Last Updated: September 2026
Sarah Lambley Marketing (“we”, “us”, or “our”) respects your privacy and is committed to protecting your personal data. This policy explains how we collect, process, store, and safeguard personal information across sarahlambleymarketing.com and connected platforms (including our training and quiz subdomains), in compliance with the UK Data Protection Act 2018 / UK GDPR, the EU General Data Protection Regulation (EU GDPR), the Privacy and Electronic Communications Regulations (PECR), and international regulations including the California Consumer Privacy Act (CCPA/CPRA).
1. Data Controller Information
The data controller responsible for your personal information is:
Legal Entity / Name: JSFR Consulting Ltd (Company No. 10149831), trading as Sarah Lambley Marketing
Registered Address: 29 Kingfisher Road, Knaresborough, HG5 0GD
Website: https://www.sarahlambleymarketing.com
Direct Privacy Inquiries: hello@sarahlambleymarketing.com
2. Personal Data We Collect
Depending on how you interact with our website and services, we may collect and process:
Identity & Contact Data: Name, business name, and email address provided via inquiry forms (Fluent Forms), newsletter opt-ins (ActiveCampaign), or diagnostic assessments.
Transactional Data: Details of products or strategy sessions purchased via our checkout subdomains (shop.sarahlambleymarketing.com powered by SamCart, or academy.sarahlambleymarketing.com via Teachable). Financial payment details (credit card numbers) are processed securely by PCI-compliant payment gateways and are never stored on our servers.
Technical & Usage Data: IP address, browser type and version, time zone setting, operating system, referral URLs, page engagement metrics, and interaction paths captured via Google Analytics 4 (GA4).
Marketing & Advertising Data: Interaction metrics and attribution parameters derived from paid campaigns via Meta (Facebook and Instagram Ads) and Google Ads.
Interactive Assessment Data: Responses provided during the Brand DNA Test, our brand archetype diagnostic quiz (archetypes.sarahlambleymarketing.com), stored in our secure database provider, Supabase.
3. How We Collect Your Data
Direct Interactions: When you fill out contact forms, book a discovery call, subscribe to our newsletter, complete a quiz, or purchase digital downloads.
Automated Technologies (Cookies & Tracking): As you navigate our site, we and authorized third parties use cookies, tags, and tracking pixels to analyze engagement and support paid advertising attribution (subject to your consent preferences).
Third-Party Services & Integrations: We receive aggregated or operational data from connected platforms, including:
Email & Marketing Automation: ActiveCampaign
E-Commerce & Course Delivery: SamCart and Teachable
Social Proof & Feedback: Senja (displaying verified testimonials)
Spam Prevention: Cloudflare Turnstile (protecting form endpoints without tracking personal profiles)
Database & Assessment Storage: Supabase (securely storing Brand DNA Test responses and results)
4. Legal Bases for Processing (UK & EU GDPR)
Under UK and EU data protection laws, we rely on the following lawful bases:
Consent (Art. 6(1)(a) GDPR): Required prior to setting non-essential cookies (Analytics, Tracking, and Advertising) and for sending direct marketing newsletters. You may withdraw consent at any time.
Contractual Necessity (Art. 6(1)(b) GDPR): To process orders, deliver purchased digital products, or perform consultancy agreements.
Legitimate Interests (Art. 6(1)(f) GDPR): To monitor site security, prevent fraud, optimize platform performance, and handle routine business inquiries.
Legal Obligation (Art. 6(1)(c) GDPR): To retain financial records and transaction logs for tax and accounting compliance.
5. Cookies & Tracking Technologies
We use cookies and similar browser storage technologies to maintain core website functions, gather audience statistics, and serve relevant advertising.
Strictly Necessary Cookies: Essential for the website to function (session management, security, and storing your consent choices). These cannot be disabled.
Statistics & Analytics Cookies: Help us understand visitor interactions across sarahlambleymarketing.com and connected subdomains using aggregated metrics in GA4. Under UK/EU privacy laws, these require your prior consent.
Marketing & Advertising Cookies: Used to evaluate ad campaigns on Meta and Google, attribute conversions, and present targeted messaging. These scripts remain inactive until explicit opt-in consent is given.
Manage Your Cookie Consent
You can adjust your tracking preferences or revoke consent at any time using our on-site cookie banner or preference manager. We also recognize and honor automated Global Privacy Control (GPC) browser signals.
