Privacy Policy

7. Marketing

Where we ask for marketing consent, it is separate, optional and unticked, and we record when and how it was given. A form, resource request or Fit Call does not automatically amount to consent to unrelated marketing.

In appropriate business-to-business circumstances, we may rely on legitimate interests where electronic-marketing law permits. We identify ourselves, provide an effective opt-out, respect objections and avoid irrelevant or excessive communications. You can unsubscribe using the link in an email or by contacting us. We may keep a minimal suppression record to honour the request.

Commercial emails to United States recipients will include accurate sender information, a valid postal address and a working opt-out, and opt-outs will be honoured as required by applicable law.

8. Cookies, analytics and advertising

We may use cookies, pixels, tags, scripts, web beacons, local storage, link and conversion tracking, and server-side event tools. Essential technologies support security, forms, bookings and privacy choices. Preference technologies remember settings. Analytics technologies measure use and performance. Advertising technologies may attribute conversions, manage audiences and frequency, and support relevant advertising.

Except where a valid exception applies, non-essential technologies are not activated until an affirmative choice is made. Cookie Settings provides current providers, purposes, categories and durations and allows choices to be changed.

For UK and European visitors, non-exempt advertising and tracking technologies are used only after the consent required by applicable law. Where an applicable US state law treats certain advertising technologies as sale, sharing, targeted advertising or cross-context behavioural advertising, relevant opt-out rights and recognised preference signals will be respected where required.

9. Platforms and booking providers

Calendly or another booking provider may process contact details, appointment and time-zone information, booking responses, device data and information needed for confirmations and reminders. We receive information needed to administer the appointment; the provider may also act independently for security, administration and legal compliance.

YouTube, Google, Meta, LinkedIn, Substack and other platforms process information under their own notices and settings. They may provide us with lead-form responses, public interactions, audience analytics and advertising reports. Depending on the feature and law, we and a platform may have separate or joint responsibilities for particular processing.

10. Sharing

We may share relevant information with website, hosting, form, funnel, consent-management, CRM, email, booking, video, webinar, storage, analytics, advertising, IT, cybersecurity, banking, payment and accounting providers; contractors assisting with an engagement; professional advisers and insurers; a genuine purchaser or successor; courts, regulators and authorities; and an organisation to which you ask us to make an introduction.

Processors acting for us must use information only for the relevant service and under appropriate contractual terms. We do not sell contact lists for money or transfer an enquiry to an unrelated consultancy, claims company, law firm or adviser without explaining the arrangement and obtaining consent where required.

11. International transfers

Some providers may process information outside the United Kingdom or European Economic Area. Where transfer rules apply, we use a permitted mechanism, such as UK or EU adequacy arrangements, the UK-US Data Bridge for eligible recipients, the UK International Data Transfer Agreement, the UK Addendum to EU Standard Contractual Clauses, EU Standard Contractual Clauses, or another lawful mechanism, with supplementary protections where appropriate.

12. Retention

General enquiries, unsuccessful Fit Calls, appointments and free-resource requests: normally up to 24 months after the last meaningful interaction.

Active marketing records: while subscribed and normally no longer than 24 months after the last meaningful interaction unless interest is renewed; suppression records are retained as needed to respect opt-outs.

Consent records: while relied on and normally up to six years afterwards where needed to demonstrate compliance.

Client, contract and project records: for the engagement and normally six years afterwards; accounting records for the legally required period.

Security logs: normally up to 12 months unless needed for an incident; cookie and advertising data for the duration shown in Cookie Settings or the provider configuration.

Public comments and platform content: while published or until removed by us, the user or the platform.

We may retain information longer for a dispute, legal hold, fraud, security or another legal or regulatory requirement, or anonymise it for statistics and business analysis.

13. Security

We use proportionate measures such as access controls, account protections, secure hosting, encryption where appropriate, supplier checks, backups, confidentiality obligations and incident processes. No internet or email service is completely secure, so do not use ordinary channels for sensitive claimant, pension-member, medical, identity or financial information unless we have agreed a secure method.

14. UK and European rights

Depending on the circumstances and law, you may have rights to information, access, correction, deletion, restriction, objection, portability, withdrawal of consent, information about transfer safeguards and complaint to a supervisory authority. You may object to direct marketing at any time. Rights are not absolute and exemptions may apply.

To exercise a right, contact [email protected]. We may verify identity and clarify the request. UK residents may complain to the Information Commissioner's Office; EEA residents may complain to the authority where they live, work or believe an infringement occurred.

15. European visitors

EU GDPR may apply where we intentionally offer services to, or monitor the behaviour of, individuals in the European Economic Area. Where Article 27 requires an EU representative, we will appoint one and publish its details here before the relevant processing begins. The availability of our website in a country does not by itself mean that every service is offered there.

16. United States privacy information

This section applies only where an applicable US state privacy law covers our activities or grants the relevant right. We may collect identifiers and contact details, professional information, internet and device data, enquiry records, marketing and advertising information, approximate IP-derived location and sensitive information only where voluntarily submitted and lawfully processed.

We do not sell personal information for money. Some advertising pixels, audience tools and data disclosures may be treated as sale, sharing or targeted advertising under certain state laws. Where applicable, rights may include access, correction, deletion, portability, opt-out of sale, sharing, targeted advertising or certain profiling, limits on certain sensitive-data uses, use of an authorised agent, appeal and non-discrimination. Requests may be made through Cookie Settings or by contacting us. We will recognise browser-based opt-out signals such as Global Privacy Control where legally required.

17. Automated processing, children and external sites

We do not use public-funnel information to make solely automated decisions that produce legal or similarly significant effects.

Automation may send a resource, route an enquiry, schedule communications, measure conversions or categorise general interests.

Our services are intended for adults and business professionals and are not directed at children under 18. External services may act as independent controllers under their own terms and notices; we do not control their privacy, content or security practices.

18. Changes and contact

We may update this policy for changes in services, suppliers, marketing, technology or law. Material changes will receive further notice or consent where required. Questions, complaints and rights requests should be sent to Descartes Consulting Limited, The Old Station Cowdenburn, Lamancha, West Linton, Borders, Scotland, EH46 7BD, or [email protected].