Who we are
This policy explains how ITGeeks ("ITGeeks", "we", "us") handles personal data collected through www.itgeeks.com (the "site"). ITGeeks is a Shopify and Shopify Plus agency headquartered in Salt Lake City, Utah, USA, with offices in the United Kingdom, Canada and India.
For the personal data described here we decide why and how it is processed, which makes us its controller (or "business" under US state law, or "data fiduciary" under India's Digital Personal Data Protection Act). You can reach us about anything in this policy at sales@itgeeks.com or on +1-385-240-2913.
This policy does not cover data we process on behalf of clients during a project (for example their customers’ data in a Shopify store). That is governed by our agreement with the client, and the client’s own privacy notice.
Information you give us
You only give us personal data through the site when you fill in one of its forms. Each form collects the following:
| Form | What it collects | Where it goes |
|---|---|---|
| Book a meeting | First and last name, work email, company, phone, country, the service you are interested in and your answers about the project (for example current platform, website address, timeline, catalogue size), and your budget. Whether you booked a time or asked us to email you instead. | HubSpot (our CRM), an email to our sales team, and a stored copy. The meeting itself is booked in HubSpot Meetings, which shows in the page. |
| Get a quote | Name, email, phone, business name, website, whether you are on Shopify Plus, the service you need, budget and your message. | HubSpot, an email to our sales team, and a stored copy. |
| Contact | First and last name, email, the topic and your message. | HubSpot, an email to our sales team, and a stored copy. |
| Careers application | First and last name, email, phone, the role, years of experience, LinkedIn profile address, location, how you heard about us, your CV or résumé file (PDF or Word .docx, up to 3 MB) and an optional cover note. | An email with your CV attached to our careers inbox. Your details and application summary (not the file) also go to HubSpot and to a stored copy. |
| Newsletter | Your email address. | HubSpot, which also sends the newsletter, and a stored copy. |
With every form we also record the page you sent it from, the page address and title, and the attribution details described below, so we know which page and campaign led to the enquiry. If HubSpot’s tracking cookie is present (only when analytics is allowed), its identifier is sent too, which lets HubSpot connect the enquiry with your earlier visits.
Every form is sent first to our own server functions (hosted by Vercel), which check it and pass it on. Emails reach our inboxes through Google Workspace. The stored copy is kept in a database run by Upstash so that no submission is lost if HubSpot or email is briefly unavailable. Before a form is accepted, Cloudflare Turnstile checks that it is being sent by a person rather than an automated script, and your IP address is used to limit repeated submissions.
Please do not include sensitive information (for example health details) in a message or a CV. If you do, we use it only to consider your enquiry or application.
Information collected automatically
How you found us (attribution)
When you arrive we note how you got here: campaign tags in the link (utm_source, utm_medium, utm_campaign, utm_term, utm_id), advertising click identifiers (gclid, gbraid, wbraid, fbclid, msclkid, li_fat_id, ttclid), the domain of the site that referred you, the page you landed on and when. We keep the first visit and the most recent campaign or referral visit, and each expires after 90 days.
This is held in your browser’s memory for the visit and attached to any form you choose to send. It is saved in your browser’s local storage, so it carries over to later visits, only if you allow functional or analytics storage. It is deleted from your browser if you later turn both off.
Your country and time zone
To decide whether to ask for cookie consent before anything loads, the site reads your device’s time zone in your browser. It is not sent to us. When you open the Book a meeting page, our host, Vercel, works out your country from your IP address and returns it to the page, which uses it to decide whether the booking form is offered in your region. We do not store it.
Server and security logs
Like any website, the servers that deliver the site (Vercel) process your IP address, browser type and the pages requested in order to deliver them, keep them secure and diagnose faults. When you send a form, your IP address is also counted for a few minutes (in Upstash) to limit repeated submissions, and passed to HubSpot with the submission.
