Privacy Policy
Last updated 12 August 2026
This policy covers gocis.co.uk. It describes what this site actually does, checked against the code that serves it rather than written from a template, so that you can tell what happens when you read a page, fill in a form or press a button on the cookie banner.
Who we are
GoCIS (gocis.co.uk) is CIS scheme accounting for UK construction trades. It is operated by SideQuester, which is the data controller for the personal information described on this page.
You can reach us about anything in this policy at hello@gocis.co.uk, or by post at 40 Bowling Green Lane, London, EC1R 0NE, United Kingdom.
What we collect
Your enquiry. When you fill in a form on this site we receive the fields you complete, typically your name, email address, phone number, company name and your message, together with the address of the page you sent it from. If the form asked you multiple-choice questions first, your answers are stored alongside the message. It is sent to our backend at xyfa-9qn6-4vhk.n7.xano.io/submit_contact.
Analytics, but only if you say yes. This site uses Google Analytics 4 (property G-QSJR0WHN22). It is loaded under Google Consent Mode v2 with every advertising and analytics signal set to denied before you choose. Until you press Accept, Google Analytics sets no cookies and records no page view. If you press Reject, it stays that way.
Request logs. Every request to this site is classified as a human visitor, a search crawler or an AI crawler. We record the hostname, the path, the browser or bot user-agent string, the country the request came from, the network operator (ASN) and the referring page. We do not record your IP address in that log. We keep it to understand which search engines and AI assistants read our pages.
Why we use it, and our lawful basis
| What we do | What that uses | Our lawful basis |
|---|---|---|
| Answering your enquiry and, if you become a client, working with you | Your name, contact details and message | Taking steps at your request before entering a contract, and our legitimate interest in responding to people who contact us |
| Understanding which pages are read and which are not | Google Analytics measurement data | Your consent, given through the cookie banner and withdrawable at any time |
| Keeping the site up and defending it from abuse | Request metadata, user-agent, country, ASN, referrer | Our legitimate interest in the security and availability of our own site |
| Seeing which search engines and AI assistants read our pages | Crawler classification counts, with no IP address | Our legitimate interest in knowing how our content is found |
Cookies and what is stored on your device
This site sets no cookies of its own. There is no session cookie, no preference cookie and no first-party tracking cookie. You can check that: nothing we serve returns a Set-Cookie header.
Your answer to the cookie banner is not stored in a cookie either. It is written to your browser's localStorage under the key bxc, as a small record of the date and whether you accepted analytics and marketing. It never leaves your browser, and clearing your site data removes it and brings the banner back.
If you press Accept, Google Analytics then sets its own cookies (_ga and _ga_<id>) to tell repeat visits apart. If you press Reject, it does not. To change your mind later, clear this site's data in your browser and the banner will ask again.
Fonts are the one thing that loads before you choose. Our pages use Google Fonts, which are requested from Google's servers as the page renders. Google receives your IP address and browser details in order to serve the font file. Google Fonts does not set a cookie, but the request happens before any consent choice, and we would rather tell you than leave it out.
Who else touches your data
| Who | What they do for us | Where |
|---|---|---|
| Cloudflare | Hosting, CDN, DNS and security for this site. Every request passes through it. | Global, including outside the UK |
| Xano | Our application backend and database, at xyfa-9qn6-4vhk.n7.xano.io. Enquiries and any account data are stored here. | Council Bluffs, Iowa, United States |
| Google (Analytics) | Measurement of page views and traffic sources. | United States and elsewhere |
| Google (Fonts) | Serves the web fonts used by our pages. Receives your IP address when a page loads. | United States and elsewhere |
Enquiries from this site are stored in our database and notified to us by email. They are not pushed to any third-party sales or chat tool.
We do not sell your personal information, and we do not share it for advertising. We do not use it to train AI models, and we do not pass enquiries to unrelated third parties. If we ever introduce you to a partner firm, we will ask you first.
Sending data outside the UK
Our backend is hosted by Xano. That service resolves to 35.193.186.65, which is Google Cloud infrastructure in Council Bluffs, Iowa, United States. So the enquiries and account data described above are stored in the United States, not the United Kingdom. Cloudflare, Google and the other processors listed above also operate outside the UK.
These are restricted transfers under UK GDPR. We rely on the UK International Data Transfer Agreement, or the EU Standard Contractual Clauses together with the UK Addendum, in our contracts with those providers, and on the technical measures they apply, principally encryption in transit and at rest. Ask us and we will tell you which mechanism covers a particular provider.
How long we keep it
Enquiries. We keep them while we are in contact with you and afterwards as a record of what was discussed. If you ask us to delete your enquiry, we delete it, and that is the fastest way to have it gone.
Request and crawler logs. Individual hits are aggregated into daily per-site counts, which is what we actually look at. Those counts contain no personal information.
Analytics. Held by Google under the retention period set on the property, and only ever collected if you consented to it.
We would rather say this plainly than quote a number we do not enforce: we do not yet run an automated deletion job over old enquiries. Ask us to delete yours and we will, and we are working on making that automatic.
AI assistants, crawlers and this site
This site is built to be readable by AI assistants as well as by people, so it is worth being clear about what that does and does not involve.
Every page is available to assistants through a small server at https://gocis.co.uk/_mcp. Its tools let an assistant list our pages, read them, and look up our business details. One tool, submit_lead, lets an assistant send us an enquiry on your behalf. If you ask an AI assistant to contact us and it uses that tool, the enquiry reaches us exactly as if you had typed it into the form, and is handled the same way. An assistant should confirm with you before sending it.
We log that a tool was called, and which one, so we can see how often assistants use the site. We deliberately do not log the arguments passed to those tools. Where we count unique callers, we do it with a salted hash of the request that is regenerated daily and cannot be reversed to an IP address, and if that salt is not configured we simply do not count them.
Our robots.txt tells crawlers that our content may be used for search and for grounding AI answers, and may not be used to train models. That is a declaration, and honest crawlers respect it.
Your rights
Under UK GDPR you can ask us to give you a copy of the personal information we hold about you, correct it if it is wrong, delete it, restrict what we do with it, or send it to you in a portable format. You can object to our processing where we rely on legitimate interests, and you can withdraw consent for analytics at any time by clearing this site's data in your browser.
Write to hello@gocis.co.uk and we will answer within one month. There is no charge. We may ask you to confirm your identity first, which for an enquiry usually just means replying from the address you used.
If you are not happy with how we have handled it, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would rather you told us first so we can put it right.
Changes to this policy
This version is dated 12 August 2026. If we change how we handle personal information, we update this page and change that date. If a change is significant, we will say so on the page rather than expect you to spot it.