Privacy Policy

ADL Consulting Limited ("we", "us", or "our") is committed to protecting and respecting your privacy. As a boutique information security and data protection consultancy, we take privacy seriously, not just because the law requires it, but because it is at the heart of everything we do.

This Privacy Policy explains how we collect, use, and safeguard personal data when you interact with our website (www.adlconsulting.co.uk) or engage our services. This policy complies with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (DPA 2018), and the Data (Use and Access) Act 2025 (DUAA 2025).

1. Who we are and how to contact us

For the purposes of data protection legislation, ADL Consulting Limited is the data controller. If you have any questions about this policy or how we handle your data, you can reach us at:

  • Company Name: ADL Consulting Limited

  • Registered Office: 6 Hinckley Road, Ibstock, Leicestershire, LE67 6PB, United Kingdom

  • Company Registration Number: 06684621

  • Data Protection Contact: privacy@adlconsulting.co.uk

2. The information we collect

We operate primarily on a business-to-business (B2B) basis. We do not collect or process consumer personal data or run marketing email campaigns. The personal data we handle is strictly limited to the business contact details of our clients, prospective clients, and professional partners. This typically includes:

  • Full name

  • Business email address

  • Professional telephone number

  • Job title and company name

  • Communications and correspondence exchanged with us during our engagements

3. How and why we use your data

We only process your personal data where we have a lawful basis to do so under UK data protection law. Most commonly, we use your data in the following circumstances:

  • To perform our contract: Managing client onboarding, delivering our information security and data protection consultancy services, communicating about ongoing work, and handling invoicing.

  • Legitimate interests: Maintaining standard business administration, securing our IT systems, and managing our professional relationships, provided these interests are not overridden by your rights.

  • Legal obligations: Complying with mandatory accounting, tax (HMRC), and regulatory requirements.

4. Who we share your data with

We do not sell, rent, or trade your personal data. To deliver our services efficiently and securely, we rely on trusted cloud-based software tools and professional specialists. Where we share data, we ensure strict data protection measures are in place:

  • Our Specialist Contractor: We occasionally outsource specific specialist tasks to I4DP, a UK-based data protection consultancy and specialist contractor bound by strict confidentiality and data protection terms.

  • Technology and Infrastructure Providers: We use industry-standard enterprise software platforms to run our business operations securely:

    • Google Workspace: Business email, document collaboration, and storage.

    • Microsoft 365 (Teams): Client meetings, collaboration, and communications.

    • Xero: Financial management, invoicing, and accounting.

    • Asana: Project management and workflow tracking.

    • AFI.ai: Secure cloud backup services.

    • Teachable: Online learning content delivery (applicable only if you subscribe to our training modules).

    • Claude (Anthropic Team License): Secure AI-assisted document drafting and analysis.

5. International data transfers

Some of the enterprise software platforms we use (such as Google, Microsoft, Asana, and Anthropic) may store or process data outside the United Kingdom, predominantly in the United States or the European Union.

Whenever we transfer personal data outside the UK, we ensure a similar degree of protection is afforded to it by implementing appropriate safeguards approved under Chapter V of the UK GDPR, such as UK Adequacy Regulations, the UK International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses.

6. How long we keep your data

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the satisfying of any legal, accounting, or reporting requirements:

  • Financial and invoicing records (Xero): Retained for 7 years to comply with UK HMRC tax and corporate audit obligations.

  • Project and client correspondence: Retained for 6 years following the conclusion of our contract or engagement, aligning with standard legal limitation periods for contractual claims.

  • General enquiries: Where an enquiry does not result in an engagement, correspondence is typically reviewed and deleted within 12 months.

7. Website cookies and tracking

Our website (www.adlconsulting.co.uk) is an informational site designed to provide details about our consultancy services. We do not use intrusive tracking cookies, advertising pixels, or third-party behavioural analytics tools. Essential session or security cookies may be used purely to ensure the website functions correctly and securely.

8. Your data protection rights

Under the UK GDPR and related legislation, you have several rights regarding your personal data:

  • Right of access: You can request copies of your personal data (a Data Subject Access Request).

  • Right to rectification: You can ask us to correct inaccurate or incomplete data.

  • Right to erasure: You can ask us to delete your personal data under certain circumstances.

  • Right to restrict processing: You can ask us to suspend the processing of your data.

  • Right to object: You can object to our processing where we rely on legitimate interests.

  • Right to data portability: You can request the transfer of your data to another service provider.

To exercise any of these rights, please contact our team at privacy@adlconsulting.co.uk. If you are unsatisfied with our response, you have the right to lodge a complaint with the UK supervisory authority, the Information Commissioner’s Office (ICO) via ico.org.uk.