Privacy Policy

Last updated: 10 July 2026

1. Who we are

Matt Madden Photography Ltd, trading as Heedly, is a limited company registered in England and Wales ("we", "us", "our"). We are the data controller responsible for the personal data collected through this website (heedly.co) within the meaning of the UK General Data Protection Regulation ("UK GDPR") and, where applicable, Regulation (EU) 2016/679 ("EU GDPR").

You can contact us about anything in this policy by emailing matt@heedly.co.

2. Scope of this policy

This policy explains what personal data we collect when you visit this website or contact us, why we collect it, the legal bases we rely on, who we share it with, how long we keep it, and the rights you have over it. It applies to visitors to this website and to people who enquire about our marketing services for veterinary practices. Where we process personal data on behalf of our clients (for example when running campaigns for a veterinary practice), we do so as a processor under a separate agreement with that client.

3. Personal data we collect

We collect the following categories of personal data:

Identity and contact data — your name, email address, practice name and any other details you choose to share when you email us, request our Vet Marketing Playbook, request early access to our website builds or otherwise get in touch. The forms on this website work by opening your own email application, so the information you send reaches us as an ordinary email.
Correspondence data — the content of the messages you send us and our replies.
Technical and usage data — information collected automatically by our hosting infrastructure when you browse the site, such as your IP address, browser type and version, device type, operating system, the pages you view and the date and time of your visit (server logs).
Cookie data — described in our Cookie Policy.

We do not intentionally collect any special categories of personal data (such as health data or data revealing racial or ethnic origin) through this website, and we ask that you do not send us such data.

4. Purposes and legal bases for processing

We only process your personal data where the law allows us to. The purposes and corresponding legal bases under Article 6 of the UK GDPR / EU GDPR are:

Responding to your enquiries and taking steps you request before entering into a contract — Article 6(1)(b) (performance of a contract or pre-contractual steps) and Article 6(1)(f) (our legitimate interest in responding to people who contact us).
Sending you the Vet Marketing Playbook and related marketing emails you have asked for — Article 6(1)(a) (your consent). You can withdraw your consent at any time (see section 5).
Managing website-builds early access requests and telling you when builds open — Article 6(1)(a) (consent) and Article 6(1)(b) (pre-contractual steps).
Operating, securing and improving this website, including preventing abuse and diagnosing technical problems using server logs — Article 6(1)(f) (our legitimate interest in running a safe, reliable website).
Measuring how the website is used and retargeting our advertising using Google Analytics, the Meta Pixel and the TikTok Pixel — Article 6(1)(a) (your consent, collected through the cookie banner). See our Cookie Policy for details.
Complying with legal obligations, such as accounting, tax and responding to lawful requests from authorities — Article 6(1)(c).
Establishing, exercising or defending legal claims — Article 6(1)(f).

Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms and concluded they are not overridden by them. You can ask us for more information about this balancing at any time.

5. Marketing communications

We only send marketing emails to people who have asked for them (for example by requesting the playbook or requesting early access). Every marketing email we send includes a way to opt out, and you can also opt out at any time by emailing matt@heedly.co. Opting out does not affect the lawfulness of processing carried out before you withdrew consent. We do not sell or rent your personal data to anyone.

6. Who we share your data with

We share personal data only where necessary and with appropriate safeguards, with:

Service providers (processors) who host our website and email, deliver our newsletters and provide business tools. They act on our documented instructions under contracts that meet the requirements of Article 28 UK/EU GDPR.
Analytics and advertising partners — Google (Google Analytics), Meta Platforms Ireland (Meta Pixel) and TikTok Technology Ltd (TikTok Pixel), where you have consented to their cookies. For the building of retargeting audiences we and Meta act as joint controllers for the collection and transmission of the data; each partner otherwise processes data under its own privacy policy, linked from our Cookie Policy.
Professional advisers such as accountants, insurers and lawyers, where necessary.
Authorities and regulators where we are legally required to disclose data.
A buyer or successor in the event that we sell or restructure our business, in which case this policy will continue to apply to your data.

7. International transfers

Some of our service providers may store or process personal data outside the United Kingdom or the European Economic Area. Where that happens, we make sure an adequate level of protection applies — either because the destination country benefits from an adequacy decision of the UK Government or the European Commission, or because we have put in place appropriate safeguards such as the UK International Data Transfer Agreement or the European Commission's Standard Contractual Clauses, together with any necessary supplementary measures. You can request a copy of the relevant safeguards by contacting us.

8. How long we keep your data

Enquiries and correspondence — up to 24 months after our last contact with you, unless the correspondence relates to a contract, in which case we keep it for up to 6 years after the contract ends (limitation periods for legal claims).
Marketing lists — until you opt out or your consent otherwise lapses, after which we keep a minimal suppression record so we do not contact you again.
Server logs — up to 12 months, for security and diagnostics.

When data is no longer needed we delete it or irreversibly anonymise it.

9. Your rights

Under the UK GDPR and EU GDPR you have the right to:

Access — obtain a copy of the personal data we hold about you (Article 15).
Rectification — have inaccurate data corrected and incomplete data completed (Article 16).
Erasure — have your data deleted in the circumstances set out in Article 17 (the "right to be forgotten").
Restriction — restrict how we process your data in the circumstances set out in Article 18.
Data portability — receive the data you provided to us in a structured, commonly used, machine-readable format and have it transmitted to another controller (Article 20).
Object — object to processing based on legitimate interests, and to direct marketing at any time (Article 21). If you object to direct marketing we will stop.
Withdraw consent — where processing is based on consent, withdraw it at any time without affecting prior processing (Article 7(3)).
Not to be subject to automated decision-making — we do not carry out automated decision-making, including profiling, that produces legal or similarly significant effects (Article 22).

To exercise any of these rights, email matt@heedly.co. We will respond within one month (extendable by two further months for complex requests, in which case we will tell you). Exercising your rights is free of charge unless a request is manifestly unfounded or excessive.

You also have the right to lodge a complaint with a supervisory authority. In the UK this is the Information Commissioner's Office (ICO, ico.org.uk). If you are in the European Union, you can complain to the data protection authority of the EU member state where you live, work, or where the alleged infringement occurred. We would, however, appreciate the chance to address your concerns first.

10. Security

We apply appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure or destruction, including encrypted connections (HTTPS), access controls, and limiting access to personal data to those who need it. No transmission over the internet is completely secure, but we work to protect your data in line with Article 32 UK/EU GDPR. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority and, where required, the affected individuals without undue delay.

11. Children

This website is aimed at veterinary professionals and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, please contact us and we will delete it.

12. Third-party links

This website contains links to third-party websites (for example our social media profiles). Clicking those links may allow third parties to collect or share data about you. We do not control those websites and are not responsible for their privacy practices — please read their privacy policies.

13. Changes to this policy

We may update this policy from time to time. The date at the top shows when it was last revised. If we make material changes, we will take reasonable steps to bring them to your attention, for example by highlighting them on this website.

14. Contact us

Questions, requests or complaints about this policy or your personal data: matt@heedly.co, addressed to Matt Madden Photography Ltd (trading as Heedly).