Privacy and Cookie Policy

Last updated: 30 April 2026

The short version

This site is run by John Webb, trading as Decoding Growth. I take your privacy seriously and only collect what I need to run my business and keep in touch with people who want to hear from me.

  • I collect your name and email if you sign up for my newsletter or download a resource.
  • I use cookies and Google Analytics to understand how the site is used. You can control or block cookies through your browser settings.
  • I never sell, rent, or trade your data.
  • You can ask to see, correct, or delete your data at any time by emailing hello@johnwebb.co.uk.
  • If you’re unhappy with how I handle your data, you can complain to the UK Information Commissioner’s Office (ICO).

The full detail follows below.

1. Who I am and how to contact me

This Privacy & Cookie Policy explains how I collect, use, and protect personal data through the website www.johnwebb.co.uk (the “Site”).

Data controller: John Webb (sole trader, trading as Decoding Growth), United Kingdom.

Email: hello@johnwebb.co.uk

I am the data controller for any personal data collected through this Site. Because I operate as a sole trader and do not carry out large-scale or high-risk processing, I am not required to appoint a Data Protection Officer under UK GDPR. You can raise any data protection question by emailing the address above.

2. What this policy covers

This policy covers personal data I collect when you visit the Site, sign up for emails, download a resource, or contact me through the Site. It does not cover information you provide offline (for example at events, by phone, or by post), which is handled in line with the same principles but is not the subject of this notice.

3. The law I follow

I comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR). Where visitors are located in the European Economic Area, I also comply with the EU GDPR.

4. What personal data I collect

Information you give me

  • Name and email address — when you subscribe to my newsletter, download a resource, or fill in a contact form.
  • Company name and role — if you choose to share these when enquiring about consulting work.
  • Message content — anything you write to me through the Site or by email.
  • Billing information — name, business address, and VAT details if you become a paying client. Card payments are handled by my payment processor; I do not see or store your full card details.

Information collected automatically

  • Technical data — IP address, browser type and version, device type, operating system, and timezone.
  • Usage data — pages visited, time spent, referring source, and interactions with the Site.
  • Cookie data — see Section 7.

5. Why I use your data and the lawful basis for each use

Under UK GDPR, I must have a lawful basis for processing your personal data. The main bases I rely on are:

  • Consent — for sending marketing emails. You can withdraw consent at any time.
  • Contract — to deliver consulting services, manage projects, and handle invoicing once you become a client.
  • Legitimate interests — to run and secure the Site, respond to enquiries, prevent fraud, and improve my services in ways you would reasonably expect.
  • Legal obligation — to keep tax, accounting, and other records required by UK law.

Specifically, I use your data to:

  • Send you the newsletter or resources you have requested (consent).
  • Respond to your enquiries and follow up on conversations (legitimate interests / pre-contract steps at your request).
  • Provide consulting and advisory services and issue invoices (contract; legal obligation).
  • Understand how the Site is used and improve content and structure (legitimate interests).
  • Protect the Site from spam, abuse, and security threats (legitimate interests).
  • Comply with my legal, tax, and regulatory obligations (legal obligation).

6. Marketing emails

If you sign up for the newsletter or a free resource, I will send you related emails. Each email contains a one-click unsubscribe link, and you can also unsubscribe at any time by emailing hello@johnwebb.co.uk.

I do not pass your email address to third parties for their own marketing. I use Brevo (Sendinblue SAS) to deliver emails and gather standard performance metrics such as open and click rates so I can improve what I send.

7. Cookies and similar technologies

Cookies are small text files placed on your device when you visit a website. The Site uses cookies and similar technologies (such as pixels and local storage) for the following purposes:

  • Strictly necessary — required for the Site to function and to remember that you have seen the cookie notice.
  • Analytics — help me understand how visitors use the Site so I can improve it (set via Google Analytics).

When you first visit the Site, a notification informs you that the Site uses cookies and points you to this policy. By continuing to use the Site you accept that cookies will be set as described here.

If you do not want cookies to be set on your device, you can control or block them at any time using your browser settings.

Most browsers let you refuse all cookies, accept only certain types, delete cookies that have already been set, and be alerted when a cookie is being placed. Blocking all cookies may affect parts of the Site.

You can also opt out of Google Analytics specifically by installing the Google Analytics Opt-out Browser Add-on, available from Google.

8. Analytics

I use Google Analytics 4 to measure traffic and usage patterns on www.johnwebb.co.uk. Google Analytics is configured to anonymise IP addresses where possible and is used only to understand site performance in aggregate.

I do not attempt to identify individual visitors from analytics data, and I do not allow Google to use the data to identify you. Google may transfer analytics data outside the UK; see Section 11 on international transfers.

