Who is responsible
The controller is Jordan Kraev, self-employed and trading as Kraev & Co, operating the Citemark brand from 67 Kentlea Road, London, SW9 0EF, United Kingdom. Contact privacy@citemark.co.uk or telephone 07593 116387.
Free scan and enquiries
When you run a scan, Citemark processes the submitted website, optional business name and town, the technical scan results, a keyed pseudonymous token derived from the requesting network address for abuse prevention, and the time of the request. Citemark does not retain the address itself in the scan record. The score and top findings do not require an email. If you unlock the complete findings, Citemark stores the work email and your request to be contacted about that result.
For other enquiries Citemark may store your name, work email, company, website, campaign page, optional competitors and your message. The purposes are to deliver what you requested, prevent misuse, respond to you and, where appropriate, take steps before entering a contract. The usual lawful bases are legitimate interests, steps at your request before a contract, and contract where you become a client.
Business prospect information
Citemark may use limited information about relevant UK businesses and professional contacts for targeted B2B outreach. Sources may include Companies House, public business listings, a business’s own website and relevant trade directories. Information may include the business name, company status and number where applicable, public business address, website, business telephone, published professional contact details, business role, technical observations about the public website and the source and date collected.
Where a named business email is not published, Citemark may derive a likely work address from a published professional name and the organisation’s own domain, then verify deliverability before use. Citemark does not buy marketing lists or scrape LinkedIn for contact databases.
The lawful basis for limited, relevant B2B prospecting is legitimate interests. Electronic mail is restricted to businesses confirmed as corporate subscribers unless another valid basis applies. Individuals may object at any time by replying “unsubscribe” or emailing privacy@citemark.co.uk. Objections are placed on a suppression list so the request can be respected.
Telephone outreach
Business telephone numbers must be screened against applicable TPS and CTPS records before marketing calls. Citemark identifies itself, presents caller ID, does not use automated recorded calls and records do-not-call requests.
Clients and payments
For clients, Citemark processes contact, order, project-intake, scope, billing, website-access and delivery information to perform the contract, keep accounting records and protect legal rights. Intake details are matched manually to the checkout email before work starts. Do not submit passwords through the website or email. Stripe processes card information; Citemark does not receive complete card numbers. Cal.com processes information you submit when booking a call.
Service providers and transfers
The website and scan records use Cloudflare infrastructure. Cal.com provides scheduling, Stripe provides payments and Resend delivers transactional email. Email and mailbox providers process messages sent to and from Citemark. Some providers may process information outside the UK. Where a restricted transfer occurs, Citemark relies on applicable UK adequacy regulations or the provider's contract incorporating an ICO-approved UK International Data Transfer Agreement or UK Addendum, as appropriate. You may ask for a description of the relevant safeguard. Citemark does not sell personal information.
Retention
Ungated scan records are automatically deleted after 90 days. Unlocked scan, enquiry and project-intake records are automatically deleted after 24 months unless an active client relationship or legal requirement means a separate record must be retained. Prospect records are reviewed or deleted within 12 months unless a conversation, objection or business relationship requires retention. Suppression records are kept as long as necessary to respect the objection. Client and accounting records may be retained for up to six years after the relevant financial period.
Security
Citemark limits administrative access, uses encrypted connections, one-time administrative login codes, abuse controls, provider multi-factor authentication where available, device security and access revocation when a provider or client relationship ends. No internet service can promise absolute security.
Your rights
Depending on the circumstances, you may ask for access, correction, deletion, restriction or transfer of your information and may object to direct marketing at any time. Email privacy@citemark.co.uk. You may also complain to the UK Information Commissioner’s Office at ico.org.uk.
Cookies and analytics
Citemark currently does not use advertising cookies. Essential hosting and security functions may process technical request data. If optional analytics or embedded tools that require consent are added, this notice and the consent mechanism will be updated before they are enabled.