ChatGPT Ads are now live in the UK, and we're already seeing great results for our partners.

Legal

Privacy Policy

How GLOBALMEDIAGROUP LTD (trading as SCROll STOP) collects, uses and protects your personal data under the UK GDPR.

Last updated: 7 October 2026

This Privacy Policy explains how GLOBALMEDIAGROUP LTD (“we”, “us”, “our” or “SCROll STOP”) collects, uses, shares and protects your personal data when you visit our website at scrollstop.com (the “Site”), enquire about our services, apply to our Appointment Setter Program, sign up to our newsletter, work with us as a client, creator or partner, or otherwise interact with us.

This Privacy Policy is issued in accordance with the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (“PECR”).

Please read this Privacy Policy carefully. If you do not agree with it, please do not use our Site or services.

1. Who we are

GLOBALMEDIAGROUP LTD is a company registered in England and Wales under company number 13766827.

Registered office: 35 Endsleigh Gardens, Upton, Chester, United Kingdom, CH2 1LT.

We trade as “SCROll STOP”.

For the purposes of the UK GDPR, GLOBALMEDIAGROUP LTD is the “data controller” responsible for your personal data collected through this Site and our services.

2. How to contact us

If you have any questions about this Privacy Policy or how we handle your personal data, you can contact us:

  • By email: [email protected]
  • By post: GLOBALMEDIAGROUP LTD, 35 Endsleigh Gardens, Upton, Chester, United Kingdom, CH2 1LT

We are not required to appoint a Data Protection Officer under the UK GDPR, but the person responsible for data protection matters within our business can be contacted using the details above.

3. Personal data we collect

We collect and process the following categories of personal data:

3.1 Information you provide to us directly. When you contact us, request information, apply to our Appointment Setter Program, fill in a form on our Site, work with us, or correspond with us, we may collect:

  • Identity data, such as your full name, job title and company name;
  • Contact data, such as your email address, telephone number and postal address;
  • Professional data, such as your LinkedIn profile, role, industry, brands you work with and information you share about your experience or contacts;
  • Application data, such as the responses you provide in our Appointment Setter Program form (including monthly capacity, industries, services understood, acknowledgements and additional comments);
  • Content of communications, including emails, messages, application notes and any other information you choose to share with us;
  • Marketing preferences, such as whether you have opted in to receive our newsletter or other marketing communications;
  • Payment and tax data, such as bank details, billing address, VAT number and other information necessary to pay you (where you are a creator, supplier or partner) or to invoice you (where you are a client).

3.2 Information we collect automatically. When you visit our Site, we and our analytics and advertising partners may automatically collect:

  • Device and technical data, such as your IP address, browser type and version, operating system, device type and screen resolution;
  • Usage data, such as the pages you visit, the links you click, referring URLs, time spent on pages, and how you interact with content;
  • Cookie and tracking data, such as cookie identifiers, pixel data and similar identifiers (see section 9 for more detail).

3.3 Information from third parties. We may receive personal data about you from third parties, including:

  • Social media and professional platforms, such as LinkedIn, Instagram, TikTok and YouTube, where you interact with us publicly or send us a message;
  • Advertising measurement from OpenAI, only if you allow advertising cookies. We do not use Google AdSense, Google Analytics or a Meta pixel;
  • Booking tools, namely Cal.com and Google Calendar, when you book a call with us, or when someone such as an appointment setter or partner books one for you. They send us the booking details, such as your name, email address, company, website, phone number, your answers to the booking questions and any referral or campaign codes in the booking link;
  • Business partners, brands, creators or referrers who introduce you to us;
  • Publicly available sources, such as company websites and Companies House.

We do not knowingly collect any “special category” personal data (such as data revealing health, race, religion or sexual orientation). Please do not send us such information.

4. How we use your personal data and our lawful bases

We will only use your personal data when the law allows us to. Under the UK GDPR, we rely on the following lawful bases:

  • Consent: where you have given us clear consent for a specific purpose (for example, marketing emails or advertising cookies). Advertising cookies stay off until you accept them.
  • Contract: where processing is necessary for the performance of a contract with you, or to take steps at your request before entering into a contract (for example, providing our services or onboarding you as a partner).
  • Legal obligation: where processing is necessary to comply with our legal or regulatory obligations (for example, tax, accounting and anti-fraud requirements).
  • Legitimate interests: where processing is necessary for our legitimate interests (or those of a third party) and these are not overridden by your interests, rights or freedoms.