9. Who I share your data with

I only share personal data with carefully chosen service providers (“processors”) who help me run my business. They act on my instructions, are bound by written contracts, and may not use your data for their own purposes.

My current processors are:

  • Brevo (Sendinblue SAS) — email marketing and newsletter delivery.
  • Google Analytics (Google Ireland Ltd / Google LLC) — website analytics.
  • SiteGround — website hosting and associated security.
  • ThriveCart — checkout, payments, and order processing for paid products and services.

I may also disclose personal data where I am legally required to do so (for example to HMRC or law enforcement), or where it is necessary to defend my legal rights.

I do not sell, rent, or trade your personal data to anyone.

10. Affiliate links

Some links on the Site are affiliate links, meaning I may receive a small commission if you click through and buy. This does not change the price you pay. Where I use affiliate links, I aim to make this clear at the point of the link. Once you click an affiliate link, the destination site’s privacy policy applies to anything you do there.

11. International data transfers

Some of my service providers (notably Google) may process data outside the United Kingdom and the European Economic Area, including in the United States. Where this happens, I rely on appropriate safeguards required by UK GDPR, such as:

  • UK adequacy regulations or European Commission adequacy decisions, where they apply.
  • The UK International Data Transfer Agreement, the UK Addendum, or the EU Standard Contractual Clauses.
  • Certifications such as the UK Extension to the EU-US Data Privacy Framework, where the recipient is certified.

You can request more information about the safeguards in place by emailing hello@johnwebb.co.uk.

12. How long I keep your data

I only keep personal data for as long as I need it for the purpose I collected it, plus any period required by law. As a guide:

  • Newsletter subscribers: until you unsubscribe, plus a short suppression record so I do not email you again by mistake.
  • Enquiries that do not become clients: up to 24 months from last contact, then deleted.
  • Client records and contracts: for the duration of our engagement and for at least six years after, in line with UK tax and accounting rules.
  • Website analytics: aggregated analytics are retained per Google Analytics defaults (currently up to 14 months for user-level data).
  • Server logs: typically up to 12 months for security and troubleshooting.

13. How I keep your data secure

I take reasonable technical and organisational measures to protect your personal data, including HTTPS encryption on the Site, access controls on the systems I use, strong authentication, and choosing reputable suppliers with their own recognised security standards.

No system is ever 100% secure. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, I will notify the ICO within 72 hours and inform affected individuals where required.

14. Automated decisions and AI tools

I do not make automated decisions that produce legal or similarly significant effects about you (for example, automatically accepting or rejecting clients).

I may use AI-powered tools (such as drafting and analysis tools) to help me work more efficiently — for example, to draft email replies, summarise documents, or prepare research. Where I use such tools, I avoid putting personal data into them unnecessarily, and I do not use your personal data to train third-party AI models.

15. Your rights

Under UK GDPR you have the following rights, free of charge:

  • Right to be informed — this notice is part of how I meet that obligation.
  • Right of access — ask for a copy of the personal data I hold about you.
  • Right to rectification — ask me to correct inaccurate or incomplete data.
  • Right to erasure — ask me to delete your data in certain circumstances (the “right to be forgotten”).
  • Right to restrict processing — ask me to limit how I use your data.
  • Right to data portability — ask for your data in a structured, machine-readable format.
  • Right to object — object to processing based on legitimate interests, including direct marketing.
  • Rights related to automated decision-making — I do not carry out automated decision-making with legal or similarly significant effects.
  • Right to withdraw consent — where I rely on consent, you can withdraw it at any time.

To exercise any of these rights, email hello@johnwebb.co.uk. I will respond within one month, and may ask for proof of identity to make sure I am dealing with the right person.

16. Children

This Site is aimed at business audiences and is not intended for children under the age of 16. I do not knowingly collect personal data from children. If you believe a child has provided me with personal data, please contact me and I will delete it.

17. Third-party sites

The Site contains links to other websites. I am not responsible for the privacy practices of those sites. I encourage you to read their privacy notices before sharing any personal data with them.

18. Changes to this policy

I may update this policy from time to time to reflect changes to my services, the law, or how I work. The “Last updated” date at the top will always show the latest version. For material changes, I will give clear notice on the Site or by email where appropriate.

19. Questions and complaints

If you have any questions about this policy or how I handle your data, please email hello@johnwebb.co.uk.

If you are not satisfied with my response, you have the right to lodge a complaint with the UK Information Commissioner’s Office at https://ico.org.uk, by phone on 0303 123 1113, or by post to Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. Visitors in the EEA can also complain to their local data protection authority.