Privacy policy

Last updated: 11th June 2026

This Privacy Policy explains how Quelfire Ltd ("we", "us", or "our") collects, uses, stores, and shares personal data when you visit https://www.quelfire.co.uk (the "Site") or otherwise interact with us (together, the "Services").

This Privacy Policy is provided in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who We Are (Data Controller)

Quelfire Ltd is the data controller responsible for your personal data.

Registered Address:
Unit 4, Spitfire Road
Nantwich
CW5 6HT
United Kingdom

Email: marketing@quelfire.co.uk

 

2. How We Collect Personal Data

We collect personal data through:

• Direct interactions (forms, emails, enquiries, orders)
  
• Automated technologies (cookies, pixels, scripts)
  
• Third-party services acting on our behalf

 

3. Categories of Personal Data We Collect

a) Data You Provide to Us

• Name
• Company name
• Job title
• Email address
• Telephone number
  
• Postal address
  
• Order, enquiry, or correspondence details

b) Automatically Collected Data (Usage & Technical Data)

When you visit our Site, we may collect:

• IP address (anonymised where possible)
  
• Device type, operating system and browser
  
• Pages viewed, time spent and navigation paths
  
• Referrer URLs

This data is collected only where you have provided consent, unless strictly necessary for site operation.

 

4. Cookies, Tracking & Consent

We operate a prior consent model for non-essential cookies and tracking technologies.

This means:

• Analytics, behavioural recording and advertising cookies are not set unless you opt in
  
• Essential cookies required for basic website functionality are always active

Where marketing communications contain tracking technologies that record email opens, clicks or engagement behaviour, this information is used solely to assess the effectiveness of our communications and improve relevance. You may object to this processing at any time.

Where required by law, we will obtain your consent before using email engagement tracking technologies. In other circumstances, we rely on our legitimate interests to assess the effectiveness of our communications and may use engagement data for that purpose.

5. Lead Scoring and Profiling

When you engage with our marketing emails (for example by opening them, clicking links within them, or returning to our website to download additional resources), we may use this engagement data to better understand the strength of your interest in our products and services and the stage you may have reached in a project or purchasing process.

This process, known as lead scoring, is a form of profiling under Article 4(4) of the UK GDPR.

Lead scoring is used solely to prioritise communications and identify information likely to be relevant to you. It is not used to make decisions about pricing, eligibility, contractual terms, service availability or any decision producing legal or similarly significant effects. It does not involve solely automated decision-making within the meaning of Article 22 of the UK GDPR. Any sales or customer engagement activity is reviewed by a member of our team before contact is made.

You have the right to object to this profiling at any time by contacting us using the details provided in this Privacy Policy or by unsubscribing from our marketing communications.

If you object, we will stop using your engagement data for lead scoring purposes, although we may continue to process personal data for other lawful purposes.

 

6. Analytics, Behavioural Recording & Marketing Tools

Hotjar (Behavioural Analytics)

We use Hotjar only with your explicit consent to understand how users interact with our Site.

Hotjar may collect:

• Mouse movements
  
• Clicks
  
• Scrolling behaviour
  
• Navigation patterns

Important safeguards:

• No keystroke logging
  
• No capture of form inputs
  
• IP addresses are truncated or masked
  
• Data is pseudonymised

Legal basis: Consent (UK GDPR Article 6(1)(a))

 

Google Analytics & Google Tag Manager

We use Google Analytics and Google Tag Manager only where consent is given to:

• Measure website traffic
  
• Understand user journeys
  
• Improve website performance

Where possible we:

• Enable IP anonymisation
  
• Disable Google Signals unless consented
  
• Do not use analytics data for profiling without consent

Legal basis: Consent (UK GDPR Article 6(1)(a))

SEMrush (SEO & Website Performance)

We use SEMrush to analyse website visibility, rankings and technical SEO performance.

SEMrush processes aggregated and site-level data. It does not identify individual visitors. No personal data is intentionally shared with SEMrush.

Legal basis: Legitimate interests (UK GDPR Article 6(1)(f))

 

ActiveCampaign (Marketing Automation)

We use ActiveCampaign to manage email communications, marketing campaigns and automated nurture sequences.

ActiveCampaign may process:

• Contact details
  
• Communication preferences
• Marketing engagement data
  
• Email interaction history
  
• Downloaded resources and content interests

Legal basis: Legitimate interests and/or consent, depending on the nature of the communication and applicable legal requirements.

Where you are an existing customer, we may send marketing communications under the soft opt-in provisions permitted by applicable law. In other circumstances, we will seek your consent before sending direct marketing communications.

