Privacy notice
Last updated 20 September 2026
This notice explains how ShowUpLondon collects and uses personal data. It is written to meet Articles 13 and 14 of the UK GDPR and the Data Protection Act 2018.
Who we are
ShowUpLondon is the trading name of Serhat Dereli, a sole trader based in Bromley, London. Address for correspondence: 54 Blyth Road, Bromley, Kent BR1 3RU. Email: hello@showuplondon.co.uk. Phone: 07946 426190. We are the controller of the personal data described here.
What we collect and why
| Data | Why we use it | Lawful basis (UK GDPR Art 6) | How long we keep it |
|---|---|---|---|
| Enquiry form: business name, your name, email, phone, business postcode, business type, current website, what you need, your message, the consent text you agreed to, the date and time, and your IP address and browser type | To prepare your free Show Up Score, contact you about it and answer your enquiry; the IP address and timing are used to prevent spam and abuse | Art 6(1)(b) steps at your request before entering a contract; Art 6(1)(f) our legitimate interest in running and protecting the service | 12 months from your enquiry if you do not become a client, then deleted automatically |
| Client records: contact details, contract, invoices, correspondence, logins you share with us for your website, Google or booking accounts | To deliver and support the services you buy, invoice you and keep required business records | Art 6(1)(b) contract; Art 6(1)(c) legal obligation for tax and accounting records | For the contract plus 6 years for tax and accounting records; logins deleted when the service ends |
| Marketing to existing clients (occasional emails about our services) | To tell clients about relevant services | Art 6(1)(f) legitimate interests, with the soft opt-in under PECR reg 22(3); every message has an unsubscribe link | Until you unsubscribe or stop being a client |
| Website analytics (page views, country, device type, referrer) | To understand how the site is used | Art 6(1)(f) legitimate interests; the analytics service (Cloudflare Web Analytics) uses no cookies and no cross-site identifiers | Aggregated only; no individual records |
We do not ask for, and please do not send, any special category data (for example health information) through the enquiry form.
Who we share it with
We use these processors under written contracts that meet Article 28: Cloudflare, Inc. (website hosting, the database that stores enquiries, and the Turnstile anti-bot check), HubSpot, Inc. (customer relationship management, where enquiries are also recorded so we can follow up) and Microsoft Corporation (email and documents). Enquiry data is stored in Cloudflare's Western Europe location. Where these providers process data in the United States they are certified under the UK Extension to the EU-US Data Privacy Framework (the UK-US data bridge, in force since 12 October 2023), which the UK Government recognises as providing adequate protection. We do not sell personal data and we do not share it with anyone else unless the law requires it.
Cookies and similar technologies
This site sets no advertising or tracking cookies and needs no cookie banner. Cloudflare Turnstile protects the enquiry form from bots and is strictly necessary to provide the service you request; it may set a strictly necessary cookie and collects technical signals described in Cloudflare's Turnstile privacy addendum. Cloudflare Web Analytics is cookieless.
Your rights
You can ask us for a copy of your data, ask us to correct or delete it, restrict or object to how we use it, and ask for it in a portable format. You can withdraw consent at any time where we rely on it, and you can object to marketing at any time. Email hello@showuplondon.co.uk and we will respond within one month. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
Security
Data is encrypted in transit and at rest, access is limited to Serhat Dereli and protected by two-factor authentication, the enquiry database has no public endpoint, and unconverted enquiries are deleted automatically after 12 months. If a breach is likely to put you at risk we will tell you and the ICO without undue delay.
Automated decisions and children
We make no decisions about you by automated means. Our services are for businesses and the site is not aimed at anyone under 18.
Changes
We will update this page if our practices change and show the date at the top.