Privacy Policy
Last reviewed: October 2026
1. Who we are
Emailium Ltd, a company registered in England and Wales under company number 00000000, with its registered office in London, United Kingdom (“Emailium,” “we,” “us”), is the data controller for personal data collected through theemailium.com and for our own marketing. Where we access a client’s Klaviyo account to produce an audit or deliver services, we act as a data processor (a service provider under US state privacy laws) on that client’s behalf, and the Audit Access and Data Handling Policy and our client agreement govern that processing.
Contact for privacy matters: support@theemailium.com.
2. What we collect and why
| What we collect | When | Why | Lawful basis (UK GDPR Art. 6) |
|---|---|---|---|
| Name, work email, store URL, role, revenue band, list-size band, email platform | You submit the Health Score form | To produce the report you asked for, route it correctly, and follow up once | Performance of a contract or steps before one (6(1)(b)) |
| Name, email, company, and anything you write | You contact us by email, form, or LinkedIn | To respond to you | Legitimate interests (6(1)(f)): answering inquiries |
| Name, email | You subscribe to the Retention Memo | To send it to you | Consent (6(1)(a)); withdraw any time via the unsubscribe link |
| Calendly booking details: name, email, chosen time, notes | You book a call | To hold the call | Performance of a contract or steps before one (6(1)(b)) |
| Screenshots you upload from your email platform | You choose the Snapshot screenshot option | To produce the Snapshot | Performance of a contract or steps before one (6(1)(b)) |
| Device, browser, pages visited, referrer, approximate location | You browse the site | To understand how the site is used and fix problems | Consent for non-essential cookies (PECR Reg. 6); legitimate interests for essential ones |
We do not collect special category data, and we ask you not to send any. We do not knowingly collect data from anyone under 18.
3. Client Klaviyo accounts
When a brand invites support@theemailium.com into its Klaviyo account, we can see that brand’s customer data. We process it only to produce the audit or deliver the agreed services, under the brand’s instructions, and we do not use it for our own purposes. We do not export customer lists, sell data, or combine one brand’s data with another’s. Access ends as set out in the Audit Access and Data Handling Policy. If you are a customer of one of our clients and have a question about your data, please contact that brand; we will help them answer you.
4. Who we share data with
We share personal data only with the service providers we need to run the business, each under a contract that limits what they may do with it:
| Provider | Purpose | Location |
|---|---|---|
| Hostinger | Website hosting | Provider’s data center; details on request |
| Klaviyo | Our own email sending and the Retention Memo | United States |
| Calendly | Call scheduling | United States |
| n8n | Form routing and notifications | Details on request |
| Google Workspace | Email and document storage | Details on request |
| Google Analytics 4, Microsoft Clarity | Site analytics, only with your cookie consent | United States |
| Accounting and payment provider | Invoicing clients | Details on request |
We may also disclose data where the law requires it, or to professional advisers under confidentiality.
5. International transfers
Some providers above are in the United States. Where data leaves the UK we rely on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, or on the provider’s certification under the UK Extension to the EU-US Data Privacy Framework where applicable. Copies are available on request.
6. How long we keep data
| Data | Retention |
|---|---|
| Health Score form entries and reports | 24 months from the report date, then deleted unless you become a client |
| Uploaded screenshots | Deleted within 30 days of the Snapshot being sent |
| Inquiry emails | 24 months from last contact |
| Retention Memo subscribers | Until you unsubscribe, plus a suppression record so we do not email you again |
| Client contract and invoicing records | 6 years after the contract ends, for tax and legal obligations |
| Analytics data | As set in the provider’s retention control; details on request |
7. Your rights
Under UK GDPR you can ask us to: access the personal data we hold about you; correct it; delete it; restrict or object to how we use it; receive it in a portable format; and withdraw consent where consent is the basis. Email support@theemailium.com and we will respond within one month. You can also complain to the Information Commissioner’s Office at ico.org.uk, though we would welcome the chance to resolve it first.
If you are in the EU or EEA, the same rights apply under the EU GDPR, and you may complain to your local supervisory authority.
8. Visitors and clients in the United States
We work with brands in the United States as well as the UK. This section applies if you live in a US state with a consumer privacy law, including California under the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA), and states with comparable laws such as Virginia, Colorado, Connecticut, Texas, and Oregon.
What we collect. In the last 12 months we have collected identifiers (name, work email), professional and commercial information (store URL, role, revenue and list-size bands, email platform), and, only with your cookie consent, internet activity on this site. Section 2 sets out the sources and purposes, section 4 who receives it, and section 6 how long we keep it.
No sale, sharing, or targeted advertising. We do not sell personal information, share it for cross-context behavioral advertising, use it for targeted advertising, or use it for profiling that produces legal or similarly significant effects. We do not collect sensitive personal information. If your browser sends a Global Privacy Control signal, we treat it as a request to opt out.
Your rights. Depending on your state, you can ask to know and access the personal information we hold about you, correct it, delete it, and receive it in a portable format. Email support@theemailium.com. We verify requests by matching them to the email address we hold, accept requests from an authorized agent with your signed permission, and respond within 45 days. We will not treat you differently for using any of these rights.
Appeals. If we decline a request, you can appeal by replying with the word Appeal. We will respond within 45 days and explain our decision. If you are not satisfied, you can contact your state attorney general.
Client account data. When a US brand gives us access to its Klaviyo account, we act as that brand’s service provider or processor, as set out in the Audit Access and Data Handling Policy. If you are a customer of that brand, please send your request to the brand; we will help it respond.
9. Cookies
Essential cookies run the site and need no consent. Analytics cookies (Google Analytics 4, Microsoft Clarity) and any embedded third-party content (Calendly) are set only after you accept them in the cookie banner. You can change your choice at any time via the cookie settings link in the footer. A full list of cookie names and durations will be published here once analytics tools are installed.
10. Security
We use two-factor authentication on every system that holds personal data, limit access to the people who need it, and keep client account access to the role level required for the task. No system is perfectly secure; if a breach affects your rights, we will tell you, and the ICO or the relevant US state authorities, as the law requires.
11. Changes to this policy
We update this page when our practices change and update the “Last reviewed” date at the top. Material changes to how we use data already collected will be notified by email where we have your address.
