Skip to main content

Privacy Policy

Last Updated: 14 February 2026

1. Introduction & Controller Identity

This Privacy Policy explains how ChatGPT Trade Ltd ("we", "us", "our") collects, uses, and protects your personal data when you visit chatgpttrade.co.uk (the "Website"). We are committed to ensuring that your privacy is protected in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Data Controller: ChatGPT Trade Ltd, registered in England and Wales.

Registered Address: 71 Queen Victoria Street, City of London, EC4V 4AY, United Kingdom.

Contact Email: [email protected]

Effective Date: 14 February 2026

Given the nature and scale of our processing activities, we have not appointed a dedicated Data Protection Officer. For all privacy-related enquiries, please contact us at the email address above.

2. Personal Data We Collect

We may collect and process the following categories of personal data:

  • Identity & Contact Data: Your full name, email address, and phone number (when voluntarily provided via our contact form).
  • Form Content: The subject matter and content of messages you submit, including any details about your enquiry or feedback.
  • Technical Data: IP address, browser type and version, operating system, device type, language preference, and screen resolution.
  • Usage Data: Pages visited, time spent on each page, referral source, click paths, and navigation patterns.
  • Cookies & Identifiers: Cookie IDs and similar tracking identifiers as described in Section 4 and our Cookie Policy.
  • Conversion Events: Records of form submissions and other interactions used to measure the effectiveness of our educational outreach.

We do not collect special-category data (health, religion, political views, biometric data), financial account details, bank credentials, government-issued identification, or any data that would constitute regulated financial information. We do not access, store, or process your bank account or transaction data.

3. Why We Process & Legal Basis

Under Article 6 of the UK GDPR, we process your personal data on the following lawful bases:

  • Contact Form Enquiries: Art. 6(1)(b) — performance of a contract or pre-contractual steps (responding to your request); Art. 6(1)(a) — your explicit consent when you tick the consent checkbox.
  • Analytics: Art. 6(1)(a) — consent, obtained via the cookie consent mechanism before any analytics cookies are placed.
  • Marketing & Remarketing: Art. 6(1)(a) — consent, obtained via the cookie consent mechanism before any marketing or remarketing cookies are activated.
  • Security & Fraud Prevention: Art. 6(1)(f) — legitimate interest in protecting the Website from malicious activity, bot attacks, and fraudulent form submissions.
  • Legal & Tax Compliance: Art. 6(1)(c) — compliance with a legal obligation where applicable (e.g. responding to lawful requests from regulatory bodies or maintaining records required by HMRC).

Automated Decision-Making (Art. 22): We do not engage in automated decision-making or profiling that produces legal or similarly significant effects on you. Our AI-powered educational content analyses anonymised, aggregate data — it does not process your individual personal data to produce personalised outcomes or decisions.

4. Cookies & Tracking Technologies

We use three categories of cookies and tracking technologies on this Website. Full details, including a cookie-by-cookie table, are available in our Cookie Policy.

Essential Cookies (No Consent Required)

These cookies are strictly necessary for the Website to function. They include _site_session (session continuity, session lifespan), cookie_consent (stores your consent choice, 12 months), and any CSRF protection tokens. These are always active and cannot be disabled.

Analytics Cookies (Consent Required)

When you consent, we use Google Analytics 4 (GA4) with IP anonymisation enabled. Specific cookies include _ga (2-year retention) and _ga_XXXXXXXXXX (GA4 session state, 2-year retention). Analytics data is retained for a maximum of 14 months within Google's systems. These cookies help us understand how visitors navigate the Website so we can improve our educational content.

Marketing Cookies (Consent Required)

When you consent, marketing cookies may be set to support remarketing, conversion attribution, and audience measurement. These include _gcl_au (Google Ads conversion linker, 90 days), _fbp (Meta Pixel browser identifier, 90 days), and _fbc (Meta Pixel click identifier, 90 days, set when a click ID is present). Beyond cookies, we may use pixel tags (gtag.js, Meta Pixel), server-side tracking via Meta Conversion API or Google Server-Side GTM (hashed data), and device identifiers derived from IP address and User-Agent string combinations.

