Privacy Policy
Last updated: 14 August 2026
This Privacy Policy explains how Karl Middleton, trading as Chadfield Marketing (“we”, “us”, “our”), collects, uses, stores and protects personal information when you visit our website, contact us, use our services, or when we provide our Spotlight reputation marketing and social media services to business clients.
We are committed to handling personal information responsibly and in accordance with applicable UK data protection law, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Chadfield Marketing is registered with the Information Commissioner’s Office (ICO), registration reference ZA346468.
1. Who we are
Chadfield Marketing is a trading name of Karl Middleton, a sole trader based in the UK.
Karl Middleton, trading as Chadfield Marketing
4 Granville Road
Felixstowe
IP11 2AT
United Kingdom
Email: admin@chadfieldmarketing.co.uk
Website: chadfieldmarketing.co.uk
ICO registration: ZA346468
For the purposes of UK data protection law, the organisation responsible for the personal information described in this Privacy Policy will depend on the circumstances in which we process it. Where we process information on behalf of a business client as part of providing a service, that client may be the data controller and Chadfield Marketing may act as a data processor or service provider on the client’s instructions.
2. Information we may collect
The information we collect depends on how you interact with us.
This may include:
- Your name
- Business name
- Job title or role
- Email address
- Telephone number
- Business address
- Information you provide when contacting us
- Information relating to services you purchase or enquire about
- Information contained in correspondence between you and Chadfield Marketing
- Website usage information and technical information where this is collected through cookies or similar technologies
- Information relating to your Google Business Profile or social media accounts where you authorise us to provide relevant services
- Publicly available Google review information used as part of our Spotlight service
We only seek to collect information that is reasonably necessary for the purposes for which we use it.
3. Information provided through our website
If you contact us through our website, by email, telephone or another method, we may use the information you provide to:
- Respond to your enquiry
- Discuss your requirements
- Provide quotations or proposals
- Arrange meetings
- Provide services
- Manage our relationship with you
- Send service-related communications
- Maintain appropriate business and financial records
We do not sell your personal information to third parties.
4. Spotlight — reputation marketing service
Spotlight is a service provided by Chadfield Marketing that helps businesses make more use of their existing customer reviews.
Depending on the version of Spotlight being provided, the service may involve creating images, videos and suggested social media wording from positive customer reviews, and may involve publishing that content to social media accounts authorised by the business client.
The exact functionality available to a client will depend on the service they have purchased and the integrations that have been enabled.
5. Google review information
Where a client uses Spotlight, we may process information contained in reviews that are publicly available on the client’s Google Business Profile.
This may include:
- The review text
- The reviewer’s displayed name
- The star rating
- The date of the review
- A publicly displayed reviewer profile image, where applicable
- The name or details of the business to which the review relates
This information is already publicly displayed by Google as part of the reviewer’s interaction with the relevant business.
We may use appropriate review information to create marketing content for the business, such as:
- Review graphics
- Images
- Short-form videos
- Social media posts
- Suggested social media captions
We do not use review information to create unrelated marketing databases or to sell information about reviewers.
Where a reviewer’s information is reproduced in marketing content, it is used in connection with the business and the review that the reviewer has publicly posted.
6. If you are a person who has left a Google review
If you have left a review for a business that uses Spotlight, the business may choose to use that review as part of its marketing.
If your review is featured in a Spotlight-created image, video or social media post and you would like it removed, you can contact the relevant business or Chadfield Marketing.
Where appropriate, we will remove the relevant content from our systems and/or ask the relevant business to remove or stop using the content.
Removing a Spotlight-created post does not necessarily remove the original review from Google. Requests concerning the original Google review should also be directed to Google or the business concerned, as appropriate.
7. Facebook and Instagram connections
Where a client authorises Spotlight to connect with its Facebook Page or Instagram professional account, we may process information required to establish and maintain that connection.
This may include:
- Facebook Page identifiers and names
- Instagram account identifiers and names
- Account information necessary to identify the authorised account
- Access tokens or similar authentication information issued by Meta
- Information required to publish authorised content
Access to these accounts is provided only after the client has authorised the relevant connection.
We use this access to provide the services requested by the client, such as publishing approved or authorised review-based content.
We do not intentionally access or collect personal information belonging to the followers or audiences of the Facebook Pages or Instagram accounts we manage.
We do not use these connections to send private messages to followers unless a separate service specifically agreed with the client requires this.
8. Other social media and publishing platforms
Spotlight may be extended over time to support additional platforms and publishing services.
These may include platforms such as X and Google Business Profile.
Where new integrations are introduced, they will only be used where:
- The relevant service has been enabled for the client
- The client has provided the appropriate authorisation
- The information is processed for the purposes of providing the agreed service
This Privacy Policy may be updated when significant new integrations or functionality are introduced.