We use your personal data for the following purposes:

  • Responding to enquiries and providing requested information. Lawful basis: legitimate interests (responding to people who contact us) and, where applicable, steps prior to entering into a contract.
  • Managing our Appointment Setter Program. Lawful basis: steps prior to entering into a contract, legitimate interests (assessing suitability of applicants) and, where relevant, performance of a contract.
  • Providing our marketing, creator and agency services to clients, brands and creators. Lawful basis: performance of a contract and legitimate interests in operating our business.
  • Preparing proposals and quotes for prospective clients, including using AI tools to draft proposal content from the details you give us, our meeting notes and call transcripts, and keeping records of quotes and how they were viewed. Lawful basis: legitimate interests (preparing accurate proposals and managing our sales process) and taking steps at your request before entering into a contract.
  • Paying creators, partners and suppliers and invoicing clients. Lawful basis: performance of a contract and legal obligation.
  • Sending you our newsletter and marketing communications where you have opted in. Lawful basis: consent (you can withdraw this at any time).
  • Sending you direct marketing about similar services where you are an existing or prospective business contact. Lawful basis: legitimate interests, subject to your right to opt out at any time.
  • Running and securing our Site, including strictly necessary cookies. Lawful basis: legitimate interests (keeping the Site working and safe). Counting visits and popular pages with our website host's analytics so we can improve the Site, unless you switch it off. Lawful basis: legitimate interests (improving our Site), and you can object at any time in Cookie settings. Measuring our ads with the OpenAI pixel, only where you accept advertising cookies. Lawful basis: consent.
  • Preventing fraud, misuse of our Site, and enforcing our terms. Lawful basis: legitimate interests and legal obligation.
  • Complying with legal, regulatory and tax obligations and responding to lawful requests from authorities. Lawful basis: legal obligation.
  • Establishing, exercising or defending legal claims. Lawful basis: legitimate interests and legal obligation.

5. Marketing communications

5.1 We may send you marketing emails about our services where you have given us consent (for example, by subscribing to our newsletter) or where we are otherwise permitted under PECR (for example, where you are an existing business contact and we are promoting similar services).

5.2 You can opt out of marketing communications at any time by clicking the “unsubscribe” link in any marketing email we send you, or by contacting us at [email protected]. Opting out of marketing does not affect service or transactional communications (for example, replies to enquiries or messages about an active engagement).

6. Who we share your personal data with

We will never sell your personal data. We may share your personal data with the following categories of recipient:

  • Our staff, contractors and group companies, on a need-to-know basis to provide and manage our services.
  • Service providers who process personal data for us on our instructions, including: Lovable (website building, hosting, email delivery and site analytics); Supabase (the database and file storage behind our forms, quotes and accounts); Cloudflare (network delivery and security); Google (business email, calendar and booking pages, meeting notes, and the company logo images shown on quote pages); OpenAI (AI tools we use to prepare proposals from enquiry details, meeting notes and call transcripts); monday.com (customer relationship management); Canva (proposal design); Cal.com (booking pages); and payment, accounting and bookkeeping providers and professional advisers (lawyers, accountants and auditors).
  • Brands, clients, creators and partners, where this is necessary to deliver a campaign, introduction or service that you have asked us to facilitate.
  • OpenAI, for advertising measurement, only where you accept advertising cookies. The OpenAI pixel can send a hashed (scrambled) copy of an email address or phone number you type into a form on our Site, so OpenAI can match your enquiry to our ad, and our server tells OpenAI that an enquiry was made (the time and the page, not your name or contact details).
  • Cal.com and Google Calendar, when you book a call through one of their booking pages. They process the booking for us and send the booking details back to us.
  • Regulators, law enforcement and other authorities where we are required or permitted by law to share information.
  • Acquirers, investors and their advisers in the event of a sale, restructuring, merger or other corporate transaction.

We require all third-party processors to respect the security of your personal data and to treat it in accordance with the law. They are only permitted to process your personal data for specified purposes and in accordance with our instructions.

7. International transfers

Some of our service providers are based outside the United Kingdom, so processing of your personal data may involve a transfer of data outside the UK.