5. Consent Mechanism (UK GDPR)

Users in the United Kingdom receive a consent notice under the UK GDPR when they first visit the Website. Marketing and analytics cookies activate only after explicit, informed, freely given consent (Art. 6(1)(a)). Your consent choice is recorded in the cookie_consent browser cookie, which persists for 12 months.

You may withdraw your consent at any time by clicking "Manage Cookie Preferences" in the Website footer, or by clearing your browser cookies. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

Essential cookies remain active regardless of your consent choice, as they are necessary for the Website to operate correctly.

6. Sharing With Advertising & Service Partners

We share personal data with the following categories of third-party service providers, solely for the purposes described:

  • Google LLC (Google Analytics 4, Google Ads, Google Tag Manager, Remarketing): We share cookie identifiers, usage data, conversion events, and remarketing list membership. Google's privacy policy is available at policies.google.com/privacy.
  • Meta Platforms, Inc. (Meta Pixel, Custom Audiences, Lookalike Audiences, Conversion API): We share page view data, conversion events, audience membership, and hashed identifiers. Meta's privacy policy is available at facebook.com/privacy/policy.
  • Cloudflare, Inc. (CDN, security, and performance): Cloudflare processes IP addresses for threat detection and content delivery. Cloudflare's privacy policy is available at cloudflare.com/privacypolicy.

We do not sell personal data. These providers may not use data obtained from our Website for their own independent commercial purposes unrelated to the services they provide to us.

7. International Transfers

Some of our third-party service providers (notably Google and Meta) are based in the United States. When personal data is transferred outside the United Kingdom, we ensure adequate safeguards are in place through one or more of the following mechanisms:

  • UK Extension to the EU-US Data Privacy Framework (primary transfer mechanism since July 2023).
  • UK International Data Transfer Agreement (UK IDTA) as a fallback mechanism.
  • Standard Contractual Clauses (EU 2021/914) supplemented by the UK Addendum, as an additional fallback.

We regularly review the transfer mechanisms in place to ensure they remain valid and adequate under applicable UK data protection law.

8. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law:

  • Contact form submissions: 2 years from your last interaction with us.
  • Analytics data: 14 months (Google Analytics retention setting).
  • Marketing cookies: As per individual cookie lifetimes (typically 90 days for advertising cookies).
  • Email correspondence: Duration of the relationship plus 1 year.
  • Server logs: 90 days, then automatically purged.
  • Cookie consent records: 3 years (for audit and compliance purposes).
  • Legal and tax records: As required by law (typically 6–7 years for financial records under HMRC guidelines).

9. Your Rights Under UK GDPR

Under the UK GDPR and Data Protection Act 2018, you have the following rights in relation to your personal data:

  • Right of Access (Art. 15): You can request a copy of the personal data we hold about you.
  • Right to Rectification (Art. 16): You can request that we correct inaccurate or incomplete personal data.
  • Right to Erasure (Art. 17): You can request that we delete your personal data where there is no compelling reason for its continued processing.
  • Right to Restriction of Processing (Art. 18): You can request that we restrict the processing of your personal data in certain circumstances.
  • Right to Data Portability (Art. 20): You can request your personal data in a structured, commonly used, machine-readable format.
  • Right to Object (Art. 21): You can object to processing based on legitimate interests or for direct marketing purposes.
  • Right to Withdraw Consent (Art. 7(3)): Where processing is based on consent, you may withdraw that consent at any time.
  • Right to Lodge a Complaint (Art. 77): You have the right to lodge a complaint with the Information Commissioner's Office (ICO).