9. Review monitoring and AI-assisted responses
We are developing additional Spotlight functionality that may allow us to monitor new Google reviews for participating businesses.
Where this functionality is enabled, new reviews may be analysed to help:
- Identify new reviews
- Identify positive reviews that may be suitable for marketing content
- Prepare suggested responses
- Identify reviews that may require personal or human attention
Artificial intelligence may be used to assist with these processes.
AI-generated content is intended to assist with the service and does not mean that every decision is made automatically.
Where appropriate, reviews may be flagged for human attention, particularly where a review appears sensitive, negative, ambiguous, contains a complaint, or otherwise requires a response that should be considered by the business.
Any automated or AI-assisted functionality will only be used where it forms part of the service agreed with the client.
10. Artificial intelligence and third-party services
Some Spotlight functionality may use artificial intelligence or other third-party technology to help analyse information, create text, generate images or videos, or perform other functions necessary to provide the service.
Where third-party services are used, we take reasonable steps to select appropriate providers and to ensure that information is handled in accordance with applicable data protection requirements.
The information sent to an AI or other third-party service will depend on the particular function being performed.
We do not intentionally submit unnecessary personal information to AI services.
Where a third-party provider processes personal information on our behalf, appropriate contractual and data protection arrangements will be considered and used where required.
11. How we use information
Depending on the circumstances, we may use personal information to:
- Provide services to clients
- Create review-based marketing content
- Publish authorised content to social media accounts
- Monitor reviews where this service has been enabled
- Prepare suggested responses to reviews
- Identify reviews requiring human attention
- Maintain and troubleshoot integrations
- Communicate with clients
- Provide customer support
- Arrange meetings and quotations
- Manage billing and invoicing
- Maintain business and financial records
- Improve our services
- Protect our systems and services
- Comply with legal and regulatory obligations
We will not use personal information for purposes that are incompatible with the purposes described in this Privacy Policy without considering whether additional information or consent is required.
12. Our legal basis for processing personal information
The legal basis we rely upon depends on the type of information and the reason for processing it.
These may include:
Contract
Where processing is necessary to provide a service that a client has requested or to take steps at the client’s request before entering into a contract.
Legitimate interests
Where processing is reasonably necessary for our legitimate business interests, such as operating our business, providing and improving our services, communicating with clients and maintaining appropriate business records, provided that those interests are not overridden by an individual’s rights and interests.
Legal obligation
Where we need to process information to comply with a legal or regulatory requirement.
Consent
Where consent is required and we have asked for it.
Where processing is carried out by Chadfield Marketing on behalf of a business client, the client’s role as data controller and Chadfield Marketing’s role as data processor/service provider will be determined according to the particular service and processing involved.
13. Who we share information with
We may share information with third parties where this is necessary to provide our services, operate our business or comply with legal requirements.
These may include:
- Hosting and website service providers
- Email and communication providers
- Accounting and invoicing providers
- Cloud storage or business software providers
- Social media platforms, including Meta, where authorised
- Google services where required to provide Spotlight or related services
- AI or content-generation service providers where required for an agreed service
- Technical service providers supporting our systems
- Professional advisers
- Government, regulatory or law-enforcement bodies where legally required
We do not sell personal information.
We do not share client account information with unrelated third parties for their own marketing purposes.
14. International transfers
Some of the technology providers and platforms used by Chadfield Marketing may process information outside the United Kingdom.
Where personal information is transferred outside the UK, we will take appropriate steps to ensure that the transfer is lawful and that appropriate safeguards are in place where required by UK data protection law.
These safeguards may include adequacy regulations, international data transfer agreements, the UK International Data Transfer Agreement, the UK Addendum to EU Standard Contractual Clauses, or other legally recognised mechanisms, as appropriate.
15. How long we keep information
We keep personal information only for as long as it is reasonably necessary for the purpose for which it was collected, unless we are required to keep it for longer by law.
For example:
- Client contact and business records may be retained for as long as necessary to manage the client relationship.
- Financial and accounting records may need to be retained for the periods required by UK law.
- Spotlight account connection information and access tokens will be retained only for as long as necessary to provide the relevant service.
- Where a client ends a Spotlight connection, we will take reasonable steps to remove or revoke access that is no longer required.
- Review-based content and service records may be retained for a reasonable period for service administration, reporting, accounting, dispute resolution and legal purposes.
We periodically review the information we hold and seek to delete or anonymise information that is no longer required.
16. Data deletion
Clients may request deletion of personal information that Chadfield Marketing holds in connection with their Spotlight account, subject to information that we are legally required or otherwise entitled to retain.
