Privacy Policy.

Banana Milkshake ("we", "us", "our") is a digital growth agency providing web design, performance marketing, and AI automation services.

Trading name: Banana Milkshake
Registered address: [REGISTERED ADDRESS — update before publishing]
Contact email: hello@bananamilkshake.co

We are the data controller for the personal information you provide to us through this website.

We only collect personal data that you actively give us. This includes:

• Contact and enquiry forms — your name, email address, company name, and any message you submit via our contact or project intake forms.
• Email correspondence — if you email us directly, we collect the information contained in that email.
• Cookie and analytics data — only if you choose to accept cookies, we may collect anonymised usage data about how you interact with our website (pages visited, time on site, referral source). We collect no analytics data if you decline cookies.

We do not collect sensitive personal data (such as health information, financial details, or government ID numbers).

We use the personal data we collect to:

• Respond to your enquiry or project request
• Communicate with you about our services
• Improve our website and services (analytics, only with your consent)
• Meet our legal and contractual obligations

We do not use your data for automated decision-making or profiling.

Under UK GDPR, we rely on the following legal bases to process your personal data:

• Legitimate interests — to respond to your enquiry and communicate about potential or existing services.
• Consent — for analytics cookies. You can withdraw this at any time using the "Cookie settings" link in the footer.
• Contract — to fulfil our obligations where we have entered into an agreement with you.

We retain your personal data only for as long as necessary:

• Enquiry and contact data — up to 2 years from last contact, after which it is securely deleted.
• Client project data — for the duration of the project and up to 6 years afterwards, as required for legal and accounting purposes.
• Cookie consent records — 12 months, after which you will be asked again.

We do not sell your personal data. We only share it with third-party service providers who help us operate our website and services:

• Vercel — our website hosting provider. Your data passes through Vercel's infrastructure when you visit this site. Vercel Privacy Policy
• Resend — our email delivery service, used to send us your contact form submissions. Resend Privacy Policy

All third-party providers are required to handle your data securely and in accordance with applicable data protection law. Where data is transferred outside the UK, we ensure appropriate safeguards are in place.

Under UK GDPR, you have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate or incomplete data.
• Erasure — request that we delete your personal data ("right to be forgotten").
• Restriction — ask us to stop processing your data in certain circumstances.
• Portability — receive your data in a structured, machine-readable format.
• Objection — object to processing based on legitimate interests.
• Withdraw consent — where we rely on consent, you can withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, email us at hello@bananamilkshake.co. We will respond within 30 days.

We use a cookie consent banner to give you control over non-essential cookies. You can accept or decline when you first visit, and change your choice at any time using the "Cookie settings" link in the footer.

• Strictly necessary cookies — required for the site to function (e.g. storing your cookie consent preference). These are always active.
• Analytics cookies — used to understand how visitors use our site. Only active if you accept cookies.

We do not use advertising, targeting, or social media cookies.

If you have a concern about how we handle your personal data, please contact us first at hello@bananamilkshake.co and we will do our best to resolve it.

If you remain unsatisfied, you have the right to lodge a complaint with the UK's data protection regulator:

Information Commissioner's Office (ICO)
Website: ico.org.uk
Phone: 0303 123 1113

We may update this policy from time to time. When we do, we will update the date at the bottom of this page. We encourage you to review it periodically. Continued use of our website after any changes constitutes acceptance of the updated policy.