Analytics and advertising tools
If allowed (see Cookies below), the site loads Google Tag Manager, Google Analytics 4 and Microsoft Clarity to understand how the site is used, and the Meta Pixel and LinkedIn Insight Tag to measure and target our advertising. These tools collect information such as the pages you view, clicks, scrolling and mouse movement (Clarity can replay a visit as a recording; it masks what you type into forms by default), your device and browser, an approximate location derived from your IP address, and identifiers stored in cookies. Tags we add through Google Tag Manager load under the same consent category as Tag Manager itself.
Embedded content
The booking page shows a HubSpot Meetings calendar, and some videos may be served from Shopify’s content delivery network. Loading these sends your IP address and browser details to HubSpot or Shopify, and HubSpot may set its own cookies inside the calendar frame.
Cookies and similar storage
We sort cookies and browser storage into four groups. Strictly necessary storage is always on. The others are optional:
- Functional: remembers how you first found us across visits (the attribution above).
- Analytics: Google Tag Manager, Google Analytics 4, Microsoft Clarity and, where Tag Manager carries it, HubSpot’s tracking code.
- Marketing: the Meta Pixel, the LinkedIn Insight Tag and Google’s advertising signals (Google Consent Mode).
In the European Union, the European Economic Area, the United Kingdom and Switzerland, and wherever your browser does not tell us its region, nothing optional loads until you choose on the banner. Elsewhere, including the United States and India, analytics and marketing are on by default and you can turn them off at any time; if your browser sends a Global Privacy Control signal there, we treat it as turning them off.
| Name | Set by | Purpose | Group | Typical duration |
|---|---|---|---|---|
| itg.consent, itg.consent.answered (local storage) | ITGeeks | Remembers your cookie choice | Strictly necessary | Until you change it |
| itg.subscribe (local storage) | ITGeeks | Remembers that you closed or answered the newsletter popup | Strictly necessary | 7 days after closing; kept once you subscribe |
| itg:stale-reload, itg.consent.reloaded (session storage) | ITGeeks | Recover from an outdated page; confirm a change of cookie choice | Strictly necessary | Until the tab is closed |
| itg.attribution (local storage) | ITGeeks | How you first and last found us | Functional | 90 days |
| _ga, _ga_*, _gid | Google Analytics | Distinguish visitors and sessions | Analytics | Up to 2 years |
| _clck, _clsk, CLID | Microsoft Clarity | Session analytics and recordings | Analytics | Up to 1 year |
| hubspotutk, __hstc, __hssc, __hssrc | HubSpot | Connect visits with enquiries | Analytics | Up to 6 months |
| _gcl_* | Google Ads | Link ad clicks to enquiries | Marketing | 90 days |
| _fbp, _fbc | Meta | Ad measurement and audiences | Marketing | 90 days |
| li_fat_id, li_sugr, lidc, bcookie, AnalyticsSyncHistory, UserMatchHistory | Ad measurement and audiences | Marketing | Up to 1 year |
You can change your choice at any time on the Cookie settings page, linked from the foot of every page. When you turn a group off we stop its tools, tell the vendors that support it (Google, Meta, Microsoft), delete the cookies those tools set on our domain and reload the page so nothing already running continues. Cookies a vendor sets on its own domain can only be removed in your browser settings.
How we use it, and our legal bases
Where the UK or EU GDPR applies, we rely on the following legal bases:
| Purpose | Legal basis |
|---|---|
| Replying to enquiries, preparing quotes and arranging meetings | Steps you ask us to take before a possible contract; otherwise our legitimate interest in answering business enquiries |
| Assessing job applications | Steps you ask us to take before a possible employment contract; our legitimate interest in recruiting |
| Sending the newsletter | Your consent, which you can withdraw with the unsubscribe link in every email |
| Optional cookies: functional, analytics and marketing | Your consent |
| Recording how an enquiry reached us (in memory, attached to the form you send) | Our legitimate interest in knowing which pages and campaigns work |
| Keeping the site and forms secure, preventing spam and abuse | Our legitimate interest in a secure, working site |
| Keeping records we are required to keep, and handling legal claims | Legal obligation; our legitimate interest in establishing or defending claims |
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Booking requests are routed to a member of our sales team by the service and budget you choose; a person handles every enquiry and application.
