Privacy and Cookie Policy

Who We Are

This website is run by Web Fuel Agency Ltd (“WFA”, “we”, “us”). We are the controller of the personal data described in this policy.

Web Fuel Agency Ltd
Company number 115730
Suite 23, Portland House
Glacis Road, Gibraltar GX11 1AA
Telephone: +350 54002166

We are based in Gibraltar and work with people in the UK, the European Union and elsewhere. We follow the Gibraltar GDPR and Data Protection Act 2004, and, where they apply to you, the UK GDPR and the EU GDPR. We have not appointed a data protection officer.

To ask about this policy or to use any of your rights, please use the contact form and choose any topic, or write to us at the address above. Please say that your message is a privacy request.

What We Collect

When you send an enquiry. Our contact, founder, investor and group forms ask for:

• your name and email address (required);
• your company or organisation (optional);
• the topic or stage you choose from a list, where the form offers one; and
• your message or the context you add.

With each enquiry we also record the page you sent it from, the page that referred you (if your browser shares it), any campaign tags in the web address (such as utm_source), the time you spent on the page before sending, and a random reference number for the submission. Some forms include a hidden field that people never see; it helps us filter out automated spam.

When you browse the site. If you accept analytics cookies, Google Analytics collects information about how you use the site, such as pages viewed, the device and browser you use, your approximate location and how you arrived. We ask Google to shorten IP addresses and we do not use advertising features. See Cookies for what happens before you choose.

Like any website, our hosting and security providers process technical data such as your IP address, browser type and the time of each request, so that the site can be delivered and protected.

Please do not send us sensitive information (for example about health) through the forms. We do not knowingly collect data from children; this site is for businesses, founders and investors.

How We Use It and Our Lawful Bases

• To reply to your enquiry and follow up about investment, partnerships, the group or our services. Our lawful basis is our legitimate interests in responding to business enquiries and developing business relationships. If you are acting for a business that is taking steps toward an agreement with us, we may also rely on steps taken before entering into a contract.
• To keep a record of enquiries in our customer relationship and lead management systems, so that the right person in the group can respond and we do not lose track of conversations. Lawful basis: legitimate interests.
• To understand how the site is used through Google Analytics, so that we can improve it. Lawful basis: your consent, which you can withdraw at any time.
• To run and protect the website, including blocking spam and abuse. Lawful basis: legitimate interests in keeping the site secure and working.
• To meet legal obligations and to establish or defend legal claims, where needed. Lawful basis: legal obligation or legitimate interests.

Where we rely on legitimate interests, we have considered that the use is expected for a business enquiry and does not override your rights. You can object at any time (see Your rights). We do not sell your personal data, and we do not make decisions about you based solely on automated processing.

Who Receives Your Data

We share personal data only with the service providers and group companies that help us run the site and respond to you:

• GoHighLevel (HighLevel): our customer relationship management (CRM) system. Enquiries are passed to it through our own relay at leads.webfuelagency.com.
• Cortex (cortexlayer.io): lead management. Cortex is a company within our group, and it receives each enquiry so that it can be routed to the right team.
• Google Analytics (Google): website analytics, only if you accept analytics cookies.
• Cloudflare: content delivery network, DNS and security for the website.
• Hostinger: website hosting.

These providers act on our instructions. We may also share information with professional advisers, or where the law requires it, for example with a regulator or a court. If any part of our business is sold or reorganised, personal data may pass to the new owner under the same protections.

International Transfers

Some of our providers, including Google, Cloudflare and HighLevel, are based in or process data in the United States or other countries outside Gibraltar, the UK and the European Economic Area. When personal data is transferred to a country that has not been recognised as giving adequate protection, we rely on an adequacy decision where one applies, or on standard contractual clauses approved for the purpose (including the UK addendum or international data transfer agreement for UK data), together with any additional safeguards that are needed. You can ask us for more information about these safeguards.

How Long We Keep It

• Enquiries: up to 24 months after our last contact with you, unless a business relationship follows. If it does, we keep the records we need for that relationship and for our legal and accounting obligations.
• Analytics data: kept in Google Analytics in line with the retention setting for our property, and reported in aggregate.
• Your cookie choice: stored in your browser until you clear it or change it.
• Server and security logs: kept by our hosting and security providers for short periods in line with their own settings.

We delete or anonymise data when it is no longer needed.

Your Rights

Depending on where you are and the basis we rely on, you have the right to:

• access the personal data we hold about you and get a copy;
• rectification: have inaccurate or incomplete data corrected;
• erasure: ask us to delete your data;
• restriction: ask us to limit how we use your data;
• object to our use of your data based on legitimate interests, and to any direct marketing at any time;
• data portability: receive data you gave us in a commonly used, machine-readable format, or have it sent to another organisation, where this applies; and
• withdraw consent at any time, for example to analytics cookies. This does not affect anything done before you withdrew it.

To use any of these rights, contact us through the contact form or at our address. We will reply within one month, and may need to confirm your identity first. There is normally no charge.

Cookies and Similar Technologies

Cookies are small files that a website stores in your browser. Similar technologies, such as your browser’s local storage, work in a similar way. We use as few as possible.

Strictly necessary. These are needed for the site to work or to remember your privacy choices, so they do not need consent.

• Your cookie choice: cookie choices are collected and remembered by Consently, an established consent-management tool we use on this site, so that we do not ask on every page.
• Security: Cloudflare may set a cookie (such as __cf_bm) to tell people apart from automated traffic and protect the site.
• Campaign tags: on pages with an enquiry form, our lead form tool keeps any campaign tags from the web address in your browser’s session storage, so they can be included with your enquiry. Session storage is cleared when you close the tab.

Analytics (optional, off until you accept). If you accept, Google Analytics 4 sets cookies named _ga and _ga_9417BSB2G7, which last up to two years, to count visits and understand how the site is used. We use Google Consent Mode, which keeps analytics storage switched off until you accept. Before you choose, or if you reject, no analytics cookies are set, although Google may still receive basic signals that a page was viewed, without cookies, which it uses only in aggregate.

Optional Marketing cookies are off until you accept them in the Consently banner. We do not load separate social-media widgets for tracking.

Changing your choice. You can change your mind at any time by clearing this site’s cookies and stored data in your browser settings; you will then be asked again on your next visit. Most browsers also let you block cookies altogether, although parts of some sites may not then work.

Complaints

If you are unhappy with how we have handled your personal data, please tell us first so that we can try to put it right. You also have the right to complain to a data protection regulator:

• Gibraltar: the Gibraltar Regulatory Authority, which is Gibraltar’s Information Commissioner. 2nd Floor, Eurotowers 4, 1 Europort Road, Gibraltar. gra.gi/data-protection.
• United Kingdom: the Information Commissioner’s Office (ICO). ico.org.uk/make-a-complaint.
• European Union: the data protection authority in the country where you live or work.

Changes to This Policy

We may update this policy when our website, services or providers change. The date at the top shows when it was last updated.