Privacy Policy

1. Who we are

Nimrod Digital Marketing is a trading brand of Makola Online Ltd, a company registered in England and Wales under company number 15147416. Our registered office is 128 City Road, London, United Kingdom, EC1V 2NX.

For the personal information described in this policy, Makola Online Ltd is normally the “controller”. This means we decide why and how that information is used.

Privacy enquiries can be sent to [email protected] .

2. Scope and our different data roles

This policy applies when you visit our website, contact us, book a meeting or Growth Review, subscribe to communications, use a Nimrod service, work with us as a supplier or otherwise interact with us.

When Nimrod is a controller

We act as controller for our own prospects, clients, website visitors, suppliers and business contacts.

When Nimrod is a processor

Some Nimrod services involve handling personal information on behalf of a client—for example, configuring a client CRM, importing contact records, creating follow-up automations or supporting customer communications. In that situation the client normally remains the controller and Nimrod acts as its processor under the client agreement and data-processing terms. Requests concerning that data should usually be directed to the relevant client organisation first.

3. Information we collect

Depending on how you interact with us, we may collect:

• Identity and contact information, such as your name, organisation, job title, email address, telephone number and business address.
• Enquiry and relationship information, including your objectives, requirements, meeting notes, correspondence, proposals, agreed actions and service history.
• Commercial and transaction information, such as services purchased, invoices, payment status and limited billing information. Payment-card details are normally handled directly by the relevant payment provider.
• Account and system information, including login identifiers, permissions, support requests and audit records where we provide access to a platform or client portal.
• Technical and usage information, such as IP address, device and browser type, approximate location, pages visited, referral source, interaction data and cookie or consent choices.
• Marketing preferences, including whether you wish to receive communications and how you interact with them.
• Content you provide, including files, form entries, testimonials, reviews, event information, images or other materials supplied for a project.
• Call, meeting and message information. If we record a call or online meeting, we will provide an appropriate notice where required.

4. Where information comes from

We receive information directly from you when you complete a form, book a meeting, communicate with us, enter a contract or use a service. We may also receive information from:

• your organisation, colleagues or authorised representatives;
• referral partners and people who introduce you to us;
• public sources such as company websites, Companies House, professional networks and social-media profiles;
• analytics, advertising, communication and CRM providers, subject to your choices and applicable law; and
• clients for whom we provide services as a processor.

5. How and why we use information

Where we rely on legitimate interests, we consider whether our use is necessary and balanced against your rights and reasonable expectations. You may ask for more information about this assessment.

6. Marketing communications

We may send relevant business-to-business communications where the law permits and our legitimate interests are not overridden by your rights. Where consent is required—for example, for certain communications to individual subscribers—we will request it.

You can unsubscribe using the link in a marketing email or by contacting us. We may retain a minimal suppression record so that we can respect your choice. Service messages, such as information necessary to perform a contract or maintain an account, are not marketing messages.

7. Cookies and similar technologies

Our website may use cookies, tags, pixels, local storage and similar technologies. Strictly necessary technologies support security and functions you request. Non-essential technologies are used only in accordance with applicable consent requirements. Please see our Cookie Policy and use the “Cookie settings” control in the footer to review or change available choices.

8. Who we share information with

We share information only where reasonably necessary and subject to appropriate safeguards. Recipients may include:

• website hosting, CRM, automation, client-portal and technology providers;
• email, telephone, SMS, messaging, scheduling and video-meeting providers;
• analytics, consent-management and advertising providers, where enabled;
• payment processors, banks, accountants, insurers and professional advisers;
• carefully selected contractors or delivery partners supporting an agreed service;
• a purchaser, investor or successor in connection with a genuine business transaction; and
• regulators, courts, law-enforcement bodies or other parties where disclosure is required or permitted by law.

Our principal CRM and automation environment is supplied using GoHighLevel/LeadConnector technology. Other suppliers used for a particular client project may be identified in the relevant agreement or data-processing documentation.

We do not sell personal information.

9. International transfers

Some suppliers or their support teams may process information outside the United Kingdom. Where personal information is transferred internationally, we use an applicable legal mechanism, such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, or another lawful safeguard. You may contact us for further information about the safeguards relevant to your information.

10. How long we keep information

We keep personal information only for as long as reasonably necessary for the purpose collected, including legal, accounting, security and dispute-resolution requirements. Typical periods are:

• unconverted enquiries and related communications: normally up to 24 months after the last meaningful interaction;
• client contracts, invoices and core transaction records: normally six years after the end of the relevant financial year or relationship, where required for legal and tax purposes;
• project files and service records: for the contract period and an appropriate period afterwards, normally up to six years unless the agreement or risk requires otherwise;
• marketing records: until you opt out, the purpose ends, or continued use is no longer justified, with a limited suppression record retained afterwards;
• technical and analytics information: according to the relevant tool configuration and Cookie Policy; and
• client-controlled data processed on a client’s behalf: according to the client’s instructions and our agreement with that client.

We may retain information for longer if required by law, a regulatory obligation, an active dispute, fraud prevention or a legal claim.

11. Your data-protection rights

Depending on the circumstances, you may have the right to:

• request access to personal information we hold about you;
• ask us to correct inaccurate or incomplete information;
• ask us to erase information in certain circumstances;
• ask us to restrict how information is used;
• receive certain information in a portable format;
• object to processing based on legitimate interests; and
• withdraw consent at any time, without affecting earlier lawful processing.

These rights are not all absolute. We may need to verify your identity and may retain information where the law permits or requires it. We normally respond within one month, although the law allows an extension for complex or multiple requests.

12. Automated decision-making

We do not currently use solely automated decision-making that produces legal or similarly significant effects on website visitors or our own prospects and clients. We may use automation to route enquiries, schedule communications, assign tasks or personalise follow-up, but material business decisions involve appropriate human oversight.

13. Security

We use proportionate technical and organisational measures designed to protect personal information against unauthorised access, alteration, loss or disclosure. Measures may include access controls, role-based permissions, multi-factor authentication, encryption provided by our platforms, backups, supplier review and staff or contractor confidentiality obligations.

No internet service is completely secure. Please use appropriate care when sending information and notify us promptly if you believe an account or communication has been compromised.

14. Children’s information

Our own website and commercial services are directed to organisations and adults, not children. We do not knowingly collect children’s personal information through this website. When we process information for a church or other client that serves children, we do so under that client’s instructions and agreed safeguards.

15. External websites and platforms

Our website may link to third-party websites or platforms. Their operators control their own processing and privacy practices. We encourage you to read the relevant privacy information before providing personal information.

16. Changes to this policy

We may update this policy when our services, suppliers or legal obligations change. The current version will be published on this page with its effective date. If a change materially affects how we use information already collected, we will take reasonable steps to provide an additional notice where required.

17. Contact and complaints