Privacy Policy

1. Introduction

This privacy policy explains how Tech Market Access Ltd, trading as GTM Hive ("we", "us", "our"), collects, uses, stores and protects your personal data when you use our services, including the GTM Hive Membership platform, our consulting and advisory services, our website (gtmhive.com), and any associated digital content or communications.

We are committed to protecting your privacy in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003 (PECR). This policy is designed to meet the standards set by the Information Commissioner's Office (ICO).

2. Data Controller

The data controller responsible for your personal data is:

Tech Market Access Ltd, trading as GTM Hive
Company number 14410756, registered in England and Wales
Registered office: Amherst Accountancy, 7 Blighs Walk, Sevenoaks, Kent, TN13 1DB
ICO registration number: ZB618137
Email: james@gtmhive.com
Website: gtmhive.com

If you have any questions about this policy or about how we handle your personal data, please contact us using the details above.

3. What Personal Data We Collect

We may collect and process the following categories of personal data:

3.1 Information you provide directly

• Full name and job title
• Business email address and telephone number
• Company name and business address
• Payment and billing information (processed securely via our third-party payment provider)
• Account credentials for the GTM Hive Membership platform
• Communications you send to us (emails, enquiry forms, feedback)
• Responses to surveys or questionnaires

3.2 Information collected automatically

• IP address and approximate geographic location
• Browser type, device type and operating system
• Pages visited, time spent on pages, and navigation paths on our website
• Consented interaction data such as clicks, scrolling and page engagement, with sensitive content masked
• Cookies and similar tracking technologies (see Section 10)
• Referral source (how you found us)
• The campaign details in the link you followed to reach us (for example utm tags)

3.3 Information from third parties

• Publicly available business contact information from LinkedIn or company websites, used for legitimate business outreach
• Data enrichment services we use to verify and supplement business contact details
• Analytics data from platform providers (e.g. website hosting, email marketing tools)
• Details of people introduced to us: when someone who has trained with us introduces you, they tell us your name and company, and we receive the contact details they share when they connect us (by email or LinkedIn). We use them only so James can reply to you once, personally, and to keep track of the introduction (our legitimate interests). We hold them in our email and our CRM (HubSpot). If you don't reply, we don't follow up, and we delete them within 12 months unless you choose to work with us.

4. Lawful Basis for Processing

Under UK GDPR, we must have a valid lawful basis for processing your personal data. The bases we rely on are set out below.

5. How We Use Your Personal Data

We use your personal data for the following purposes:

• To create and manage your account on the GTM Hive Membership platform
• To reply to enquiries you send us
• To deliver consulting, training and advisory services you have engaged us for
• To process payments and manage subscriptions
• To send you service-related communications (e.g. login details, subscription confirmations, service updates)
• To send marketing communications where you have opted in or where we have a legitimate interest (with an easy opt-out)
• To personalise your experience on our platform and website
• To analyse website usage patterns and improve our services
• To conduct business development and outreach activities
• To comply with legal and regulatory obligations
• To protect our rights, property and safety and that of our users

6. Marketing Communications

We may send you marketing communications about our services, events, content and offers, by email and — where you have provided a mobile number and explicitly opted in — by SMS text message or WhatsApp. We rely on your consent, or in limited circumstances the "soft opt-in" under PECR, as the lawful basis for these communications.

6.1 How we obtain your consent

We treat the following actions as your clear and informed consent to receive marketing emails from us. In each case the form or page through which you provide your email makes this clear at the point of collection:

• Creating an account on our platform (including the membership area and any other GTM Hive product)
• Downloading any lead magnet, guide, course, template or other resource where you provide your email address
• Subscribing to our newsletter

Sending us an enquiry through our contact form is not consent to marketing emails. We use your details to reply to your enquiry.

Marketing by SMS and WhatsApp is separate and strictly opt-in. We only send marketing messages on these channels where you have entered a mobile number in your account settings and ticked the dedicated opt-in box, which is unticked by default. We record the date of your consent and the exact wording you agreed to. You can withdraw this consent at any time by un-ticking the box in your account or by replying STOP to any message.

We also rely on the "soft opt-in" under PECR Regulation 22(3) where you are an existing client or subscriber and the communication relates to similar services to those you have already engaged us for. We rely on it too when you join the waitlist for one of our workshops: you also receive our weekly newsletter, Notes from the Hive, unless you tick "No thanks, waitlist only" on the form.

6.2 How to opt out

Every marketing email we send includes a clear and functional unsubscribe link, and every marketing text message or WhatsApp message includes a STOP opt-out. You can opt out at any time, and we will action your request promptly. Opting out of marketing will not affect service communications necessary for the performance of our contract with you (e.g. login details, billing confirmations).

