Privacy Policy

1. Who we are

GroundWork OS is run by Sebastian Otto Wibaut, trading as GroundWork OS, a sole trader based in the United Kingdom. For the purposes of UK data protection law (the UK GDPR and the Data Protection Act 2018), we are the controller of the personal information described in this policy.

You can reach us about anything in this policy at [email protected]. A postal address is available on request.

2. The information we collect

• When you enquire. If you fill in a form on this site we collect your name, phone number, the subject you pick, your message, and whether you ticked the box agreeing to receive texts.
• When you book a call. Our scheduling system collects your name, email address, phone number and the appointment time you choose.
• When you use our Meta ads funnel. We collect your name, company name, phone number, email address, trade, the timescale in which you want more work, and the turnover and marketing-spend bands you select. If you request a free business analysis, we also collect the business name, postcode and Google Business Profile listing you choose.
• When you become a client. We hold your business details, billing information (payments are processed by Stripe, we never see your full card number), the content you give us to build your website, and records of the messages, calls and reviews that run through your system.
• Businesses we contact. If we get in touch with your business first, we collected publicly available business information (business name, contact name, phone number, email address, and whether you have a website) from public sources such as Google Maps and Google Business Profiles, Companies House, and your own website or listings.
• Technical and usage information. This can include your IP address, approximate location, browser and device type, referring page, pages viewed, and how you interact with the site, such as clicks, scrolling and form-step progress. Where you consent, it can also include pseudonymous identifiers stored by Microsoft Clarity and Meta cookies. See section 7. Our pages also load fonts from Google, which means your IP address is sent to Google to deliver the font files.

3. How we use it, and our lawful grounds

• Answering your enquiry and running your demo call. Lawful ground: our legitimate interest in responding to people who contact us, and taking steps you ask for before entering a contract.
• Sending you texts you have agreed to. If you tick the consent box we may text you in reply to your enquiry and with service updates. Lawful ground: consent. Reply STOP at any time and the texts stop.
• Delivering the service and billing you. Lawful ground: performing our contract with you.
• Keeping accounting and tax records. Lawful ground: legal obligation.
• Contacting businesses we think the service could genuinely help. Lawful ground: our legitimate interest in offering a relevant business service to businesses. We only use publicly available business contact details, we tell you who we are, and we stop the moment you ask us to.
• Running and improving this website and our service. Lawful ground: our legitimate interests.
• Understanding and improving the Meta ads funnel. With your consent, Microsoft Clarity helps us understand page use through aggregated analytics, heatmaps and session recordings. Where Clarity operates without cookies after you decline consent, it uses a new identifier for each page view rather than recognising you across pages or visits. Lawful grounds: consent for non-essential cookies and our legitimate interest in limited, cookieless measurement.
• Measuring our advertising. With your consent, the Meta Pixel helps us attribute page visits and enquiries to Facebook and Instagram ads, measure campaign results, and improve which ads we show. Lawful ground: consent.

4. Who we share it with

We never sell your information. We share it only with the providers we need to run the service, under contracts that require them to protect it:

• HighLevel Inc. (the platform our system runs on): hosts our websites, forms, contact records, calendars and messaging. HighLevel is a US company, see section 5.
• Stripe: processes payments. We do not store your card details.
• Google: delivers the fonts on this site, and we use Google Calendar and Google Meet to run booked calls.
• Microsoft Clarity: provides funnel analytics, heatmaps and session recordings. Microsoft may receive technical and interaction information and pseudonymous cookie identifiers. Sensitive form content is masked from recordings.
• Meta Platforms: provides the Meta Pixel for advertising measurement and conversion attribution. Meta may receive device and browser information, page URLs, ad-click information and pseudonymous cookie identifiers.
• Professional advisers (such as an accountant) where we are required to keep or share records.

5. International transfers

Some of our providers, including HighLevel, Microsoft and Meta, may store or process information outside the United Kingdom, including in the European Economic Area and the United States. Where UK law requires a transfer safeguard, the provider uses a recognised mechanism, such as the UK Extension to the EU-US Data Privacy Framework where applicable, the UK's International Data Transfer Agreement, or the UK Addendum to approved standard contractual clauses.

6. How long we keep it

• Enquiries that go nowhere: up to 2 years, then deleted.
• Client records: for the length of our relationship, then up to 6 years afterwards for tax and legal purposes.
• Outreach details: deleted if you ask us to stop or nothing comes of the contact, except a minimal record kept so we do not contact you again.
• Cookie choices: normally remembered for 180 days.
• Clarity session recordings: normally available to us for up to 30 days.
• Advertising and analytics cookies: retained for the duration shown in section 7, unless you delete them sooner.

7. Cookies

We use essential cookies to make the site and its cookie controls work. On our Meta ads funnel, we also ask permission to use analytics and advertising cookies. Non-essential cookies are denied unless you choose Accept all.

• Essential: cookie-config and cookie-categories remember your cookie choice for up to 180 days.
• Analytics: Microsoft Clarity uses _clck for up to one year and _clsk for up to one day to recognise pseudonymous visits and connect page views into a session. Microsoft may also set third-party cookies including CLID, ANONCHK, MR, MUID and SM. Clarity helps us create aggregated reports, heatmaps and session recordings.
• Advertising: the Meta Pixel can use _fbp and _fbc for up to 90 days to measure visits and enquiries from Facebook and Instagram ads. _fbc is normally created only after a Meta ad click.

You can choose Essential only or Accept all when the banner appears. You can withdraw consent by deleting this site's cookies in your browser; the banner will ask again on your next visit to the funnel. You can also block or delete cookies through your browser settings, although parts of the site may then work differently.

8. Your rights

Under UK data protection law you can ask us to:

• give you a copy of the information we hold about you,
• correct it if it is wrong,
• delete it,
• limit what we do with it,
• stop using it, including an absolute right to stop direct marketing, or
• hand it over in a portable format.

Email [email protected] and we will respond within one month. We may need to confirm you are who you say you are first.

If you are unhappy with how we have handled your information, tell us and we will do our best to put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

9. Changes to this policy

If we change how we handle your information we will update this page and change the date at the top. This policy was last updated on 24 August 2026.