Privacy Notice

1. Who is responsible for your information

Friday Promotions Limited is the controller of the personal information described in this notice. You can contact us at hello@wearefriday.co.uk.

2. Information we collect

• Contact and enquiry information, such as your name, organisation, email address and the contents of your enquiry.
• Report request information, such as your name, organisation, work email, role where provided, and the report you request.
• Subscription information, such as your email address, signup source, subscription status and records of your choice to receive Friday communications.
• Business relationship information, such as correspondence, meeting notes, project information, supplier or client contact details, and records needed to manage a professional relationship.
• Website and device information, such as pages viewed, referral source, device/browser information and interaction data where analytics technologies are enabled.
• Technical and security information needed to operate, protect and troubleshoot our website and services.

3. How we use your information and our lawful bases

We use personal information only where we have a lawful basis. Depending on the context, we may use it to:

• Respond to enquiries and discuss potential work. We generally rely on legitimate interests in running and developing our business and, where relevant, on taking steps at your request before entering into a contract.
• Provide a report or resource you have requested. We generally rely on legitimate interests and, where relevant, steps requested before a contract.
• Manage client, supplier and professional relationships, including delivery, administration, record keeping and communications. We rely on contract, legitimate interests and legal obligations as appropriate.
• Send Friday research, insights, events or other marketing communications. For unsolicited electronic marketing to individual subscribers, including sole traders and certain partnerships, we use consent unless the products and services soft opt-in applies. PECR does not require prior consent for electronic marketing to corporate subscribers, although UK data protection law may still apply where personal information is used. We provide a simple way to unsubscribe or object in our marketing messages.
• Operate and secure our website. We rely on legitimate interests for necessary operational and security processing. Non-essential analytics technologies are handled as described in our Cookie Notice and are not loaded until the required choice has been made.
• Meet legal, regulatory, accounting, fraud-prevention or dispute-resolution requirements. We rely on legal obligations and legitimate interests as appropriate.

Where we rely on legitimate interests, those interests include operating and improving Friday, responding to people who contact us, understanding how our services are used, protecting our systems, developing relevant business relationships and maintaining appropriate records. We consider the impact on individuals and do not rely on legitimate interests where our interests are overridden by your rights and freedoms.

4. Marketing and Friday communications

Requesting a report or contacting Friday does not automatically subscribe you to marketing. Where consent is required, we ask for a clear positive choice. Where the products and services soft opt-in applies, we provide an opportunity to opt out when details are collected and in every subsequent marketing message. Corporate recipients can also unsubscribe or object. We maintain appropriate suppression records so that we can respect opt-outs.

5. Cookies and analytics

Please see our Cookie and Tracking Technologies Notice for details of the cookies, analytics services and other technologies we use, the choices available to you, and how to change those choices.

6. Who we share information with

We may use trusted service providers to host, operate and support our website, forms, databases, email delivery, analytics and research recruitment. Depending on the service you use, these may include:

• Supabase, for database and backend services used by the website.
• Lovable and its managed services, where used to host or operate website functionality and email notifications.
• Google, where Google Analytics or Google Tag Manager is enabled.
• Microsoft, where Microsoft Clarity is enabled.
• Tally, where a Friday research or recruitment form is hosted through Tally.
• Prolific, where participants are recruited or paid through Prolific.
• Professional advisers, regulators, authorities or other recipients where disclosure is necessary for legal, regulatory or dispute-resolution purposes.

Service providers may only use personal information in accordance with their role, our instructions where applicable, and applicable data protection law. We do not sell personal information to advertisers.

7. International transfers

Some of our service providers may process information outside the United Kingdom. Where personal information is transferred internationally, we take steps required by UK data protection law, such as relying on UK adequacy regulations or approved contractual safeguards and carrying out any required transfer risk assessment.

8. How long we keep information

• General enquiries: normally up to 24 months after the last meaningful contact.
• Genuine business and client prospect records: normally up to 5 years after the last meaningful contact where there is a continuing business-record need.
• Report requests: normally up to 24 months.
• Email subscribers: while subscribed. We may retain a limited suppression record after unsubscribe so that we can respect your choice.
• Prize draw administration records: normally up to 6 months after prize fulfilment, unless a longer period is required for legal, accounting or dispute-resolution purposes.
• Website analytics: where Google Analytics is used, we intend to configure user-level and event-level data retention to 14 months. Other technical or aggregated information may be retained differently by the relevant service or where it no longer identifies an individual.
• Records needed for contracts, accounting, legal claims or regulatory compliance: for the period required or reasonably necessary for those purposes.

We may keep anonymised information for longer because it no longer identifies an individual.

9. Your rights

Depending on the circumstances, UK data protection law gives you rights to:

• Ask for access to the personal information we hold about you.
• Ask us to correct inaccurate or incomplete personal information.
• Ask us to delete personal information in certain circumstances.
• Ask us to restrict how we use personal information in certain circumstances.
• Receive certain personal information in a portable format, and ask us to transfer it where the right to data portability applies.
• Object to processing based on legitimate interests in certain circumstances.
• Object at any time to the use of your personal information for direct marketing.
• Withdraw consent at any time where we rely on consent. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

These rights are not absolute and exceptions can apply. To exercise a right, contact hello@wearefriday.co.uk. We may need to verify your identity before acting on a request.

10. Complaints

If you have concerns about how we use personal information, please contact us first so we can try to resolve them. You also have the right to complain to the UK Information Commissioner's Office (ICO).

11. Changes to this notice

We may update this notice as our services, technology or legal obligations change. The date at the top shows when it was last updated.