7. Who We Share Your Data With

We do not sell your personal data to third parties. We may share your data with the following categories of recipients, strictly on a need-to-know basis:

• Payment processors (e.g. Stripe) to handle transactions securely
• Email marketing platforms (e.g. MailerLite) to manage newsletters and communications
• Email delivery providers (Resend) to send the emails you ask for, such as downloads, booking confirmations and account messages
• Website hosting, infrastructure and analytics providers (e.g. Vercel, Supabase and PostHog)
• Visitor identification and sales engagement tools (e.g. Lemlist) — see Section 10
• Our CRM (HubSpot), for managing business relationships
• AI tools acting on our behalf to analyse aggregated analytics, our CRM and privacy-masked session recordings
• Cloud storage providers for secure document storage
• Professional advisers (accountants, lawyers) where necessary
• Law enforcement or regulatory bodies where we are legally required to do so

All third-party processors we work with are required to process your data in accordance with UK GDPR, and we ensure appropriate contracts are in place with each provider.

8. International Data Transfers

Some of the third-party services we use may store or process data outside the United Kingdom. Where this occurs, we rely on the safeguards UK law provides: an adequacy decision by the UK Secretary of State (for example for the European Economic Area, where PostHog holds our analytics data and from where Resend sends our emails); for providers in the United States, such as HubSpot, which hosts our CRM there, the UK Extension to the EU-US Data Privacy Framework where the provider is certified under it; and otherwise the ICO's International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

If you would like further details about the specific safeguards applied to any international transfer of your data, please contact us.

9. How Long We Keep Your Data

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected. Our retention periods are as follows:

• Active membership data: retained for the duration of your subscription plus 12 months after cancellation
• Consulting engagement records: retained for 6 years after completion (in line with HMRC requirements)
• Marketing consent records: retained for as long as your consent is active, plus 12 months after withdrawal
• Website analytics data: Vercel Web Analytics data may be retained for up to 26 months. PostHog session recordings are kept for 30 days and PostHog events for one year, under our current plan with PostHog.
• Financial and tax records: retained for 6 years as required by UK law
• Correspondence and support enquiries: retained for 2 years after the last interaction

When personal data is no longer required, we securely delete or anonymise it.

10. Cookies and Tracking Technologies

Our website uses cookies and similar technologies (scripts and local storage). Cookies are small text files placed on your device; similar technologies can store or read identifiers on your device for comparable purposes. Some of what we use needs your consent. Our cookie-free statistics do not, but you can switch them off.

10.1 What we use and why

• Strictly necessary: Used to keep you signed in to your membership account (authentication and session management), to process payments securely, including fraud prevention, during checkout (Stripe), and to remember your cookie choices. These are required for the website to function and do not require consent.
• Statistics (no consent needed; you can switch this off in Cookie settings): We use Vercel Web Analytics and PostHog (hosted in the EU) to count visits without cookies and without storing any identifier on your device. PostHog records the pages you view, actions such as submitting a form, the site you came from and the campaign tags in the link you followed, and your browser and device type; it keeps no IP address and no location. Vercel records the page, the site you came from, your country, and your browser, operating system and device type. To tell one visit from another, each provider calculates a temporary code on its own servers from details of your request, such as your IP address and browser, and PostHog keeps that day's visit together on its servers so it can count sessions. The code changes every day and is then discarded, so a visit on one day is not linked to a visit on the next. We use this data only in aggregate, as counts and rates by page, source and campaign, to improve the site, and advertising click codes are removed before it is sent. To switch statistics off, use "Turn off" on our cookie banner or untick Statistics in Cookie settings in our website footer; Vercel and PostHog then stop counting your visits on that browser.
• Analytics with your consent (journeys and session recordings): If you allow journeys and session recordings, PostHog stores an identifier on your device so we can follow your journey across visits, and records privacy-masked sessions and heatmaps on our public pages: your clicks, scrolling, mouse movement and the page content, with form inputs masked. Recordings and heatmaps are never made on account, member or administration pages, and recordings are kept for 30 days. If you are signed in, we link your journey to your account ID, never to your name or email address.
• CRM tracking, with your consent (HubSpot): If you allow CRM tracking, we load HubSpot's tracking code. It sets a cookie that, once you submit a form on our website or click a tracked link in one of our emails, links the pages you view on our website to your contact record in our CRM.
• Visitor identification, with your consent: We use Lemlist to help us understand which businesses visit our website. This technology may store an identifier on your device and match your visit against business contact databases and your interactions with emails we have sent you, which can identify your company and, in some cases, you as an individual. We enable it only if you allow visitor identification through our cookie banner or Cookie settings, and you can change your choice at any time (see Section 10.2).
• Advertising and retargeting, with your consent: We use advertising pixels from Meta (Facebook and Instagram), Google (Google Ads) and LinkedIn. These place or read an identifier on your device so that, after you visit our website, we can show you relevant GTM Hive content and ads on those platforms (this is known as retargeting) and measure how well our ads perform. They may allow the platform to recognise you as one of their logged-in users. We load these pixels only if you allow advertising through our cookie banner or Cookie settings, and you can withdraw your consent at any time (see Section 10.2). Ad platforms may also add an identifier to the link you click to reach us (such as gclid, fbclid or li_fat_id). We use it only if you accept advertising cookies; otherwise we remove it before any analytics data is sent.
• Storage on your device by our own website: We always store your cookie choices, so we don't ask again on every page, and PostHog stores a note of whether you allowed it (a key beginning __ph_opt_in_out), so a refusal is kept to. Only if you allow journeys and session recordings do we also store a note of the campaign link you first arrived from (its utm tags, never advertising click codes), for up to 90 days, so that if you create an account we can see which campaign brought you. We delete it if you reject or withdraw that consent. Otherwise the campaign details stay in the page's memory during your visit; if you sign in with Google, they travel in the address Google sends you back to rather than being stored on your device. If you create an account during that visit, we record the campaign it came from against your account.