Whenever we transfer your personal data out of the UK, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:

  • We will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data by the UK government; or
  • Where we use providers based outside the UK, we may use the UK’s International Data Transfer Agreement (IDTA) or the EU Standard Contractual Clauses together with the UK Addendum, and apply any additional measures required.

The providers named in section 6 that may process personal data outside the UK are Lovable, Supabase, Cloudflare, Google, OpenAI, monday.com, Canva and Cal.com, mainly in the European Economic Area and the United States. For each transfer we rely on one of these safeguards: UK adequacy regulations (for example for the European Economic Area); the UK Extension to the EU-US Data Privacy Framework, where the provider is certified to it; or the UK International Data Transfer Agreement, or the EU Standard Contractual Clauses with the UK Addendum, in the provider's data processing terms. You can ask us which safeguard applies to any provider, and for a copy of it, using the details in section 2.

You can contact us using the details in section 2 for more information about the specific safeguards in place for any transfer.

8. How long we keep your personal data

We will only retain your personal data for as long as necessary to fulfil the purposes for which we collected it, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements.

As a general rule, we retain personal data collected through our Site (including contact forms, Appointment Setter Program applications, newsletter sign-ups and user accounts) for 3 years from your last interaction with us, unless a longer retention period is required or permitted by law (for example, financial records that we are required to keep for 6 years under UK tax law).

Quote and proposal records, and the engagement and tracking data for a quote (described in section 2 of our Client Terms at scrollstop.com/terms), are kept for 7 years. If a contract is signed, the 7 years run from the end of the contract. If a quote is never signed, the 7 years run from the date we sent the quote. We keep these records for that long so we have a record of the offers we made and how they were handled, can deal with any question or dispute about whether, when and on what terms a contract was formed, and can bring or defend a legal claim within the 6 year limitation period for contract claims in England and Wales, plus a short margin. Lawful basis: legitimate interests (keeping accurate business records and establishing, exercising or defending legal claims). This 7 year period applies to these records instead of the general 3 year period above. Once a quote has expired or a contract has ended, we only use these records for the purposes in this paragraph.

When we no longer need your personal data, we will securely delete or anonymise it.

9. Cookies and similar technologies

Cookies are small files saved on your device. We also use similar technologies, such as local storage, session storage and pixels. In this section we call them all cookies.

Strictly necessary cookies are always on, because the Site cannot work properly or securely without them. Site analytics is on unless you switch it off. Advertising cookies stay off until you accept them. Reject all and Accept all are both on the first layer of our banner, and you can change your choice at any time from Cookie settings in the footer of any page, or in the admin menu if you have a staff account.

We use these cookies:

  • Strictly necessary: ss_cookie_consent (local storage, SCROll STOP). Remembers your cookie choices. Kept for 12 months, then we ask you again.
  • Strictly necessary: __cf_bm (cookie, Cloudflare, our hosting network). Tells people and bots apart to protect the Site. Lasts 30 minutes.
  • Strictly necessary: __dpl (cookie, Lovable, our website host). Keeps your visit on the same version of the Site while we publish an update. Lasts 24 hours.
  • Strictly necessary: sb-...-auth-token (local storage, Supabase, our database provider). Keeps you signed in. Only set if you log in to an account, and removed when you sign out.
  • Strictly necessary: tsr-scroll-restoration (session storage, SCROll STOP). Remembers your place on a page when you go back. Deleted when you close the tab.
  • Contract platform only: ss_quote_session (session storage, SCROll STOP). Groups your visit to a quote page, and is only set after you tick the box on that page. Deleted when you close the tab. Section 2 of our Client Terms explains this.
  • Site analytics: session-id (cookie, Lovable, our website host). Groups your page views into one visit so we can count visits and see which pages work. Lasts 30 minutes. On unless you switch it off.
  • Advertising, only if you accept: __obref (cookie, OpenAI). A random browser reference used to measure our ChatGPT ads. Lasts up to 12 months.
  • Advertising, only if you accept: __oppref (cookie, OpenAI). Stores the ad click reference if you arrived from one of our ChatGPT ads. Lasts up to 30 days.
  • Advertising, only if you accept: oaiq_consent and oaiq_cs (local storage and session storage, OpenAI). The pixel's record of your choice and of your current visit. Kept until you clear your browser storage, or until you close the tab.
  • Advertising, only if you accept: __cf_bm on OpenAI's servers (cookie, Cloudflare for OpenAI). Bot protection on OpenAI's servers. Lasts 30 minutes.

