media
Legal
Privacy notice, in plain English.
This notice explains what personal data Love Yours Media holds, why we hold it, who we share it with, and what you can tell us to do about it. It covers everyone: people who visit this website, people who send us an enquiry, our clients, and businesses we approach with marketing. If you are reading this because we emailed you out of the blue, the section you want is marketing to businesses, which covers both of our campaigns, and the answer to "how do I make them stop" is immediately below.
Want us to stop emailing you? Reply to any email from us with a single word ("stop", "no thanks", anything at all) or email hq@loveyoursmedia.com. We will delete your details and never write to you again, keeping only the minimum suppression record that stops a later campaign reaching you (explained below). You do not have to give a reason and we will not ask for one. We action it on receipt, and it is permanent.
Email us to stopWho is responsible for your data
The data controller is:
LOVE YOURS RECORDINGS LTD, trading as Love Yours Media.
Company number 15728873 · incorporated 19 May 2024 · England & Wales.
651a Mauldeth Road West, Chorlton, Manchester, M21 7SA, United Kingdom.
ZC059949 (Tier 1). We are registered with the Information Commissioner's Office as a data controller.
Mr Romaan Sheikh · hq@loveyoursmedia.com. We are not required to appoint a statutory Data Protection Officer and have not appointed one; Romaan is our named data protection contact.
Visiting this website
We run no analytics and no advertising trackers. There is no Google Analytics, no advertising pixel, no heatmap tool and no third-party tracking script anywhere on this site. We do not build a profile of you, and we do not know who you are when you read this page.
Three things do happen, and we would rather describe them exactly than pretend the site is inert:
Our host, Cloudflare, records standard request logs: IP address, browser user-agent, the page requested and the time. These exist to keep the site up and to block attacks. We do not use them to identify visitors and we do not combine them with anything else. Lawful basis: legitimate interests in the security and availability of our own website.
The site stores at most two items in your browser's session storage. lym-wm, whose entire value is 1, records that the masthead animation has already played once, so it does not replay on every page. lym-ux-score, set only if you press the Sound button on the Connected House page, records whether you turned the score on or off. Neither contains personal data, neither leaves your browser, neither is read by us or anyone else, and both are erased the moment you close the tab.
On the contact page only, we use Cloudflare Turnstile to tell humans from bots. It processes your IP address for that check. We also briefly record your IP address, for about one minute, to stop the form being flooded. Both exist solely to keep the form usable. Lawful basis: legitimate interests in preventing abuse of our own contact form.
We do not show a cookie banner because we do not set advertising, analytics or tracking cookies. If that ever changes, we will ask you first, and this notice will say so before it happens.
Sending us an enquiry
When you use the contact form we receive your name, email address, the service you selected and whatever you write in the message. Your IP address is processed for the anti-spam check described above.
The message is delivered to hq@loveyoursmedia.com by our email provider Resend, sent from contact@send.loveyoursmedia.com. A person reads it and replies.
Lawful basis: our legitimate interest in answering a message you chose to send us and, where you are asking about hiring us, taking steps at your request before entering into a contract. How long: we keep the enquiry while the conversation or engagement is live, and delete it on request at any time.
Paying us
We use Stripe to take payment for one-off website packages and for Care plan subscriptions.
We never see or store card numbers. The package buttons on this site are plain links to a payment page hosted by Stripe. No Stripe code runs on loveyoursmedia.com. You enter your card details on Stripe's own page and they never reach our systems. What we receive back is the customer's name, email address, what they bought and confirmation that payment succeeded. Stripe also uses payment data as a controller in its own right for fraud prevention and to meet its own legal obligations, under its own privacy policy.
Lawful basis: performance of a contract with you. How long: we keep financial records for the period UK tax and company law requires, currently six years from the end of the accounting period they relate to.
Working with us as a client
When you become a client we hold the business contact details of the people we work with, the account and platform access needed to do the work, and the material you send us. Lawful basis: performance of our contract with you.
Some client work involves personal data that belongs to the client rather than to us, for example the enquiry records generated by an advertising campaign we run on their behalf. In that work the client decides what happens to the data and we act on their instructions as their processor. Their privacy notice governs that data, not this one.
Marketing to businesses
We write to a small number of organisations to offer them production services. If you received an email from us that you did not ask for, this is the section that explains it. Stopping it takes one reply.
We run two outbound campaigns, and they hold different things about different people. Find yours below.
Our lawful basis, and the assessment behind it
Legitimate interests (Article 6(1)(f) UK GDPR), for both campaigns. Recital 47 of the UK GDPR expressly recognises that direct marketing may be carried out for a legitimate interest.
Before any campaign begins sending, we carry out a written Legitimate Interests Assessment weighing our interest against your rights, and a director signs it. It records the safeguards we operate: an address that cannot be verified is never written to; any objection or bounce is written to a permanent suppression record; no business is contacted more than once a week, or by both campaigns; every change to our contact records is logged; and the opt-out appears in the first message. The assessment is deliberately conditional: if those safeguards stop working, sending stops until they are fixed. You are welcome to ask us for a summary of it.
Campaign one: production services
Who we write to: marketing and communications role-holders at organisations whose own published commercial function is marketing hospitality and destinations.
What we hold: your name, business email address, job title, employing organisation, business address and telephone number, your public professional profile URL, and notes on your organisation's published commercial activity.
Where we got it:
Your employer's own published website.
Public professional profiles that you or your organisation published.
Published trade press coverage and press releases.
Business-to-business contact data providers, specifically Apollo and Hunter.
How long: kept while the commercial interest subsists and reviewed at 24 months from the last meaningful contact; records with no engagement at that review are deleted.
What we never hold here: no special category data, no criminal offence data, no children's data, no financial or payment data, and no personal or non-work contact details. We do not enrich your record beyond your professional role.
