Privacy notice
Last updated 30 October 2026
This notice explains how Show Up London collects and uses personal data. It is written to meet Articles 13 and 14 of the UK GDPR and the Data Protection Act 2018.
Who we are
Show Up London is the trading name of Serhat Dereli, a sole trader based in Bromley, London. Address for correspondence: 54 Blyth Road, Bromley BR1 3RU. Email: hello@showuplondon.co.uk. Phone: 07387 819501. We are the controller of the personal data described here.
What we collect and why
| Data | Why we use it | Lawful basis (UK GDPR Art 6) | How long we keep it |
|---|---|---|---|
| Enquiry form: business name, your name, email, phone, business postcode, business type, current website, what you need, your message, the consent text you agreed to, the date and time, and your IP address and browser type | To prepare your free business check, contact you about it and answer your enquiry; the IP address and timing are used to prevent spam and abuse | Art 6(1)(b) steps at your request before entering a contract; Art 6(1)(f) our legitimate interest in running and protecting the service | 12 months from your enquiry if you do not become a client, then deleted automatically from our enquiry database. Copies in our CRM and mailbox are deleted in a monthly review |
| SponsorRadar research enquiries: your name, reply email, optional creator or agency name, YouTube link, optional brief and exclusions, consent wording, source tag, date/time, IP address and browser type | To assess and respond to the research example you request, and prevent spam or abuse. This form does not subscribe you to marketing emails. | Art 6(1)(b) steps at your request before entering a contract; Art 6(1)(f) our legitimate interest in protecting the service | 12 months if you do not become a client, under the enquiry retention process (database deletion is automatic; copies in our CRM and mailbox go in a monthly review) |
| Product-video enquiries: your name, reply email, product website, workflow brief, optional deadline, consent wording, source tag, date/time, IP address and browser type | To assess your product-video brief, contact you about the enquiry and prevent spam or abuse. This does not subscribe you to marketing emails. | Art 6(1)(b) steps at your request before entering a contract; Art 6(1)(f) our legitimate interest in protecting the service | 12 months if you do not become a client, under the enquiry retention process (database deletion is automatic; copies in our CRM and mailbox go in a monthly review) |
| CRM migration enquiries: your name, email, organisation, source and destination CRM, records in each export, estimated exceptions, whether source IDs are kept, project timing, what would help, your project outline, consent wording, source tag, date/time, IP address and browser type | To assess and respond to your CRM migration enquiry and prevent spam or abuse. This does not subscribe you to marketing emails. | Art 6(1)(b) steps at your request before entering a contract; Art 6(1)(f) our legitimate interest in protecting the service | 12 months if you do not become a client, under the enquiry retention process (database deletion is automatic; copies in our CRM and mailbox go in a monthly review) |
| Client records: contact details, contract, invoices, correspondence, logins you share with us for your website, Google or booking accounts | To deliver and support the services you buy, invoice you and keep required business records | Art 6(1)(b) contract; Art 6(1)(c) legal obligation for tax and accounting records | For the contract plus 6 years for tax and accounting records; logins deleted when the service ends |
| Payments and orders: your name, email, phone number, billing address, business name, the plan you buy and its payment status. Card or bank details are entered on Stripe's page and held by Stripe, not by us | To take payment, set up and run your plan, send receipts and invoices, and let you sign in to your client portal to manage it | Art 6(1)(b) contract; Art 6(1)(c) legal obligation for tax and accounting records | For the contract plus 6 years for tax and accounting records |
| Marketing to existing clients (occasional emails about our services) | To tell clients about relevant services | Art 6(1)(f) legitimate interests, with the soft opt-in under PECR reg 22(3); every message has an unsubscribe link | Until you unsubscribe or stop being a client |
| Website analytics: page views, country, device type and referrer (Cloudflare Web Analytics), plus our own daily totals of button taps and report views | To understand how the site is used | Art 6(1)(f) legitimate interests; neither uses cookies or identifies you, and neither uses cross-site identifiers | Aggregated daily totals only; no individual records |
| Google Analytics, only if you accept analytics cookies: the pages you visit, how you arrived, your approximate location (town or city, worked out from your IP address, which Google Analytics does not store), your device and browser type, and a few actions on the site (starting the website checker, sending an enquiry, starting a checkout, tapping to call, WhatsApp or email us) | To see which pages and services people find useful, so we can improve the site | Art 6(1)(a) consent, given through the cookie banner; you can withdraw it at any time with Cookie settings at the bottom of every page | Event-level data is deleted by Google after 2 months; reports keep totals, not individuals |
We do not ask for, and please do not send, any special category data (for example health information) through the enquiry form.
If we contacted you first (business prospects)
This section is for people at businesses we contacted before you got in touch with us, and is our Article 14 notice to you.
- Where we got your details. From public sources: your business's own website, its Google Business Profile and public business directories. We did not get them from anyone else.
- What we hold. Your business name, the contact names your business publishes, your business phone number and email address, and our observations about your website and online presence (for example how it looks on a phone, or whether it takes bookings).
- Why we use it. To offer you services relevant to your business: websites, online booking and an AI receptionist. We prepare a private report about your online presence and may contact you by email, WhatsApp or phone to offer it.
- Lawful basis. Legitimate interests (Art 6(1)(f)). Our interest is finding customers for services that may help local businesses; we use only business information that is already public, collect no more than we need, and you can stop us at any time.
- Private report links. If we send you a link to your report, it is unlisted and marked noindex, so search engines do not list it. Only people who have the link can open it. We record when the link is opened (the first and last time, and how many times, with no IP address) so we know when to follow up.
- Preview pages. If we send you a preview page (a web address starting /p/), we record only that the page was opened, whether the video was watched (and how far), and which buttons were clicked, with the time. We record no IP address.
