Privacy Policy

1. Who we are

We are committed to protecting personal data and to complying with the Data Protection Act 2018 and the United Kingdom General Data Protection Regulation (UK GDPR). Opus Business Expert is a limited company registered in England and Wales, company number 16173384, with its registered office at 17 King Street, Knutsford, WA16 6DW.

We are the data controller for the personal data described in this policy. That means we decide what is collected and why.

Trading name

Opus Business Expert

Registered company name

To be confirmed

Company number

16173384

Registered office

17 King Street, Knutsford, WA16 6DW

ICO registration number

To be confirmed

Data protection contact

[email protected]

This policy explains how we collect and use the personal data of individuals — clients, people who contact us, and others whose data reaches us in the course of our work. We use personal data only for the purposes described here, or for purposes explained to the individual at the point it was collected.

2. How we receive personal data

We may obtain personal data directly from you when you:

• request a proposal from us for the services we provide;
• engage us to provide those services, and during their provision;
• contact us for any reason by email, telephone, post, the enquiry form on this website, or social media;
• give us access to your systems, accounts or premises so that we can carry out work you have asked for.

We may also obtain personal data indirectly:

• from a colleague, employer or adviser who introduces you to us;
• from publicly available sources, for example Companies House or your own website;
• from your systems, where an engagement requires us to work in them.

This list is not exhaustive. Where it becomes necessary to obtain personal data about you from a third party, you will usually have been told that we intended to do so.

3. What we process, and what this website does

The enquiry form on this website collects your name, your email address, optionally your company name, the subject you select, and the message you write. Submitting it sends that information to us by email, through our email delivery provider, with the reply-to address set to yours so that we can answer you. This website has no database and stores nothing you type.

When you submit the enquiry form, the website reads the IP address the request arrives from and uses it to count submissions — no more than five in any hour from the same address — so that the form cannot be used to send bulk mail. The address is held in the server’s memory only. It is never written to disk, never included in the email we receive, and is discarded within the hour. We rely on our legitimate interest in preventing abuse of our own systems.

This site sets one cookie of its own, to remember your language choice. It uses Google Tag Manager for analytics, but only if you accept it: nothing is requested from Google unless you do, and you are asked before anything loads. There are no advertising or remarketing pixels. Our cookie policy sets out the detail.

In the course of an engagement we may also process the personal data of your staff, contacts, suppliers and customers — names, contact details, diary and travel arrangements, correspondence, and whatever else the work requires. Where we do that on your instructions we are acting as a processor and you remain the controller.

4. The lawful bases on which we process personal data

• Consent — where you have given consent to processing for one or more specific purposes.
• Contract — where processing is necessary to meet our obligations under a contract to which you are party, or to take steps at your request before entering into one.
• Legal obligation — where processing is necessary for compliance with a legal obligation to which we are subject.
• Legitimate interests — where processing is necessary for our legitimate interests or those of another party, except where those interests are overridden by your interests, rights and freedoms.

In practice those map onto what we do like this:

Delivering an engagement

Contract

Answering an enquiry you send us

Legitimate interests, or steps taken before entering a contract

Preventing abuse of our website and systems

Legitimate interests

Telling you about other services we provide

Consent

Keeping company and tax records, and responding to lawful requests

Legal obligation

Running and improving the business, including record-keeping and insurance

Legitimate interests

Where we rely on legitimate interests, we have considered whether those interests are overridden by the interests, rights and freedoms of the people concerned, and we will explain that assessment on request.

5. Data security

We have put in place appropriate and proportionate security measures to address the risk of personal data being lost, misused, altered or accessed without authorisation. We limit access to personal data to those with a business need for it, who process it only on our instructions.

No transmission over the internet can be regarded as wholly secure. We have measures in place to deal with any suspected data security breach, including notifying the Information Commissioner’s Office and affected individuals where the law requires it. Our procedures are reviewed periodically to check they remain fit for purpose.

6. Who we share personal data with

We share personal data with third parties only where it is necessary for the purposes for which we process it. The service providers involved in running this website and this business are:

Email delivery provider

Delivers the enquiry form to our inbox. It processes the contents of the enquiry in transit.

Cloudflare

Sits in front of this website and routes and protects every request to it. It processes IP addresses and request metadata at its network edge.

Hosting provider

Runs the server this website is served from.

Email and productivity providers

Hold our mailbox and the working files for an engagement.

Professional advisers and insurers

Where we need advice, or need to notify a claim.

We permit service providers to process personal data only for specified purposes and in accordance with our instructions, under contractual terms and security arrangements appropriate to the data involved. We do not sell personal data, and we do not share it for anyone else’s marketing.

We will also disclose personal data where we are legally required to, and to the extent necessary to establish, exercise or defend legal claims.

7. Transfers outside the United Kingdom

Some of the service providers above are based outside the United Kingdom, or process data on infrastructure that is. Where personal data is transferred outside the UK, we rely on the UK’s adequacy regulations for the destination country where they apply, and otherwise on the International Data Transfer Agreement, or the International Data Transfer Addendum to the European Commission’s standard contractual clauses, together with any additional safeguards the transfer requires.

8. How long we keep personal data

We keep personal data only for as long as there is a lawful basis for doing so. In setting a retention period we consider the needs of the business, the services provided, our legal obligations, and the purposes for which the data was collected.

IP addresses used to rate-limit the enquiry form

In memory only, for at most one hour.

Enquiries that do not lead to an engagement

Kept while we deal with the enquiry and for a reasonable period afterwards, then deleted.

Records of an engagement

Six years from the end of the business relationship, reflecting the ordinary limitation period for a contractual claim.

Company and tax records

For the period the law requires us to keep them.

Credentials and access to your systems

Removed or revoked as soon as the work they were provided for is complete.

9. Your rights over your personal data

It matters that the data we hold is accurate and current. If your details change, please tell us.

You have rights over the personal data we process as controller. We aim to respond promptly; how long a response takes depends on the nature and extent of the request. You have the right to:

• request access to your personal data under Article 15 of the UK GDPR, so that you receive a copy of what we hold;
• request rectification under Article 16 of any errors or inaccuracies in it;
• request erasure under Article 17 where there is no good reason for us to continue processing it;
• object to processing under Article 21 where we rely on legitimate interests and you believe your own interests or rights override them;
• request restriction of processing under Article 18, for example while its accuracy is established;
• withdraw consent under Article 7 where we process on the basis of your consent;
• request the transfer of your personal data to you or to another controller under Article 20.

To exercise any of these rights, email [email protected]. There is no charge.

We do not carry out automated decision-making that produces legal effects concerning you or similarly significantly affects you, and we do not profile individuals.

10. Contact and complaints

If you have any question about this policy, or would like to discuss how we process personal data, email [email protected] or telephone 01565 364819. You can also write to us at 17 King Street, Knutsford, WA16 6DW.

You also have the right to complain to the Information Commissioner’s Office, the UK supervisory authority for data protection. We would ask you to raise the matter with us first so that we have the chance to put it right.

Information Commissioner’s Office

Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. Telephone 0303 123 1113. ico.org.uk/concerns

11. Changes to this policy

We may update this policy from time to time. The current version is always the one published on this page, and its effective date is shown at the top.