Legal
Privacy Policy
Last updated: 25 October 2026. How SHINIMINI LTD collects, uses and protects your personal data.
Last updated: 25 October 2026. How SHINIMINI LTD collects, uses and protects your personal data.
Shinimini Ltd is a private limited company registered in England and Wales (company number 15190504, listed on Companies House).
We provide business-growth services, websites, software, AI receptionists and automation. We act as the data controller for our own website visitors, business contacts and enquiries. When we process personal data on a client's behalf, our role and responsibilities are set out in a separate data-processing agreement.
Email: hello@scalingfirm.com or info@scalingfirm.com. You can also contact the UK's data protection regulator, the Information Commission (formerly the Information Commissioner's Office), at ico.org.uk.
When you request a review through our Facebook or Instagram form, SHINIMINI LTD, trading as The Scaling Firm, receives your contact details, business answers, response preference and the identifiers for the form and advert. We use these details to respond to your enquiry, assess the service you need and arrange a meeting.
The form asks separately whether you want a call from Joey, our AI assistant. We call only when you request that AI call. You can choose an email response instead. You can withdraw your call permission at any time by telling Joey or emailing hello@scalingfirm.com.
Joey identifies himself as an AI assistant. His calls are recorded and transcribed. We use the recording, transcript, call summary and technical call information to handle your enquiry, check the call's accuracy and follow up on any appointment or action you request. Full call records have no automatic deletion setting. This applies to voice records separately from the enquiry-data periods below. You can request access to or deletion of your call records at hello@scalingfirm.com.
Please keep the enquiry about your business. Do not include patient names, health records or another person's private information.
Service providers may use aggregated, de-identified call and usage data for analytics and AI model training under their terms. Contact us for the processing arrangements that apply to your call. Client services have separate agreed processing terms.
We use service providers for enquiry forms, AI conversation and voice processing, telephone connections, secure hosting, contact management, appointment booking, calendars, video meetings and business email. These providers receive the information needed for their part of the service.
These services may process information outside the UK. You can contact hello@scalingfirm.com for information about the processing arrangements for your enquiry.
You can decline the call, ask us to stop contacting you, correct your details or request access to or deletion of your information. Email hello@scalingfirm.com. Withdrawing call permission does not affect the lawfulness of processing before withdrawal.
We research small and medium businesses in the UK, Canada and the United Arab Emirates that may want our services or those of our sales partners. For the people who own, run or make decisions at those businesses, we hold their name, job role and business, links to their public professional profiles, and the work or mobile phone number and email address we found on the business's own website, that they gave us on a call or in an email, or that we recorded in our customer records after speaking with them. Business details come from public registers, the business's own website and online business and map listings. We use these details to contact people about services for their business. Our lawful basis is our legitimate interest in direct marketing to businesses (UK GDPR Article 6(1)(f)).
We share these business details, and the contact details of people at those businesses, with a small number of vetted sales partners. Each partner signs our Partner Data and Access Agreement first (and, if it is outside the UK, the UK International Data Transfer Agreement), works only its own territory of countries and trades, and may use the details only to offer its own products and services to businesses in that territory. Each partner is a separate controller and is responsible for its own calls and messages. When a partner first contacts you, it must tell you who it is, why it is contacting you, where your details came from and how to object, and it must check the relevant telephone preference and do not call registers before it calls. Partners cannot sell or pass on your details. Partners may be based in the UK, Canada or the United Arab Emirates; see International transfers.
You can object at any time, to us or to any partner who contacts you, and we will stop using your details for marketing and stop our partners using them too. Tell whoever contacts you, or email hello@scalingfirm.com with your name and your business's name or phone number. We keep a short record of your name and number on a do not contact list so that neither we nor our partners contact you again. You can also ask us which partners have received your details, ask us to delete them, or complain to us or to the Information Commission at ico.org.uk.
We keep a person's details for as long as they stay useful for researching businesses that may want our services or our partners' services, and delete them at the latest 24 months after we last used them. Partners must delete what they hold when their agreement with us ends.
| Purpose | Lawful basis (UK GDPR Article 6) |
|---|---|
| Provide, manage and support our products and consulting | Performance of a contract or steps prior to contract |
| Process subscriptions, invoices, payments and refunds | Contract / legal obligation |
| Respond to enquiries, demos and deliver consultations | Contract / pre-contract / legitimate interests |
| Recorded AI calls requested through our enquiry form | Consent, recorded through your separate AI-call choice |
| Direct marketing about our tools | Consent where PECR requires it; legitimate interests for permitted business marketing |
| Researching businesses and sharing business contacts with sales partners | Legitimate interests |
| Improve our website, products and services | Legitimate interests |
| Fraud prevention, security, debugging | Legitimate interests / legal obligation |
| Compliance with legal obligations | Legal obligation |
We do not sell personal data.
Some recipients are located outside the UK. We ensure appropriate safeguards (UK IDTA, UK Addendum to EU SCCs, or UK adequacy regulations). All transfers comply with UK GDPR Chapter V. Some of our sales partners are in Canada (covered by UK adequacy regulations where PIPEDA applies) or the United Arab Emirates; partners outside the UK sign the UK International Data Transfer Agreement before they get access.
You have the right to access, rectify, erase, restrict, port and object to processing of your data, and to withdraw consent. To exercise these rights, email hello@scalingfirm.com. We respond within one month. You can complain to us at hello@scalingfirm.com, and we will acknowledge your complaint within 30 days.
We implement appropriate technical and organisational measures (encryption in transit and at rest, access controls, regular testing, secure hosting). No internet transmission is fully secure.
Nothing that tracks you loads on scalingfirm.com or book.scalingfirm.com until you choose. The bar at the foot of the page offers “Accept all” or “Manage preferences”. Under Manage preferences, strictly necessary cookies are always on and analytics and advertising measurement are separate switches, shown switched on; switch either off and save to refuse it. Nothing loads until you press Accept all or Save preferences. Change your mind at any time with “Cookie settings” at the foot of every page. If your browser sends Do Not Track or Global Privacy Control, we treat that as no to both and do not ask.
| Name | Provider | Purpose | Category | How long |
|---|---|---|---|---|
| tsf_consent | Us | Remembers your cookie choice on both our sites (a copy is also kept in your browser’s local storage) | Strictly necessary | 12 months |
| _ga, _ga_* | Google Analytics 4 | Counts visits and which pages help. Google signals and ad personalisation are off. | Analytics | Up to 14 months; Google keeps the data for 14 months |
| _clck, _clsk | Microsoft Clarity | Shows how pages are used (clicks, scrolling and session replays) so we can fix what confuses people. Anything typed into forms is masked. | Analytics | Set by Microsoft; see Microsoft’s Clarity cookie list, which also covers the cookies Microsoft sets on its own domains |
| tsf-attr (local storage) | Us | Remembers the advert or website that first sent you, so an enquiry can be credited to it | Analytics (click IDs only with Advertising) | 30 days |
| _gcl_au | Google Ads | Tells us when someone who clicked one of our adverts sends an enquiry or signs up. No personalised ads. | Advertising | 90 days |
We may update this notice. Changes are posted here with the updated date. Thank you for trusting Shinimini Ltd with your information.