 

Advertising & Remarketing (e.g. LinkedIn Ads)

Where you provide consent, we may use advertising cookies and pixels to:

• Measure campaign performance
  
• Deliver relevant advertisements on third-party platforms
  
• Limit repetitive advertising

Legal basis: Consent (UK GDPR Article 6(1)(a))

 

7. How We Use Personal Data

• Purpose Legal Basis
  
• Responding to enquiries Legitimate interest
  
• Processing orders and contracts Contract
  
• Website analytics and optimisation Consent
  
• Behavioural recording (Hotjar) Consent
  
• Marketing communications Consent or legitimate interest (where permitted)
  
• Automated lead nurturing and follow-up communications Legitimate interest
  
• Legal compliance Legal obligation
  
• Security and fraud prevention
  
• Legitimate interest

Where you submit your contact details through one of our forms, for example to download a whitepaper, technical guide, checklist, product information, request support or register for a CPD session, we may send a series of follow-up communications over the following weeks and months.

These communications may be triggered automatically based on:

• The resource requested
  
• Your role within the design, specification or installation process
  
• Previous engagement with our content
  
• Your stage within a project or enquiry process

You may unsubscribe from marketing communications at any time using the unsubscribe link included in every marketing email.

Our marketing emails may contain tracking pixels and tracked links that record when an email is opened and which links are clicked.

We use this information to:

• Understand which content is useful and relevant
  
• Improve the effectiveness of our communications
  
• Time follow-up communications appropriately
  
• Remove inactive subscribers from our marketing lists

This processing is carried out under our legitimate interest in operating a relevant and effective marketing programme.

 

8. Sharing Personal Data

We may share personal data with trusted third parties who act as data processors, including:

• Website hosting providers (e.g. Shopify)
• Payment processors
  
• Analytics and optimisation providers
  
• Advertising platforms (where consent has been provided)

In addition to Shopify, we use the following processors to support our lead generation, CRM and marketing activities:

• JotForm Inc. – used for online forms, landing pages and marketing campaign enquiries.
  
• Pipedrive – used as our customer relationship management (CRM) platform.
  
• ActiveCampaign LLC – used for email marketing, automated communications and lead nurturing.
  
• Google Analytics – used for website traffic patterns, user journeys and website performance metrics.
  
• HotJar – used to record anonymised usage of the website to understand user experience and improve usability.
  
• LinkedIn – used for capturing lead information and targeting personalised advertisements.

Some providers including ActiveCampaign, JotForm and other cloud service providers may process personal data in the EEA, United States or other jurisdictions.

All processors are contractually required to:

• Process personal data only on our instructions
  
• Implement appropriate security measures
  
• Comply with UK GDPR and applicable data protection legislation

We do not sell personal data.

 

9. International Transfers

Some service providers may process data outside the United Kingdom.

Where data is transferred internationally, we rely on:

• UK International Data Transfer Agreements (IDTAs)
  
• UK International Data Transfer Addendums
  
• Adequacy regulations issued by the UK Government
  
• Other approved safeguards permitted under UK GDPR

 

10. Data Retention

We retain personal data only for as long as necessary to:

• Fulfil the purposes outlined in this policy
  
• Meet legal and regulatory obligations
  
• Resolve disputes
  
• Enforce contractual agreements
  
• Retention periods vary depending on the data type and purpose.

We will generally stop retaining marketing engagement data after 24 months unless there is evidence of an ongoing commercial relationship, active project involvement, contractual relationship or another lawful basis requiring continued retention.

An interaction may include:

• Opening a marketing email
  
• Clicking a link in a marketing email
  
• Downloading a resource
  
• Submitting an enquiry
  
• Visiting our website through tracked marketing activity

If you become a customer, separate customer retention requirements may apply.

 

11. Your Rights Under UK GDPR

You have the right to:

• Access your personal data
  
• Rectify inaccurate data
  
• Request erasure
  
• Restrict processing
  
• Object to processing
  
• Withdraw consent at any time
  
• Data portability

Right to Object to Direct Marketing

You have an absolute right under Article 21(2) of the UK GDPR to object to your personal data being used for direct marketing purposes, including profiling carried out for direct marketing activities.

If you exercise this right, we will stop processing your personal data for marketing purposes immediately.

You can do this by:

• Clicking the unsubscribe link included in any marketing email
  
• Contacting us using the details provided below

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO):

Website: https://ico.org.uk

Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Telephone: 0303 123 1113

 

12. Children's Data

Our Site is not intended for children under 16, and we do not knowingly collect personal data from children.

 

13. Security

We implement appropriate technical and organisational measures to protect personal data.

However, no method of transmission over the internet or electronic storage can be guaranteed to be completely secure, and we cannot guarantee absolute security.

 

14. Contact Us

For privacy-related enquiries, data protection requests or to exercise your rights:

📧 marketing@quelfire.co.uk

📍 Unit 4, Spitfire Road, Nantwich, CW5 6HT, United Kingdom