Privacy

Who we are

Practical Reason is the trading name of Parallel Agents Ltd, a company registered in England & Wales (company no. 17123782). Our registered office is at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ. Contact: hello@practicalreason.co.uk.

We are registered with the UK Information Commissioner's Office (ICO) as a data controller. Registration reference: ZC120533. You can verify this at ico.org.uk.

What data we collect

In short: what you type into our forms, payment details handled by Stripe, and basic technical data to keep the site safe.

• Contact information: name, email address, brand name and store web address, submitted through our free audit and contact forms
• Payment data: card details entered when paying for the full review or a monthly plan, processed directly by Stripe. We never see or store your full card number
• Usage data: pages visited and referral source, only with consent
• Technical data: browser type, device type and IP address, for security and fraud prevention (legitimate interest)

The free shop check and our forms

In short: you tell us what we need to reply, and we use it for nothing else.

Our website has four kinds of form: the free shop check, the ad account audit request, the 17 checks download, and the contact form. Depending on the form, we collect:

• Free shop check: your shop’s web address, your email address and your shop’s name. We use the web address to run automatic checks on your public website, and your email address to send you the report
• Ad account audit and contact forms: your name, email address, shop or business name, web address, your rough monthly ad spend as a band (for example £3,000 to £10,000), which ad platforms you use, and any message you write. We use these to reply, and to judge whether we can help before we ask you for anything else
• The 17 checks: your email address and, if you give it, your shop’s name, so we can give you the checklist and know who asked for it

Each form also has a hidden field that people never see. It catches automated spam and holds no personal data.

Our legal basis is consent (6(1)(a)) when you submit a form, and legitimate interests (6(1)(f)) for replying to you. We keep form data for 24 months from our last contact unless you become a client, as set out under Data retention below. You can ask us to delete it at any time.

Analytics load only after consent. Google Analytics, and the form events it records (such as a form being started or sent), load only if you accept analytics cookies. If you decline, or do not answer the cookie banner, they never load.

How we use your data

• To run and deliver the free audit you requested
• To deliver the full review and any monthly service you buy, and to process payment (Stripe)
• To respond to enquiries
• To improve the website (only with analytics consent)
• To meet our legal and tax obligations

We do not add you to a marketing list when you request a check, an audit or send a note. After a free shop check we may send you up to two short emails about your report within the following week. Reply with the word stop, or ask us at any time, and we will not contact you again.

Legal basis for processing

In short: UK law says we need a legal reason for each way we use your data. These are ours.

• Consent (6(1)(a)): when you submit a form or accept analytics cookies
• Contract (6(1)(b)): to deliver services you have bought and process payment
• Legitimate interests (6(1)(f)): to respond to enquiries, prevent fraud and keep the site secure
• Legal obligation (6(1)(c)): to meet tax, accounting and regulatory requirements

Sub-processors

In short: these are the companies we use to run the service. Each one must protect your data to GDPR standards.

We use the following processors to deliver the service. Each is contractually bound to GDPR standards:

• Cloudflare (US/UK): website hosting, CDN and DDoS protection
• Stripe (US/Ireland): payment processing
• Google Workspace (US/Ireland): business email and document storage
• Resend (US): transactional email delivery
• Klaviyo or Mailchimp (US/Ireland): client email campaigns, where applicable
• Anthropic & Google AI (US): AI content generation, with contractual data protection commitments

International transfers are covered by UK Standard Contractual Clauses or UK adequacy decisions where applicable. These are the legal safeguards UK law requires when data leaves the UK.

Data retention

In short: how long we keep your data before we delete it.

• Enquiry and audit data: 24 months from last contact, unless you become a client
• Client data: the length of the engagement plus 7 years (UK accounting requirements)
• Payment records: 7 years (HMRC requirement)

Your rights

In short: it's your data. You can ask to see it, change it or delete it at any time.

Under UK GDPR you can access, correct, erase, restrict, port or object to our use of your data, and withdraw consent at any time. To exercise any right, email us at the address above. We respond within 30 days. You can complain to the ICO at ico.org.uk or on 0303 123 1113.

Cookies

Essential cookies (no consent needed): security and your cookie preference. Optional analytics cookies are off by default and set only if you accept them. No third-party advertising cookies are used.

Security

HTTPS across the site, encrypted data at rest, Stripe PCI-DSS Level 1 for payments, multi-factor authentication on all admin accounts and least-privilege access controls.