Privacy policy

1. Who I am

Arete Data & Analytics Ltd is the data controller for personal data collected through this website. The company is registered in England and Wales, company number 16639477, registered office 19 Fownhope Avenue, Sale, M33 4RE, United Kingdom.

Questions about this policy, or about the personal data I hold: [email protected].

This policy explains how personal data is handled in line with the UK General Data Protection Regulation and the Data Protection Act 2018.

2. What this website collects

This is a static website. It has no database and no account system.

• The contact form. No form service is currently connected. When you submit the form, your browser opens your own email application with the details filled in. Nothing is sent to or stored on this website. If a form service is connected in future, this section will be updated before it goes live.
• The maturity assessment. The assessment runs entirely in your browser. Your scores and the details you enter are used to generate the PDF report on your own device. Lead capture is currently switched off, so nothing you enter is transmitted anywhere. If that changes, this section will be updated and the consent wording on the assessment will say exactly where the data goes.
• Email, phone and LinkedIn. If you contact me directly, I hold what you send me: your name, contact details, organisation and the content of the message.
• Analytics. Only if you accept. See section 4.

Like any website, this one is served by a hosting provider (Cloudflare) which processes technical information such as IP address as part of delivering and securing the page. That is server infrastructure rather than something this site collects for its own purposes.

3. Why, and on what legal basis

• To reply to you and to provide services. Legitimate interests, or performance of a contract where one exists.
• To send you something you asked for. Consent, which you can withdraw at any time.
• To understand which pages are read. Consent, through the cookie banner.

I do not sell personal data, I do not use it for automated decision-making or profiling, and I do not send marketing to people who have not asked for it.

4. Cookies and analytics

No analytics or tracking cookie is set unless you actively accept one.

When you first arrive, a banner asks whether you are willing to allow Google Analytics 4. Until you choose Accept analytics, no Google script is loaded and no request is made to Google. If you accept, Google Analytics 4 is loaded with IP anonymisation enabled and sets its own cookies to recognise a returning browser and to measure which pages are read. If you decline, nothing is loaded.

Your choice is stored in your browser's local storage under the key arete-consent. That is not a cookie and is never transmitted to me. You can change your mind at any time using the Cookie settings link in the footer of every page, which clears the stored choice and asks again. Clearing your browser data has the same effect.

Google Analytics is provided by Google, which acts as a processor and may transfer data outside the UK under the safeguards set out in its own terms. Google's privacy information is at policies.google.com/privacy.

No advertising, remarketing or social media tracking cookies are used on this site.

5. Sharing

I do not sell or trade personal data. It is shared only with service providers needed to run the business, and only as far as necessary: website hosting (Cloudflare), email and office software (Microsoft), and analytics (Google, and only with your consent). Each of these acts as a processor under contract.

The "Book a discovery call" button opens Microsoft Bookings in a new tab. From that point you are on a Microsoft page, and the name, email and any notes you enter there go to Microsoft Bookings so the appointment can be created. Nothing about the booking passes through this website.

6. How long it is kept

Enquiries that do not lead to work are kept for up to two years so I can pick up a conversation you started. Records relating to actual engagements are kept for six years after the engagement ends, to meet accounting and legal requirements. Analytics data is retained according to the retention setting in Google Analytics.

7. Your rights

Under UK GDPR you have the right to:

• Access the personal data I hold about you.
• Rectify anything inaccurate or incomplete.
• Erase your data in certain circumstances.
• Restrict or object to processing in certain circumstances, including any processing based on legitimate interests.
• Receive your data in a portable, structured format.
• Withdraw consent at any time where consent is the basis, including analytics.

To exercise any of these, email [email protected]. I will respond within one month.

8. Security

The site is served over HTTPS. Business email and documents are held in Microsoft 365 with multi-factor authentication. Client data encountered during an engagement is handled under the terms of that engagement and stays in the client's own environment wherever possible.

9. Changes

If this policy changes, the revised version appears on this page with a new date at the top. A change that materially affects how your data is used will be described here.

10. Complaints

If you are unhappy with how your personal data has been handled, please tell me first so I can put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.