Privacy Policy

Last updated: 2 November 2026

1. Who we are

ZY CONSULTANCY LTD is the data controller responsible for the personal data described in this policy.

2. Personal data we collect

2.1. Through this website

• Identity and contact data: your name, email address, telephone number and the organisation you give.
• Enquiry content: the area of interest you select and whatever you write in the message field.
• Technical data: your IP address and the date and time of submission, recorded for security purposes and as a record that the message was sent.

Please do not send confidential, commercially sensitive or special category information through the website form. If an engagement requires that kind of information, we will agree an appropriate channel and, where needed, a non-disclosure agreement first.

2.2. In the course of an engagement

Where you instruct us, we will process the data necessary to carry out the work and to administer the relationship, which may include:

• Contact and role details for client personnel and nominated stakeholders.
• Notes of interviews and workshops conducted as part of evidence gathering.
• Correspondence, meeting records and engagement documentation.
• Billing contact details and payment records.
• Identity and anti-money-laundering verification information where required.

Where client material supplied to us contains personal data relating to your employees or customers, we process it on your instructions as a processor, under a written agreement that sets out the purpose, duration and security measures.

3. How and why we use your data

Purpose	Lawful basis (UK GDPR)
Responding to enquiries made through the website, by email or by telephone.	Consent (Art. 6(1)(a)) and steps taken at your request before entering a contract (Art. 6(1)(b)).
Preparing proposals and performing a consultancy engagement.	Performance of a contract (Art. 6(1)(b)).
Administering the client relationship, invoicing and collecting payment.	Performance of a contract (Art. 6(1)(b)); legitimate interests in recovering sums due (Art. 6(1)(f)).
Meeting statutory obligations including accounting, tax and company law duties.	Legal obligation (Art. 6(1)(c)).
Keeping engagement records to establish, exercise or defend legal claims, and for professional indemnity purposes.	Legitimate interests (Art. 6(1)(f)).
Protecting the security of the website and preventing automated form abuse.	Legitimate interests (Art. 6(1)(f)).

We do not send marketing to you unless you have asked us to, we do not sell personal data, and we do not carry out automated decision-making that produces legal or similarly significant effects.

4. How long we keep it

• Enquiries that do not proceed: up to 12 months from our last contact with you.
• Engagement records: for the duration of the engagement and ordinarily 6 years afterwards, reflecting the limitation period for contractual claims.
• Accounting and tax records: 6 years from the end of the accounting period concerned, as required by HMRC and the Companies Act 2006.
• Client material processed on your instructions: for the period agreed in writing with you, after which it is returned or securely deleted.
• Technical security logs: only for as long as needed for the purpose that generated them.

5. Who we share it with

We share personal data only where necessary, and only with:

• Our professional advisers, accountants and insurers.
• Associates or subcontractors engaged on a specific project, bound by equivalent confidentiality and data protection obligations, and only where you have been informed.
• Our IT, website hosting and email providers, acting as processors under written terms.
• Public authorities, where we are required by law to disclose information.

We do not routinely transfer personal data outside the United Kingdom. If that becomes necessary, we will ensure an appropriate safeguard recognised under the UK GDPR is in place, such as an adequacy decision or the International Data Transfer Agreement.

6. Your rights

Under data protection law you have the right to:

• be informed about how your data is used;
• request access to a copy of your data;
• have inaccurate data corrected;
• request erasure, where there is no continuing reason to hold it;
• restrict processing in certain circumstances;
• object to processing based on our legitimate interests;
• data portability, where processing is by consent or contract and carried out by automated means;
• withdraw consent at any time, where consent is the basis we rely on.

To exercise any of these rights, email info@zyconsultancy.online or write to the registered office. We will respond within one month. There is no charge, though we may ask you to verify your identity first.

If you are an individual whose data we process on behalf of a client, your request is best directed to that client as the controller; if you contact us, we will forward it to them promptly.

7. Complaints

If you are unhappy with how we have handled your personal data, please tell us first so that we can put it right. You also have the right to complain to the Information Commissioner's Office, the UK supervisory authority:

Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF — telephone 0303 123 1113 — ico.org.uk

8. Security

We apply appropriate technical and organisational measures to protect personal data against unauthorised access, loss or alteration, including access limited to those who need it, encrypted storage and transmission, and confidentiality obligations on everyone working on an engagement. Data submitted through this website is transmitted over an encrypted connection once the SSL certificate is installed.

9. Children

Our services are directed at organisations and the adults who work in them. We do not knowingly collect personal data relating to children through this website.

10. Cookies

Our use of cookies and similar storage is described in the Cookie Policy.

11. Changes to this policy

We may update this policy to reflect changes in our practices or in the law. The version published on this page, with the date shown above, is the one that applies.