10.2 Managing cookies and tracking

When you first visit our website, our cookie banner asks whether you accept or reject the uses above that need your consent, and lets you switch off our cookie-free statistics with one click. You can change any of these choices at any time using the Cookie settings link in our website footer, where each use has its own setting. You can also block or delete cookies through your browser settings, or ask us to exclude your data from visitor identification by contacting us at james@gtmhive.com.

Please note that blocking strictly necessary cookies may prevent parts of the website from working, such as signing in to your account or completing a purchase.

11. Your Rights Under UK GDPR

Under the UK GDPR and the Data Protection Act 2018, you have the following rights in relation to your personal data:

• Right of access: You can request a copy of the personal data we hold about you (a Subject Access Request).
• Right to rectification: You can ask us to correct inaccurate or incomplete personal data.
• Right to erasure: You can ask us to delete your personal data where there is no compelling reason for us to continue processing it.
• Right to restrict processing: You can ask us to suspend processing of your personal data in certain circumstances.
• Right to data portability: You can request that we transfer your data to another organisation in a structured, commonly used, machine-readable format.
• Right to object: You can object to processing based on legitimate interests or direct marketing at any time.
• Right to withdraw consent: Where we rely on your consent, you can withdraw it at any time, as easily as you gave it: use Cookie settings in our website footer, the unsubscribe link in any marketing email, or the opt-out in your account settings. Withdrawing does not affect what we did with your consent before.
• Right to switch off statistics: You can switch off our cookie-free statistics at any time, with one click, in Cookie settings. Vercel and PostHog then stop counting your visits (see Section 10.1).
• Rights related to automated decision-making: You have the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects.

To exercise any of these rights, please contact us at james@gtmhive.com. We will respond to your request within one calendar month, as required by UK GDPR. There is no fee for making a request, although we may charge a reasonable fee or refuse to act on a request if it is manifestly unfounded or excessive.

12. Data Security

We take the security of your personal data seriously and have implemented appropriate technical and organisational measures to protect it against unauthorised access, alteration, disclosure, or destruction. These measures include:

• Use of encrypted connections (HTTPS/TLS) across all platforms
• Secure password policies and, where available, multi-factor authentication
• Access controls limiting data access to authorised personnel only
• Regular review of our data processing activities and security measures
• Use of reputable third-party service providers with strong security practices

While we take all reasonable steps to protect your data, no method of electronic transmission or storage is completely secure. We encourage you to use strong passwords and protect your account credentials.

13. Children's Data

Our services are designed for business professionals and are not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child, we will take steps to delete it promptly.

14. Links to Third-Party Websites

Our website and platform may contain links to third-party websites and services. We are not responsible for the privacy practices of those third parties. We encourage you to read the privacy policy of any website you visit.

15. Changes to This Privacy Policy

We may update this privacy policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. Where changes are material, we will notify you by email or by a prominent notice on our website. We encourage you to review this policy periodically.

The date at the top of this policy indicates when it was last updated.

16. How to Complain

If you are unhappy with how we have handled your personal data, you can complain to us directly. Email james@gtmhive.com with "Data protection complaint" in the subject line, or write to us at our registered office (see Section 2).

We will acknowledge your complaint within 30 days of receiving it, look into it, and respond without undue delay, telling you what we found and what we have done about it.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's independent authority for data protection:

Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Telephone: 0303 123 1113
Website: ico.org.uk

17. Contact Us

If you have any questions about this privacy policy or our data practices, please get in touch:

James Barker
Tech Market Access Ltd, trading as GTM Hive
Email: james@gtmhive.com
Website: gtmhive.com