Legate Local's Privacy Policy

Privacy Notice: Legate Local
Last updated: 20 October 2026

Who we are

Legate Local is the trading name of Harrison Leggett, a sole trader registered with HMRC, of SIU Offices, 4–6 Greatorex Street, London, E1 5NF, United Kingdom.
Registered with the Information Commissioner’s Office (ICO), registration reference: C2024465.
Contact: [email protected]

This notice applies differently depending on who you are

You’ve received an automated text message

You’ll normally get an automated text from us because a business you’ve used has confirmed your job as complete. In a small number of cases, a business may instead supply you as part of a one-off list of past customers, but only where they’ve confirmed to us that you were already given the chance to opt out of this kind of message when they first took your details. This is the exception, not the norm. In either case, that business is a client of Legate Local. The business you’re dealing with, not Legate Local, is responsible for your personal data. We act only as their data processor: we handle the technical delivery of the service strictly on their instructions, and we don’t make our own decisions about what happens to your data.

What we collect when this happens:

Your mobile number

Your name, where the business has given it to us to personalise the message
Your email address, where the business has given it to us and we’re messaging you by email
The date the business confirmed your job as complete (or, in the rare one-off case above, that you were a past customer of theirs)
The date and time of the message, and whether you’ve opted out

What we do with it:

We send you one automated message, a review request, by text and/or email, in the business’s name.
We send this message in reliance on the PECR “soft opt-in” exemption described above. We don’t use your details for any other marketing, and we never sell or share them beyond what’s needed to deliver the service.
Reply STOP to a text, or use the unsubscribe link in an email, and you will never receive another automated message from us on any channel, permanently.

The business is responsible for offering you the chance to opt out of this at the point they first took your contact details, as well as in the message itself. Because the business you contacted is the controller of your data, they’re the right first point of contact if you want to exercise your data protection rights (see below). If you’re not sure how to reach them, you can email us at [email protected] and we’ll help direct your request.

You’re a business enquiring about, or using, our service

If you’ve contacted us directly, or you’re a client using the service, Legate Local is the controller of your own business’s information: your name, business name, contact details, and billing information, which we use to run our agreement with you. The job-completion information (or, in the rare cases described above, a backlog customer list) you send us to trigger review-request messages is your customers’ data, which we process on your instructions as your data processor, not as its controller (see the Data Processing Schedule). Where you take up the Service as a paying client, your billing and payment information is also shared with Stripe, our payment processor, to collect subscription fees; see Who we share data with, below.

We use this to respond to your enquiry, deliver and manage the service under our agreement with you, and meet our own legal and accounting obligations.

What we collect and why

Purpose: Requesting a review after a job the client has confirmed complete
Data: Mobile number, email address (where used), job-completion date, name (where provided), reply content
Lawful basis: Soft opt-in (PECR permission); legitimate interests (UK GDPR basis, LIA to be completed)

Purpose: Sending a one-off backlog review request (rare exception only, see clause 5 of the Agreement)
Data: Mobile number, name (where provided)
Lawful basis: Soft opt-in (PECR), client-confirmed

Purpose: Honouring an opt-out
Data: Mobile number
Lawful basis: Legal obligation (PECR)

Purpose: Running client agreements, invoicing, enquiries
Data: Name, business name, contact details
Lawful basis: Legitimate interests / performance of contract

Purpose: Collecting payment for the Service
Data: Name, business name, billing/contact details, payment information
Lawful basis: Performance of contract

Who we share data with

We use two service providers to help deliver the service. We don’t sell personal data to anyone.
GoHighLevel: sends the review-request text, and stores the job-completion records and suppression (opt-out) list securely.
Stripe: processes subscription payments from client businesses using the Service, and holds the billing and payment information needed to do so. We don’t store your card details ourselves.

International transfers

GoHighLevel may process data outside the UK. Where that happens, we make sure an appropriate legal safeguard is in place first (such as the UK International Data Transfer Addendum or Standard Contractual Clauses within our agreement with them). Stripe may also process data outside the UK; the same safeguard requirement applies to our agreement with them.

How long we keep data

Job-completion and message-send records: for the length of our agreement with the relevant business, plus 90 days afterwards, then deleted.
Backlog list records (rare exception only): only as needed to complete the one-off send, then deleted, save for any resulting opt-out records.
Opt-out (STOP) records: kept separately for each business we work with, for the length of our agreement with them and for 12 months afterwards, so a number that has opted out is not texted again on that business’s behalf, then reviewed and deleted unless there’s a continuing reason to keep it. We don’t apply one business’s opt-out to any other business we work with.

Your rights

Under UK GDPR you have the right to:
Ask what personal data we hold about you and get a copy (access)
Ask us to correct inaccurate data (rectification)
Ask us to delete your data, where applicable (erasure)
Object to or restrict certain processing
Ask for your data in a portable format, where applicable
Complain to the ICO if you’re unhappy with how your data has been handled

If your query relates to a specific job or review request, the fastest route is usually the business you originally contacted, since they hold the full picture. For anything else, email [email protected].

Cookies

legatelocal.co.uk does not use analytics or advertising cookies, and does not track visitors for marketing purposes. It uses only what is strictly necessary for the site to function: a bot-protection check (Cloudflare Turnstile) on our enquiry and booking forms, and session identifiers set by our page-building platform (GoHighLevel) so those forms work correctly. The site also loads Google Fonts to display text, which involves a request to Google’s servers but sets no tracking cookie. If we add analytics or advertising tracking in future, this section will be updated before that goes live.

Complaints

You have the right to complain to the UK’s data protection regulator:
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF · ico.org.uk · 0303 123 1113

Changes to this notice
We may update this notice from time to time. The date at the top shows when it was last revised.