Campaign two: websites for UK local businesses
Who we write to: owners and named contacts at small UK businesses (salons, barbers, beauty and personal training, trades, cafés, takeaways and caterers, independent fashion boutiques and clothing retailers, tutors, driving instructors, therapists, photographers, cleaners, pet services and micro-clinics) whose published web presence is missing, parked, broken, a free subdomain, or only a social or booking-tool page, or who already have a working website or online storefront that we are offering to redesign. We do not write to a business unless we have actually checked what we can find published about it and recorded what we found, including when what we found was that there was no website at all.
What we hold: your trading name, your business address including street, town and postcode, business telephone numbers, a second one where your business publishes two, business category, your Google review count and rating, the Google listing we checked, the web address that listing linked to, any web or social links your business publishes, a fingerprint of that page as it read on the day we checked, your Companies House number if the business is incorporated, your owner or director name where it is published, the email address we wrote to and any second address your business publishes, and the result of the check that confirmed that address works.
Where we got it:
Your business's own public Google listing, obtained through the Google Places API, or through the business-listings data provider DataForSEO.
Your business's own public social page, where that is the page you publish for customers to find you.
Your published website, fetched and recorded so that what we say about it is evidenced rather than asserted.
Published business pages found through the search providers Brave and Exa, and classified using Firecrawl.
The public register, for businesses that are incorporated.
How long: kept until you object, or 12 months after we last wrote to you, whichever comes first.
One thing we want to be straight about. Many small businesses publish an ordinary webmail address, a Gmail or Hotmail address, as their business contact. Where that is the address a business publishes for enquiries, that is the address we use, and we use it only in that business capacity. We know that is a less clear-cut boundary than a corporate mailbox, so this campaign is held to a stricter standard: published pricing in the first email, every factual claim about your website evidenced and in date, and an opt-out actioned the same day.
What we never hold here: no special category data, no criminal offence data, no children's data, and no financial or payment data.
How much we send
A first message and at most one follow-up. Then nothing further unless you reply. No business is contacted by both campaigns.
Suppression and bounce records are kept indefinitely, on purpose. This is the one case where deleting your data would harm you: the record of your objection is precisely what stops you being contacted again by a later campaign. We keep the minimum needed to do that and nothing more.
Who else sees your data
We do not sell, rent or trade personal data, and we never have. We do use a small number of service providers to run the business, and they process data on our instructions:
Hosting, security, server logs and the anti-spam check on the contact form.
Delivery of contact-form emails to our inbox. Operated by Plus Five Five, Inc.
Our email. Anything you send us lives in a Google-hosted mailbox.
Payments for website packages and Care plans.
Emailable
Email deliverability verification for business marketing only. They receive the email address alone, for the single purpose of confirming that the mailbox exists. Nothing else is sent to them.
Supplies the public business-listing data used by the website campaign. We send it a search, a business type and a place, and it returns published listing information.
Firecrawl
Web search and page-fetching, used to find and check a business's published web presence. What we send them is a search term or a published web address, never your contact record.
We may also disclose data to our professional advisers, or to a public authority such as HMRC, where the law requires it.
Sending data outside the UK
Some of those providers are outside the United Kingdom, so some of your data is transferred abroad. We rely on the safeguards below, which we have checked rather than assumed:
European Union, with servers in Hungary and Sweden. Covered by the UK's adequacy regulations for the EEA, so no additional safeguard is required.
Google · Stripe
Emailable
United States. Each is self-certified under the UK Extension to the EU–US Data Privacy Framework, which the UK government has approved as providing an adequate level of protection. Each also offers the EU Standard Contractual Clauses with the UK International Data Transfer Addendum as an alternative safeguard.
United States. Transfers are made under the EU Standard Contractual Clauses together with the UK Addendum, as set out in its data processing agreement.
Estonia. Covered by the UK's adequacy regulations for the EEA, so no additional safeguard is required.
Firecrawl
United States. As above, what reaches them is a search term or a published web address rather than your contact record.
Your rights
Under UK GDPR you have the following rights. To use any of them, email hq@loveyoursmedia.com. We reply within one calendar month, and it is free.
This one is absolute. Under Article 21(2) you can object to direct marketing at any time, and there is no balancing test, no exception and nothing for us to weigh against it. One reply and we stop, permanently. This is the right almost everyone reading this page wants.
Ask what personal data we hold about you and get a copy of it.
Have anything inaccurate corrected, and anything incomplete completed.
Ask us to delete your data. Note the one deliberate exception: if you have objected to marketing, we keep the minimum suppression record needed to make sure you are never contacted again.
Ask us to pause what we do with your data while a question about it is resolved.
Object to any processing we carry out under legitimate interests, not only marketing. We then stop unless we can show compelling legitimate grounds that override your interests.
This right applies only where processing is based on your consent or on a contract and carried out by automated means. It therefore covers data you gave us in a contractual relationship, but it does not apply to our business marketing data, which we process under legitimate interests. We would rather tell you that plainly than list a right you cannot actually use here.
Automated decisions and profiling. We do not carry out automated decision-making or profiling that produces legal or similarly significant effects, within the meaning of Article 22. No algorithm decides anything about you here.
Complaining
If you are unhappy with how we have handled your data, please tell us first, hq@loveyoursmedia.com, because we can usually fix it faster than anyone else can.
You also have the right to complain to the Information Commissioner's Office at any time, and you do not have to come to us first. The ICO is at ico.org.uk, or on 0303 123 1113.
Changes to this notice
This is version 1.0, published 27 August 2026. If we change how we use personal data, we update this page and change the date and version at the top. Where a change is significant, and we have a way of reaching you, we will tell you directly rather than relying on you to re-read this page.