The short version
Fortitude Media Limited is the data controller for the personal data described in this policy. We are registered in England and Wales under company number 17191927. Our registered office is 5 Missenden Road, Chesham, HP5 1JL. Our website is fortitudemedia.ai.
For anything to do with your personal data, email hello@fortitudemedia.ai or write to the address above, marked for the attention of the data protection lead. A founder reads that inbox and will reply within one working day.
This policy covers our website and the way we handle the details of people who contact us through it, book a call with us or become a client. It does not cover the websites we build for clients, which have their own policies, or the sites of other companies we link to.
We collect personal data in four situations. In each one we ask only for what the task needs.
When you book a Growth Review. You choose a time in a Calendly diary embedded on our site. Calendly collects your name, email address, company and any notes you add, and creates the meeting. We receive those details, together with the page you booked from, the site that referred you and any campaign tags in the link you used, and we store a record of the booking. We use this to prepare for the call, to hold it, and to send you the three fixes in writing afterwards. If you tell us about your firm, a service you want to grow and two competitors, we use that only to prepare the call.
When you send us a note. The form on the Growth Review page asks for your name, email address, company, the reason for writing and your message. Your phone number is optional. We record the page the note came from, your browser type and a scrambled version of your internet address (a salted hash, which cannot be turned back into the address) so that we can stop automated abuse of the form. We use your note to reply and, if you ask us to, to start work. A copy is emailed to a founder so nothing waits.
When you ask for a Paid Discovery. This uses the same form as a note. We use your details to confirm the work, raise an invoice and deliver the readout.
When you become a client. We hold the contract, invoices, the names and contact details of the people we work with at your firm, and the work itself. We use these to deliver and account for the work.
When you play Fortitude Grand Prix. Our racing game at fortitudemedia.ai/grand-prix asks for three initials and, if you choose, your company name, and shows them with your lap time on the public leaderboard. Your email address is optional and never shown. We ask for it only if you tick the monthly prize or the email that tells you someone has beaten your time, and we use it for those two things and nothing else. To check that a lap is genuine, the game sends us the controls you pressed during the lap and a random identifier for your browser, and we record a scrambled version of your internet address (a salted hash, as above) to stop automated entries.
When you visit the site. If you allow analytics cookies, Google Analytics records the pages you view, roughly where you are, the device you use and a random identifier that lets it count you once rather than many times. It does not tell us who you are. If you choose essential cookies only, no analytics runs. Our hosting provider keeps short-lived server logs, including internet addresses, for security and to keep the site running.
We do not collect special category data (such as health, religion or political opinions), and we ask you not to send it to us.
UK data protection law requires a lawful basis for each use of personal data. Ours are:
Our database runs in Supabase's London region, so enquiries, bookings and client records stay in the United Kingdom.
Calendly, Resend and Google are based in the United States. When we use them, some personal data leaves the UK. We rely on the safeguards UK law provides for this: the UK Extension to the EU-US Data Privacy Framework where the supplier is certified under it, and otherwise the International Data Transfer Agreement or the UK Addendum to the European Commission's Standard Contractual Clauses. You can ask us for a copy of the relevant safeguard.
| What | How long | Why |
|---|---|---|
| Notes and enquiries sent through the site | 24 months from the last contact | So we have the record if you come back, then deleted |
| Growth Review booking records | 24 months from the call | As above |
| Fortitude Grand Prix laps, initials and company names | While the leaderboards run, or until you ask us to remove them | To show the boards and check new laps against them |
| Fortitude Grand Prix email addresses | 24 months from your last lap, or until you ask us to remove them | For the prize and the overtake email you asked for |
| The scrambled internet address recorded with a lap | 30 days | To stop automated entries |
| Client contracts, invoices and correspondence | 6 years from the end of the financial year in which the work ended | HMRC record-keeping rules |
| The work we produce for a client | Returned or deleted on request at the end of the engagement, otherwise kept as above | Contract |
| Analytics data | 14 months | Google Analytics retention setting |
| Server and security logs | Up to 30 days | Security |
Where a shorter period applies to a specific record we will tell you when we collect it. If you ask us to delete your data (section 7) we will do so unless a legal reason requires us to keep it, in which case we will tell you what and why.
You have the right to:
To use any of these, email hello@fortitudemedia.ai. We may ask you to confirm your identity so we do not release data to the wrong person. We will reply within one month. There is no charge unless a request is clearly unfounded or excessive, in which case the law allows us to charge a reasonable fee or decline, and we will explain why.
We use essential cookies to make the site work, and one analytics tool that sets cookies only if you allow it. We set no advertising cookies. The full list, with names and lifetimes, and the controls to change your choice, are on our cookie policy page.
Our services are for businesses. The site is not aimed at children and we do not knowingly collect personal data from anyone under 18. If you believe a child has sent us their details, email us and we will delete them.
Data travels between you and the site over an encrypted connection. Our database restricts access by role so that form submissions cannot be read by the public. Access to systems that hold personal data is limited to the founders and the suppliers named above. No system is perfectly secure, and if a breach affects your rights we will tell you and the Information Commissioner's Office as the law requires.
We do not make decisions about you by automated means alone, and we do not profile you.
If you are unhappy with how we have handled your data, please tell us first at hello@fortitudemedia.ai and give us the chance to put it right. You also have the right to complain to the Information Commissioner's Office, the UK regulator, at ico.org.uk, by phone on 0303 123 1113, or by post to Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
We review this policy when the way we handle data changes and at least once a year. The date at the top tells you when it last changed. If a change affects you materially, for example a new use of your data, we will tell you by email where we have your address.