A client can make a deletion request by emailing:
admin@chadfieldmarketing.co.uk
Please use the subject line:
Data Deletion Request
Where appropriate, please identify the business, Facebook Page, Instagram account or other service connection concerned.
We will acknowledge the request and take reasonable steps to delete the relevant information within 30 days, subject to any information that we are required to retain for legal, accounting, security or other legitimate purposes.
Where access to a third-party platform has been authorised by the client, the client may also be able to revoke that access directly through the relevant platform.
17. Security
We take reasonable technical and organisational measures to protect personal information against unauthorised access, loss, misuse, alteration or disclosure.
These measures may include:
- Restricted access to systems and information
- Appropriate authentication and access controls
- Secure storage of credentials and access tokens
- Use of reputable third-party service providers
- Regular review of access where appropriate
No internet-based system can be guaranteed to be completely secure, but we take reasonable steps to protect the information entrusted to us.
18. Cookies
Our website is built using WordPress and may use cookies or similar technologies.
Some cookies are necessary for the website to function correctly. Other cookies may be used by WordPress, plugins, embedded content, analytics services or other third-party technologies, depending on the configuration of the website.
Where applicable, cookies may be used to:
- Maintain website functionality
- Remember preferences
- Support website security
- Understand how visitors use the website
- Improve website performance
The exact cookies used by the website may change as we add, remove or update plugins and services.
Where consent is legally required for particular cookies or similar technologies, we will seek that consent in accordance with applicable requirements.
19. Comments and user-generated content
If commenting functionality is enabled on our website, information submitted through comments may include the information entered into the comment form, together with technical information such as IP address and browser user-agent information where required for security and spam prevention.
An anonymised version of an email address may also be provided to the Gravatar service where WordPress comment functionality uses that service.
Approved comments may be publicly visible.
We may retain comments and associated information for as long as reasonably necessary for website administration, security and moderation.
20. Media uploads
If you upload images or other media to the website, you should avoid uploading files containing unnecessary embedded location information, such as GPS information in image metadata.
Visitors may potentially be able to download published media and inspect information contained within the file.
21. Embedded content from other websites
Pages on our website may contain embedded content, such as videos, images, maps, social media posts or other material provided by third parties.
Embedded content may behave in the same way as if you had visited the third-party website directly.
Those third parties may collect information, use cookies or similar technologies, and monitor interaction with their content according to their own privacy policies.
Examples may include social media platforms, video services and other online providers.
22. Your data protection rights
Depending on the circumstances, UK data protection law gives individuals a number of rights in relation to their personal information.
These may include the right to:
- Request access to personal information we hold about you
- Ask us to correct inaccurate or incomplete information
- Request deletion of personal information where applicable
- Request restriction of processing in certain circumstances
- Object to certain processing
- Request data portability where applicable
- Withdraw consent where processing is based on consent
These rights are subject to certain legal exceptions and may not apply in every situation.
If you are an employee, customer, follower or reviewer of a business that uses Chadfield Marketing’s services, that business may be the data controller for information relating to you.
Where your request relates to information held or processed by that business, you may need to contact the business directly.
If your request relates specifically to processing carried out by Chadfield Marketing, you can contact us using the details below.
23. Children’s privacy
Our services are intended primarily for businesses and adults.
We do not knowingly seek to collect personal information from children through our services.
If you believe that a child has provided personal information to us, please contact us so that we can investigate and take appropriate action.
24. Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect:
- Changes to our services
- New Spotlight functionality
- New third-party integrations
- Changes to the way we process information
- Changes in applicable law or regulatory guidance
The “Last updated” date at the top of this page will indicate when the policy was most recently revised.
Where appropriate, significant changes may be brought to the attention of affected clients.
25. Complaints
If you have concerns about the way we have handled your personal information, please contact us first.
We will try to resolve your concern promptly.
You also have the right to complain to the UK’s data protection regulator:
Information Commissioner’s Office (ICO)
The ICO provides information about data protection rights and how to make a complaint.
26. Contact us
If you have questions about this Privacy Policy, our use of personal information, Spotlight, or wish to exercise a data protection right, please contact:
Karl Middleton, trading as Chadfield Marketing
4 Granville Road
Felixstowe
IP11 2AT
United Kingdom
Email: admin@chadfieldmarketing.co.uk
Telephone: 07940 852 840
Spotlight and your privacy
Spotlight is designed to make better use of the positive customer feedback that businesses have already received.
We believe technology should make marketing easier without taking control away from the business.
Where Spotlight uses automation or AI, we aim to use it to reduce repetitive work while keeping appropriate human oversight — particularly where a review may require a personal or sensitive response.
If you have any questions about how Spotlight uses information, please contact us.