Privacy Policy

Data we collect

We collect personal data in two ways: information you submit deliberately through a form, and limited technical information collected automatically when you browse.

• Contact form: your name, email address, optional phone number, the type of organisation you represent, the service you are interested in, and your message.
• Proposal or quote request: the above, plus your organisation name, budget range where you choose to give one, your timeline, and your project description.
• Training enquiry: your name, email address, optional phone number, the programme you are interested in, and your preferred schedule.
• Newsletter signup: your email address only.
• Automatically: your IP address, browser user agent and referring page. The IP address is used transiently for rate limiting and bot mitigation on form submissions.

Why we collect it

We do not sell personal data. We do not use enquiry data for advertising, and we do not add people who submit an enquiry to the newsletter list — that requires a separate, deliberate signup.

• To respond to your enquiry — this is the sole purpose for which contact, proposal and training form data is used.
• To send you the confirmation email acknowledging your submission.
• To send newsletter emails, where you have specifically asked us to.
• To protect the site from spam and automated abuse.
• To understand aggregate site usage, so we can improve the pages people struggle with.

Legal basis

• Responding to your enquiry: our legitimate interest in answering a message you sent us, and steps taken at your request prior to entering a contract.
• Newsletter emails: your consent, which you may withdraw at any time using the unsubscribe link in any email.
• Spam protection and site security: our legitimate interest in keeping the site available and usable.

Processors we use

We use third-party services to operate this site. Each acts as a processor on our behalf and is bound by its own agreement with us.

• Hosting and content delivery — serves this website and processes request metadata including IP addresses.
• Transactional email — delivers your confirmation email and our internal notification.
• Bot mitigation — assesses form submissions to distinguish people from automated traffic.
• Analytics — produces aggregate usage statistics.
• Internal team notification — alerts our team that a new enquiry has arrived.
• [TBC — confirm and name each provider before launch, together with its hosting region, to satisfy the transparency requirement.]

International transfers

We are a remote-first company and our providers operate internationally, so your data may be processed outside your country of residence. Where that happens we rely on the transfer mechanisms offered by the provider concerned.

[TBC — confirm the processing regions of each provider and the specific transfer mechanism relied upon.]

How long we keep it

We keep enquiry data for as long as needed to deal with your enquiry and for a reasonable period afterwards, in case you come back to us about the same matter. Newsletter subscriptions are kept until you unsubscribe.

[TBC — set and state specific retention periods for each category above.]

Your rights

Depending on where you live, you may have the right to access the personal data we hold about you, to have it corrected or deleted, to restrict or object to our processing of it, and to receive a copy in a portable format. Where we rely on consent, you can withdraw it at any time.

To exercise any of these rights, contact us at [TBC — data protection contact address]. If you are not satisfied with our response, you may complain to your local data protection authority.

Cookies and analytics

This site does not use advertising or cross-site tracking cookies. Any analytics we run is configured for aggregate measurement rather than individual profiling.

[TBC — once the analytics provider is confirmed, state whether it sets cookies, and add a consent banner if the chosen provider requires one in your target markets.]

Security

We serve this site over HTTPS, apply security headers, validate and sanitise all form input on the server, rate-limit submissions, and keep dependencies scanned and updated. No system is perfectly secure, but the practices we apply here are the same ones we recommend to clients.

Changes to this policy

If we change this policy we will update the date shown at the top of this page. Material changes will be highlighted on the page itself.