Live Cookie Inventory
Below is the dynamic inventory of all active cookies, retention periods, and purposes currently operating across this website:
6. International Data Transfers
When data is processed by international platforms (such as Google, Meta, or ActiveCampaign servers based outside the UK and European Economic Area), we ensure appropriate safeguards are maintained through UK International Data Transfer Agreements (IDTAs), Standard Contractual Clauses (SCCs), or adequacy regulations.
7. Data Retention
Contact & Inquiry Inquiries: Retained for up to 24 months following the conclusion of an active discussion or project.
Newsletter & Marketing Contacts: Retained until you click “Unsubscribe” or withdraw consent.
Consent Audit Logs: Retained for 365 days to demonstrate compliance with data protection authorities.
Financial & Billing Records: Retained for 6 to 7 years in accordance with UK statutory accounting obligations.
8. E-Commerce & Assessment Subdomains
We operate dedicated subdomains to deliver digital training materials, process e-commerce transactions, and host our brand diagnostic tools. The data collected across these platforms is strictly used for service delivery, assessment feedback, and customer management:
1. Digital Shop & Training Checkout (shop.sarahlambleymarketing.com)
Platform Provider: SamCart powers our checkout and order fulfilment infrastructure.
Data Collected: When you purchase digital downloads, training materials, or strategy blueprints, we collect your name, billing address, email address, order details, and VAT/tax identification where applicable.
Payment Security: PCI-DSS-compliant payment gateways (such as Stripe or PayPal) handle all credit card and payment processing. We do not store, process, or have access to raw payment card numbers or sensitive CVV security details on our servers.
Commercial Purpose: Transactional data is processed solely to fulfill orders, issue invoices, maintain statutory financial records under UK tax law, and provide customer support.
2. Brand DNA Test (archetypes.sarahlambleymarketing.com)
Assessment Framework: We host our proprietary Brand DNA Test, a brand archetype diagnostic assessment, on a secure cloud-hosted subdomain (Netlify), with quiz responses and results stored in Supabase, our secure database provider.
Data Collected: When you complete the assessment, you provide your name, business email, and self-selected responses evaluating your current business positioning, brand challenges, and commercial goals. This information is stored against your session and, where you provide your email, linked to your results so they can be retrieved or emailed to you.
Purpose of Processing: We use this information to calculate your brand persona profile, deliver your tailored Brand DNA test results, and send relevant follow-up strategic advice or weekly marketing letters (where you have explicitly opted in via our consent checkbox).
Strict Non-Disclosure & Data Exclusivity Commitment
We maintain an unconditional commitment to your commercial and personal data privacy:
No Data Brokerage or Sale: We will never sell, rent, trade, lease, or monetize your personal data, quiz responses, assessment profiles, or purchasing history to any third-party brokers, external marketing agencies, or data aggregators.
No Unaffiliated Data Sharing: All information shared through shop.sarahlambleymarketing.com and archetypes.sarahlambleymarketing.com remains strictly confidential between you and Sarah Lambley Marketing.
Essential Service Processors Only: Your data is only transmitted through secure, GDPR-compliant software infrastructure essential to run our business operations (e.g., sending automated quiz confirmation emails via ActiveCampaign, completing card transactions via SamCart’s processors, or routing traffic through secure hosting networks). These technical service providers are legally bound by Data Processing Agreements and are strictly forbidden from using, reviewing, or sharing your data for their own independent commercial purposes.
9. Your Legal Rights
Depending on your country or state of residence, your rights include:
UK & European Union (GDPR): The right to access, correct, erase, restrict, or transfer your personal data, as well as the right to object to processing and withdraw consent. You also have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) (ico.org.uk) or your local EU supervisory body.
United States (California CCPA/CPRA & State Privacy Laws): The right to know what personal information is collected, request deletion, correct inaccurate data, and opt out of the “sale” or “sharing” of personal data for cross-context behavioural advertising. We do not sell personal information for monetary consideration.
To exercise any of these rights, contact us at hello@sarahlambleymarketing.com.
10. Updates to This Policy
We review and update this policy periodically to reflect changes in our legal obligations, tracking technologies, or service offerings. Any revisions will be published here with an updated effective date.