Information Commissioner’s Office, see section 10. 

How to exercise a right 

Contact us using the details in section 1. Tell us which right you want to exercise and give us enough information to find your data. There is no charge. 

• We will respond within one month of receiving your request. 

• If your request is complex, or you have made a number of requests, we may extend that by up to two further months. We will tell you within the first month if we need to, and why. 

• If we need to verify who you are, or your request is unclear and we need to ask what you are looking for, the one-month period does not run while we are waiting for your reply. We will ask promptly, and the clock restarts when we hear back. 

• When we search for your data we will carry out a reasonable and proportionate search, we will look where the data is likely to be, proportionate to your request. It does not mean searching every system without limit. 

• You can unsubscribe from marketing at any time using the link in any marketing email, or by emailing us. We will action it promptly. 

9. Other websites

Our website contains links to sites operated by other organisations. Some may carry a Shoothill logo even though we do not run them. We are not responsible for the privacy practices of those sites, and this policy does not apply to them. Once you leave our website, please read the privacy policy of the site you have moved to. 

10. Complaints

If you are unhappy with how we have collected, used or looked after your personal data, or with how we have handled a request to exercise your rights, please tell us. We would rather hear from you and put it right. 

How to complain to us. Email us at [email protected], call +44 (0) 1743 636300, or write to Data Protection, Shoothill Ltd, Willow House East, Shrewsbury Business Park, Shrewsbury SY2 6LG. Use whichever route suits you.  

What happens next. We will acknowledge your complaint within 30 days of receiving it, and we aim to do so within five working days. We will investigate without undue delay, keep you updated if it is taking time, and write to you with the outcome, our reasons, and anything we are putting right. Our full complaints procedure, including how to ask for an internal review, is at www.shoothill.com/data-protection-complaints. 

Escalating to the Information Commissioner’s Office. You have the right to complain to the ICO, the UK’s independent regulator for data protection. You can do that at any time, you do not need our permission or agreement, although the ICO will usually want to know whether you have raised the matter with us first and given us a reasonable opportunity to respond. 

Information Commissioner’s Office 
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF 
Helpline: 0303 123 1113 
Online: ico.org.uk/make-a-complaint 

Complaining to us or to the ICO does not affect your right to take your own legal action. You can apply to a court for an order requiring us to comply with the law, and you may be able to claim compensation for damage caused by a breach of data protection law. 

11. Changes to this policy

We review this policy at least annually and update it when our practices or the law change. The current version and its effective date are shown at the top. Where we make a change that materially affects how we use your personal data, we will publish a notice on this page and, where we hold your email address and it is appropriate to do so, tell you directly.