Site analytics. Our website host, Lovable, provides built-in analytics. When you view a page it records the page address, the referring site, your browser and device type, your language setting and an approximate country worked out from your time zone, and it sets a session-id cookie for 30 minutes so the pages you view in one visit are counted together. We only use this to see, in total, how many people visit, which pages they view and where they come from, so we can improve the Site. We do not use it to identify you, to build a profile of you or for advertising. Analytics data is processed by our hosting and platform provider (Lovable) under its data processing agreement. Because this analytics is used only to improve our Site, we do not need your consent for it under the Privacy and Electronic Communications Regulations, but you can object at any time, free of charge: open Cookie settings and switch off Site analytics, or click Reject all on the banner. The analytics script then stops on that device and the session-id cookie is deleted.

Advertising. If you accept advertising cookies, we load the OpenAI measurement pixel to see whether people who click our ads in ChatGPT go on to contact us. If you then fill in a form on our Site, the pixel can detect your email address or phone number and send a hashed (scrambled) copy of it to OpenAI to match your visit to our ad. Your details are not sent in readable form this way. When you submit a form, our server also tells OpenAI that an enquiry was made (the time and the page, not your name or contact details), and it only does this if you have accepted advertising cookies. If you do not accept, none of this happens.

We do not use Google AdSense, Google Analytics, a Meta pixel or DoubleClick tags. Our fonts are served from our own Site, so loading a page does not request fonts from Google. Some images and videos are delivered from other servers, such as content delivery networks. That shares your IP address with the server so it can send the file, but those requests do not set cookies.

Booking a call opens Cal.com or Google Calendar in a new tab. We do not embed either on our Site, so their cookies are set on their own sites, not on ours.

Changing your choice. Open Cookie settings at any time. Turning advertising off deletes the OpenAI cookies we can delete and reloads the page. Switching site analytics off stops the analytics script on that device and deletes the session-id cookie. You can also delete or block cookies in your browser settings, but please use Cookie settings as well, because we cannot read your browser settings as a choice. We ask you again after 12 months, or sooner if we change the cookies we use.

10. Your rights under the UK GDPR

Under the UK GDPR, you have the following rights in relation to your personal data:

  • Right of access: to request a copy of the personal data we hold about you.
  • Right to rectification: to ask us to correct inaccurate or incomplete personal data.
  • Right to erasure: to ask us to delete your personal data in certain circumstances.
  • Right to restriction of processing: to ask us to suspend the processing of your personal data in certain circumstances.
  • Right to object: to object to our processing of your personal data where we rely on legitimate interests, and to object to direct marketing at any time.
  • Right to data portability: to receive your personal data in a structured, commonly used and machine-readable format, in certain circumstances.
  • Right to withdraw consent: where we rely on your consent, you can withdraw it at any time (this does not affect the lawfulness of processing carried out before withdrawal).
  • Rights relating to automated decision-making: we do not currently make decisions based solely on automated processing that produce legal or similarly significant effects.

To exercise any of these rights, please contact us at [email protected]. We may need to verify your identity before responding. We aim to respond to all valid requests within one month.

You also have the right to lodge a complaint with the Information Commissioner’s Office (“ICO”), the UK’s data protection regulator, at any time. We would, however, appreciate the chance to deal with your concerns before you approach the ICO. The ICO can be contacted at ico.org.uk or on 0303 123 1113.

11. Security

We have put in place appropriate technical and organisational measures to protect your personal data against accidental loss, unauthorised access, alteration or disclosure. Access to your personal data is limited to those staff, contractors and third parties who have a legitimate business need to know.

We have procedures in place to deal with any suspected personal data breach and will notify you and the ICO where we are legally required to do so.

While we take reasonable steps to protect your personal data, no method of transmission over the internet or method of electronic storage is 100% secure, and we cannot guarantee absolute security.

12. Third-party links

Our Site may contain links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. We encourage you to read the privacy notice of every website you visit.

13. Children

Our Site and services are not directed at children under the age of 16. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us so that we can take appropriate steps to delete it.

14. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements or for other operational reasons. The updated version will be indicated by an updated “Last updated” date at the top of this page.

We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your personal data.