International transfers
We and our providers operate in several countries, chiefly the United States and India, so your data may be processed outside the country where you live, including outside the UK and the European Economic Area. Where the law requires it, we rely on adequacy decisions (including the EU-US Data Privacy Framework and its UK extension, where the provider is certified), the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum. You can ask us for details of the safeguard used for a particular transfer.
How long we keep it
We keep personal data only as long as we need it for the purpose it was collected for, and then delete or anonymise it. In practice:
- Enquiries and booking requests: while we are in discussion or working with you, and for a limited period afterwards for follow-up and our records.
- Job applications and CVs: for the recruitment process you applied to and a limited period afterwards in case a suitable role opens, unless you ask us to delete them sooner.
- Newsletter subscriptions: until you unsubscribe.
- Backup copies of form submissions: only as long as needed to make sure each submission is delivered.
- Attribution in your browser: 90 days, or until you clear it or withdraw consent.
- Cookies: as listed in the cookie table above.
We may keep some information longer where the law requires it or to deal with a legal claim.
Your rights
Everyone
You can change your cookie choices at any time on the Cookie settings page, and unsubscribe from the newsletter with the link in any email. For anything else, write to sales@itgeeks.com. We will need to confirm your identity before acting on a request, and we will reply within the time the law allows (one month under the GDPR, 45 days under US state laws). We will not treat you differently for using your rights.
UK, EU, EEA and Switzerland
You have the right to access your personal data; to have it corrected or erased; to restrict or object to how we use it (including an absolute right to object to direct marketing); to data portability; and, where we rely on consent, to withdraw it at any time without affecting what was done before. You can also complain to a data protection authority: in the UK the Information Commissioner’s Office (ico.org.uk), in the EU the authority where you live or work, though we would appreciate the chance to resolve it first.
California and other US states
If you live in California, Colorado, Connecticut, Virginia, Texas, Oregon or another state with a comprehensive privacy law, you can ask to know what personal information we hold about you and how it is used and disclosed, to receive a copy, to have it corrected or deleted, and to opt out of the "sale" or "sharing" of your personal information for targeted (cross-context behavioural) advertising.
To opt out, turn off Marketing on the Cookie settings page, or turn on Global Privacy Control in your browser: we honour a GPC signal as an opt-out for that browser. In the last 12 months we have collected identifiers (name, email, phone, IP address, cookie identifiers), professional or employment information (company, role, CV), internet activity (pages viewed, interactions, referral source) and approximate location (country), from you and from your device, for the purposes described above. We do not use sensitive personal information to infer characteristics about you, and we do not knowingly sell or share the personal information of anyone under 16. You may use an authorised agent to make a request; we may ask them for proof of your authorisation.
India
Under the Digital Personal Data Protection Act, 2023 you may ask for a summary of the personal data we process about you and with whom it has been shared, ask us to correct, complete, update or erase it, withdraw consent you have given, nominate another person to exercise your rights in the event of death or incapacity, and raise a grievance with us at sales@itgeeks.com. If you are not satisfied with our response, you may complain to the Data Protection Board of India.
Children
The site is meant for businesses and job seekers. It is not directed at children, and we do not knowingly collect personal data from anyone under 18. If you believe a child has sent us personal data, contact us and we will delete it.
Security
The site is served only over HTTPS, forms are checked for spam and limited against repeated submissions, and access to enquiries and applications is limited to the people who need it. No system is perfectly secure, so please do not send us anything you would not want to share by email.
Changes to this policy
We will update this policy when what we do changes, and change the date at the top. If a change is significant we will make it prominent on the site, and ask for consent again where the law requires it.
Contact us
Questions, requests and complaints about privacy: sales@itgeeks.com (please put "Privacy" in the subject line), or call +1-385-240-2913.