To exercise any of these rights, please email us at [email protected] with the subject line "Privacy Rights Request". We will respond within 30 calendar days. In complex cases, we may extend this period by a further 60 days, and we will inform you of any such extension within the initial 30-day period.

Lead Supervisory Authority: Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, United Kingdom — ico.org.uk.

10. Children's Privacy

This Website is not directed at individuals under 16 years of age. We do not knowingly collect personal data from minors. If we become aware that we have inadvertently collected personal data from a child under 16 without verifiable parental consent, we will take steps to delete that data promptly. If you believe a child has provided us with personal data, please contact us at [email protected].

11. Do Not Track Signals

This Website does not currently respond to "Do Not Track" (DNT) browser signals. There is no uniform standard for interpreting DNT signals, and the cookie consent mechanism we provide gives you direct control over non-essential tracking. Third-party providers (Google, Meta) may have their own DNT handling policies, which are detailed in their respective privacy policies linked in Section 6.

12. Account & Data Deletion

If you wish to have your personal data deleted from our systems, please email [email protected] with the subject line "Data Deletion Request". We will verify your identity and complete the deletion within 30 calendar days.

In limited circumstances, we may retain certain data where we are legally obligated to do so (for example, records required by HMRC or data necessary to comply with a court order). We will inform you if any such retention applies to your request.

13. Business Transfers

In the event of a merger, acquisition, asset sale, corporate restructuring, financing, or insolvency, personal data held by ChatGPT Trade Ltd may be transferred to a successor entity as part of the transaction. If such a transfer occurs and materially changes how your data is used, we will notify you via a prominent notice on the Website at least 14 days before the change takes effect, giving you the opportunity to exercise your rights under Section 9.

14. California Residents (CCPA / CPRA)

Although ChatGPT Trade Ltd is a UK-based company, we recognise that some visitors may access the Website from California. For the benefit of California residents, we disclose the following:

Categories of personal information disclosed in the past 12 months:

  • Identifiers (name, email, IP address, device identifiers) → disclosed to service providers and advertising partners.
  • Internet/network activity (browsing history, page interactions) → disclosed to analytics and advertising providers.
  • Inferences (interests, preferences derived from browsing patterns) → disclosed to advertising partners for audience targeting.

We do not sell personal information as defined by the CCPA. We do share certain data for cross-context behavioural advertising; California residents may opt out of this sharing via our cookie preferences panel accessible from the Website footer.

Your California rights: Right to Know, Right to Delete, Right to Correct, Right to Opt-Out of sale/sharing, and Right to Non-Discrimination.

To submit a request, email [email protected] with the subject line "California Privacy Request". Identity verification is required. Authorised agents may submit requests with written proof of authorisation.

15. Virginia Residents (VCDPA)

Virginia residents have the right to Access, Correct, Delete, obtain a Portable copy, and Opt-Out of targeted advertising under the Virginia Consumer Data Protection Act.

To submit a request, email [email protected] with the subject line "Virginia Privacy Request".

We do not sell personal data or engage in profiling that produces legal or similarly significant effects.

If you wish to appeal a refusal of a privacy request, email us with the subject line "Appeal of Refusal — Privacy Request". We will respond within 60 days. If the appeal is not resolved to your satisfaction, you may contact the Virginia Attorney General.

16. Nevada Residents

Nevada residents may submit a verified opt-out request by emailing [email protected] with the subject line "Nevada Do Not Sell Request". We do not currently sell personal information as defined under Nevada Revised Statutes Chapter 603A.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. Material changes will be announced via a prominent banner on the Website homepage at least 14 days before taking effect. The "Last Updated" date at the top of this page will be refreshed with every revision. We encourage you to review this policy periodically.

18. Contact Us

If you have any questions about this Privacy Policy, your personal data, or wish to exercise any of your rights, please contact us:

We aim to respond to all legitimate enquiries within 30 calendar days. Occasionally, it may take longer if your request is particularly complex or you have made multiple requests, in which case we will notify you and keep you updated on progress.