Privacy Policy

This privacy policy applies to Kingsbury Consulting Ltd, a company registered in England and Wales (Companies House registration number: 16148652), trading as Kingsbury Consulting. Our registered address is in Leeds, UK.

We are registered with the Information Commissioner's Office (ICO) as a data controller. If you have questions about how we handle your personal data, you can contact us at michael@kingsbury.consulting.

Our data protection practices are governed by the following legislation:

• UK General Data Protection Regulation (UK GDPR) - the primary framework for how personal data must be collected, processed, and protected.
• Data Protection Act 2018 (DPA 2018) - the domestic legislation that implements and supplements the UK GDPR.
• Data (Use and Access) Act 2025 (DUAA) - which amends both the UK GDPR and the DPA 2018, introducing targeted reforms including updates to automated decision-making, data subject rights, and legitimate interests.
• Privacy and Electronic Communications Regulations 2003 (PECR) - which governs the use of cookies and electronic marketing, and has been updated by the DUAA.

We collect personal data in the following circumstances:

Compliance assessment submissions (/assess)
When you complete our compliance assessment, we collect your name, email address, organisation name, and the answers you provide. This data is used to send you your results and the relevant resource guide, and to create a record in our client relationship system. Our legal basis is legitimate interests - you have initiated contact by completing the assessment and expect to receive a response.

Meeting bookings (/contact)
When you book a conversation through our contact page, we collect your name, email address, and any information you provide through the HubSpot booking interface. This data is used to schedule and manage the meeting. Our legal basis is legitimate interests.

Client engagements
When we work with you as a client, we collect and process information necessary to deliver our services and fulfil our contractual obligations. This may include contact details, organisational information, and any data you share with us as part of the engagement. Our legal basis is contract performance.

Website analytics
We use Google Analytics to measure site traffic and understand how visitors use our website. This involves the use of cookies that collect anonymised information about your visit, including pages viewed, time on site, and referral source. No personally identifiable information is collected through analytics, and IP addresses are anonymised. Under PECR as updated by the DUAA, statistical cookies of this kind do not require prior consent, provided a clear opt-out mechanism is available. You can manage your analytics preferences at any time via the Cookie Preferences link in the footer of this site.

We use the following types of cookies on this site:

• Essential cookies - necessary for the site to function, including storing your cookie preference. These cannot be disabled.
• Analytics cookies (Google Analytics) - used to collect anonymised data about how the site is used. You can opt out at any time using the Cookie Preferences link in the footer.

We do not use advertising, targeting, or social media cookies.

We use a small number of third-party services to operate our business. Each is subject to its own data processing terms:

Google Analytics - used to measure anonymous site traffic and understand how visitors use this website. IP addresses are anonymised. Google Ireland Ltd processes data in the EU. Google Privacy Policy.

Google (Gmail) - used to send emails including assessment results. Google Ireland Ltd processes data in accordance with its standard data processing terms. Google Privacy Policy.

Make.com - automation platform used to process assessment submissions and route data between systems. Make.com processes data in the EU region. Make.com Privacy Policy.

Airtable - used as our client relationship management system to store prospect and client records. Airtable is a US-based service operating under Standard Contractual Clauses for data transfers, approved by the UK ICO. Airtable Privacy Policy.

HubSpot - used for meeting booking on our contact page. HubSpot operates in the EU region. HubSpot Privacy Policy.

Storyblok - used as a content management system for our website. Storyblok processes data in the EU region. Storyblok Privacy Policy.

We do not sell your personal data to third parties. We do not share your data with third parties for marketing purposes.

Most of our data processors operate within the European Economic Area (EEA) or the UK. Where data is transferred to processors based in the United States (specifically Airtable), we ensure appropriate safeguards are in place through Standard Contractual Clauses approved by the UK ICO.

Assessment submissions: Records are retained for up to two years from the date of submission, after which they are deleted unless an ongoing client relationship has been established.

Client engagement data: Data relating to client engagements is retained for six years from the end of the engagement, in line with UK legal and contractual obligations.

Meeting bookings and enquiries: Contact data is retained for one year from the date of the enquiry or meeting, unless an ongoing relationship develops.

Under the UK GDPR, the Data Protection Act 2018, and the Data (Use and Access) Act 2025, you have the following rights in relation to your personal data:

Right of access - you can request a copy of the personal data we hold about you.

Right to rectification - you can ask us to correct inaccurate or incomplete data.

Right to erasure - you can ask us to delete your data where there is no legitimate reason for us to continue processing it.

Right to restriction - you can ask us to restrict processing of your data in certain circumstances.

Right to data portability - you can ask us to provide your data in a structured, machine-readable format.

Right to object - you can object to processing based on legitimate interests.

Right to complain directly to us - introduced by the DUAA, you have a formal right to raise a complaint with us directly about how we handle your personal data. We will acknowledge your complaint within 30 days and respond without undue delay.

To exercise any of these rights, please contact us at michael@kingsbury.consulting. We will respond within one calendar month.

If you are not satisfied with our response, you have the right to lodge a complaint with the ICO at ico.org.uk or by calling 0303 123 1113.

We work with a small number of contractors and virtual assistants who may access client data as part of their work. All such individuals are subject to confidentiality obligations and are provided with data handling guidance appropriate to their role.

We review this policy at least annually and whenever our data processing activities change materially. The date at the top of this page reflects the most recent review. We will notify clients of any significant changes that affect the processing of their data.

For any questions about this policy or your personal data, please contact:

Michael Guy
Kingsbury Consulting Ltd
Leeds, UK
michael@kingsbury.consulting