- Who it is shared with. Only the processors named under "Who we share it with" below. Prospect records are kept in our own outreach database (hosted by Cloudflare) and in HubSpot.
- How long we keep it. If you do not reply, we delete your prospect record within 12 months of our last contact with you, the same period we use for enquiries that do not become clients. If you become a client, the client records row of the table above applies instead.
- Stopping contact. You can object, and ask us to stop all contact, at any time by emailing hello@showuplondon.co.uk (or telling us on a call or by message). We act on it straight away. We then keep a minimal suppression record (your business name and contact details, and the date you objected) for the sole purpose of making sure we never contact you again.
- Email and PECR. We send unsolicited marketing emails only to limited companies and other corporate bodies. We contact sole traders and partnerships only by phone, or by email or message if they have agreed to hear from us. We check numbers against the Telephone Preference Service (TPS) and Corporate TPS before calling. Your other rights, and how to complain to the ICO, are set out under "Your rights" below.
Live chat on our website and reports
Our website has a live chat assistant that answers questions about our services. Here is what happens to what you type.
- Who sees your messages. What you type is sent to Cloudflare Workers AI (Cloudflare, Inc.), which generates the reply. Cloudflare states that it does not use customer content processed by Workers AI to train AI models (Cloudflare's Workers AI data usage page). Please do not type anything sensitive into the chat.
- Chats are not stored. We do not keep your chat unless you choose to leave your details. If you do, and you tick the consent box, we keep your name, business name, phone or email, best time to contact you and a copy of this chat (the last 10 messages) for 30 days, and we use them only to reply to you. They are then deleted automatically. The copy we email to ourselves is also covered by the monthly review described above.
- Lawful basis. For the details you choose to leave, consent (Art 6(1)(a)); you can withdraw it at any time. For answering a question you asked in the chat, our legitimate interests (Art 6(1)(f)) in replying to people who ask us about our services.
- Abuse protection. To stop spam and overuse we keep short-lived counters of how many requests come from each IP address. They expire automatically, after at most about 25 hours (most after 10 minutes to a few hours), and they are not linked to your name or to anything you typed. Our logs record which service answered, never what was said.
- WhatsApp. If the chat offers to carry on over WhatsApp and you choose it, the conversation moves to WhatsApp (Meta) and is handled under their terms and privacy policy, not ours.
- Deleting your details. Email hello@showuplondon.co.uk and we will delete them.
Who we share it with
We use these processors under written contracts that meet Article 28: Cloudflare, Inc. (website hosting, the database that stores enquiries, the Turnstile anti-bot check, AI chat replies (Workers AI), the service emails we send you, and Cloudflare Access, which emails you a one-time PIN so you can sign in to your client portal), Stripe Payments UK Ltd (Stripe: takes card and Direct Debit payments and runs subscriptions, receipts and invoices; it handles your name, email, phone number, billing address and payment details, and we never see or store your full card or bank numbers), HubSpot, Inc. (customer relationship management, where enquiries are also recorded so we can follow up), Microsoft Corporation (email and documents), Anthropic PBC (AI analysis of prospect website screenshots and text, used by our outreach tool), Google Ireland Limited and Google LLC (Google Analytics, only if you accept analytics cookies) and Apple Inc. (iCloud copy of owner alerts). Enquiry data is stored in Cloudflare's Western Europe location. Where these providers process data in the United States they are certified under the UK Extension to the EU-US Data Privacy Framework (the UK-US data bridge, in force since 12 October 2023), which the UK Government recognises as providing adequate protection. We do not sell personal data and we do not share it with anyone else unless the law requires it.
Cookies and similar technologies
We ask before using any cookie that is not strictly necessary. On your first visit a banner asks whether we may use analytics cookies. Nothing is set and nothing is sent to Google unless you choose Accept analytics, and rejecting or ignoring the banner changes nothing else about the site.
- Analytics cookies, only with your consent. Google Analytics sets two cookies,
_gaand_ga_23BGZNG84P, which tell one browser from another so we can count visits. They last up to two years and are renewed when you come back. We have turned off Google signals and every advertising feature, so this data is not used to show you adverts or to link your devices together. Google explains its side in How Google uses information from sites that use its services. - Remembering your choice. Your browser stores your answer in its local storage (
sul-consent, holding only the choice and the date) so we do not ask on every page. We ask again after 12 months, or sooner if this notice changes. If you switch between light and dark mode, your browser also remembers that (sul-theme). Neither leaves your device. - Strictly necessary. Cloudflare Turnstile protects the enquiry forms from bots and is strictly necessary to provide the service you request; it may set a strictly necessary cookie and collects technical signals described in Cloudflare's Turnstile privacy addendum. Cloudflare Web Analytics and our own daily totals use no cookies at all.
- Changing your mind. Use Cookie settings at the bottom of any page. If you withdraw consent, Google Analytics stops on that browser straight away and its cookies are deleted.
Your rights
You can ask us for a copy of your data, ask us to correct or delete it, restrict or object to how we use it, and ask for it in a portable format. You can withdraw consent at any time where we rely on it, and you can object to marketing at any time. Email hello@showuplondon.co.uk and we will respond within one month. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
Security
Data is encrypted in transit and at rest, access is limited to Serhat Dereli and protected by two-factor authentication, the enquiry database has no public endpoint, and unconverted enquiries are deleted automatically from the enquiry database after 12 months. If a breach is likely to put you at risk we will tell you and the ICO without undue delay.
Automated decisions and children
We make no decisions about you by automated means. Our services are for businesses and the site is not aimed at anyone under 18.
Changes
We will update this page if our practices change and show the date at the top.