Media Gem – Privacy Notice
Version 1.0 – last updated 2 November 2026. This notice explains how Media Gem uses personal data.
1. Who we are
Media Gem is the trading name of Stephen George Hippel, a sole trader based in East Sussex, England. Media Gem provides local web marketing and the Media Gem Marketing Manager, an online tool for managing Google Business Profiles.
- Address: 47 Edmonton Road, Bexhill-on-Sea, East Sussex, TN39 4BJ, United Kingdom
- Email: info@media-gem.co.uk
- Phone: 01424 307024
- ICO registration number: ZC289381
For the personal data described here, Media Gem is the controller unless section 2 says otherwise. Questions about this notice or your data go to info@media-gem.co.uk.
2. Who this notice covers
This notice covers people whose data we hold as controller:
- clients and the people who log in for them (owners, staff and approvers);
- people we invite to register, before they sign up;
- people who contact us or visit our websites.
Where we act for our clients (processor). When we manage a client’s Google Business Profile, we also handle personal data about their customers – for example a reviewer’s name and review text, or people shown in photos the client supplies. For that data the client is the controller and Media Gem is their processor, under the data processing terms in our Terms of Service. If you are one of our clients’ customers, please contact the business concerned first; we will help them answer you.
3. What we collect, why, and our lawful basis
We collect only what we need to provide our services. Most of it comes from you; some comes from Google (your Business Profile) and from our billing system.
| Data | Examples | Why we use it | Lawful basis |
|---|---|---|---|
| Invitation details | Name, email address, business name, invite code | To invite you to register and check your code | Legitimate interests (offering our services to existing clients); steps before a contract |
| Account details | Name, email address (your login), mobile number if you give it, password (stored only in scrambled form), the businesses and locations you can see, your role (for example approver) | To give you a login and show you only your own business | Contract |
| Business information | Your Business Profile Builder answers, services, areas covered, opening hours, tone, photo permission | To write posts, replies and suggestions for your business | Contract |
| Photos and files | Photos you upload, logos, cover and premises photos | To publish them to your Google profile when you ask, or under the standing consent in our Terms | Contract |
| Google Business Profile data | Profile details, figures, reviews and photos read from Google | To show your dashboard, draft replies and keep your profile up to date | Contract (and, for your customers’ data, as your processor – section 2) |
| Billing details | Name, billing address, invoices, payment status | To bill you and keep accounts | Contract; legal obligation (tax records) |
| Records of what happened | What changed and who changed it, terms you accepted and when, emails we sent | To run the service, show what was done, and protect both of us if there is a dispute | Legitimate interests; legal claims |
| Messages | Emails, calls and support requests | To answer you | Legitimate interests |
| Security data | A scrambled form of your internet address, kept for about an hour, to limit repeated sign-up attempts | To keep accounts safe | Legitimate interests |
| Website analytics | Pages visited, device and browser type, approximate location, collected by Google Analytics cookies | To see how the site is used and improve it | Consent (cookie banner) |
We do not take card details: card payments are handled by our payment providers (section 5). We do not sell your data or use it for advertising.
4. AI and automated checks
We use AI (Claude, from Anthropic) to help draft posts, review replies, profile descriptions and service suggestions. To do this we send it your business information and, for review replies, the review being answered. We send only what the draft needs. Under Anthropic’s commercial terms, what we send is not used to train its models, and it is deleted within 30 days.
We also run automatic checks on drafts and photos (for example spelling, misleading claims, and whether a photo shows a face or a house number). A draft or photo the checks flag is held for a person to decide.
No decision with legal or similarly significant effects on you is made by automated means alone. Your approver decides what is published, apart from routine photos under the standing consent in our Terms, which still pass these checks first.
5. Who we share it with
We use a small number of service providers to run Media Gem. They act on our instructions and may only use your data to provide their service to us.
| Provider | What they do for us | Where |
|---|---|---|
| Krystal Hosting | Hosts our websites, the Marketing Manager and our client billing portal | UK |
| QUIC.cloud | Speeds up and protects our website; manages our domain’s DNS | UK / worldwide network |
| Your Business Profile (through Google’s official tools), website analytics (Google Analytics, only with your consent) and Search Console, and our business email and file storage (Google Workspace, including Drive for your photos) | UK / EU / USA | |
| n8n | Runs our automations: drafting, publishing, photo checks and daily checks | EU (Germany) |
| Anthropic | AI drafting (section 4) | USA |
| Stripe and PayPal | Take card and PayPal payments. They act as independent controllers for payment data, under their own privacy notices | UK / EU / USA |
We may also share data with our professional advisers (for example an accountant or solicitor), or where the law requires it (for example HMRC).
Transfers outside the UK. Where a provider handles data outside the UK, we rely on UK adequacy regulations (for the EU), the UK Extension to the EU–US Data Privacy Framework where the US provider is certified, or the UK’s International Data Transfer Agreement or Addendum.
6. How long we keep it
We keep data only as long as we need it, then delete it.
| Data | How long |
|---|---|
| Content read from Google (reviews, reviewer names, profile figures) | No longer than 30 days, as Google’s policies require; most is shown live and not stored |
| Unused invitations | Codes expire 30 days after sending; the record is kept as part of our client records |
| Unfinished sign-ups (registered but not linked and paid) | Removed after 30 days |
| Account and business information | While you are a client, then 12 months after our services end |
| Photos and files you supplied | While you are a client. After our services end, they are moved to the Google Drive bin within 37 days and permanently deleted by Google about 30 days later (our Terms, section 6.5) |
| Records of what happened and terms you accepted | 6 years after our services end |
| Billing records and invoices | 6 years from the end of the tax year they relate to (HMRC requirement) |
| Messages | 2 years from the last contact |
| Security data | About an hour |
| Website analytics (Google Analytics) | 14 months (our Google Analytics setting) |
7. Cookies, security and your rights
Cookies. We use two kinds of cookies:
- Essential cookies to log you in and keep your session secure. These are always on, because the site can’t work without them. Your last chosen business and location is remembered in your account, not in a cookie.
- Analytics cookies (Google Analytics) to understand how the site is used, so we can improve it. These are only set if you agree in our cookie banner, and you can change your choice at any time using the Manage consent tab on the site.
We do not use advertising cookies. We also use Google Search Console to see how our site appears in Google search; it does not set cookies on your device.
Security. Access is by personal login only, and each person sees only their own business. Passwords are stored in scrambled form. Our connection to Google uses Google’s official tools; we never ask for your Google password. Secret keys are kept in our systems’ secure settings, never in emails or documents.
Your rights. You can ask us to:
- give you a copy of your personal data;
- correct data that is wrong or incomplete;
- delete your data, or restrict how we use it;
- object to us using it on the basis of legitimate interests;
- give you your data in a portable format, where the law allows.
To make a request, email info@media-gem.co.uk. We will reply within one month. You do not normally have to pay.
Complaints. If you are unhappy with how we have handled your data, please tell us first. You can also complain to the Information Commissioner’s Office (ICO): ico.org.uk/make-a-complaint, or call 0303 123 1113.
Changes. We will update this notice when how we use data changes, and show the date at the top. Clients will be told about important changes.