Privacy Policy
Summary. ACURIS SERVICES LTD is a business-to-business advisory firm. We process limited personal data about people who work for other organisations (our clients, prospective clients and suppliers) and about visitors to this website. We do not sell personal data. You can object to marketing at any time by emailing legal@acuris.uk or using the unsubscribe link in any email.
1. Who we are (data controller)
The data controller responsible for your personal data is:
ACURIS SERVICES LTD, a private company limited by shares registered in England and Wales under company number 17503449, with its registered office at 2c Darmonds Green Avenue, Liverpool, L6 0DP, United Kingdom.
Contact for all data protection matters: legal@acuris.uk
We have not appointed a Data Protection Officer because we are not legally required to do so. Our director is responsible for data protection compliance.
2. Who this policy covers
This policy applies to personal data of:
- Website visitors to acuris.uk;
- Enquirers who contact us through the website, by email or by telephone;
- Representatives of prospective clients (for example directors and managers of organisations we believe may benefit from our services), including people whose details we obtain from public sources;
- Representatives of clients and suppliers with whom we work.
Our services are provided to organisations only. We do not knowingly provide services to consumers.
3. Personal data we collect and where it comes from
| Category | Examples | Source |
|---|---|---|
| Identity and role | Name, job title, employer, role (e.g. director) | You; your organisation; public sources (Companies House register, your organisation's website, professional networking profiles) |
| Business contact details | Work email address, work telephone number, business address | You; your organisation; public sources as above |
| Enquiry content | Area of interest and the information you include in your message | You |
| Engagement records | Correspondence, meeting notes, contract and invoicing records | You; your organisation |
| Marketing preferences | Opt-ins, objections and unsubscribe requests | You |
| Technical data | IP address, browser type, date and time of access, security logs | Your device, via our hosting and security provider |
We do not intentionally collect special category data (such as health data) or criminal offence data. Please do not include such data in your messages.
4. Purposes and lawful bases
Under the UK GDPR we must have a lawful basis for each use of personal data. Because our clients are organisations, we usually rely on legitimate interests (Article 6(1)(f)). We have carried out a legitimate interests assessment, which is available on request.
| Purpose | Lawful basis |
|---|---|
| Responding to enquiries and assessing a potential engagement | Legitimate interests: responding to business enquiries and developing our business |
| Identifying and contacting relevant decision-makers at organisations that may benefit from our services (business development) | Legitimate interests: promoting our B2B services to relevant organisations. You can object at any time (see section 5) |
| Delivering services and managing the client relationship | Legitimate interests: performing our contract with your organisation. Where you contract with us as a sole trader or partnership, performance of a contract (Article 6(1)(b)) |
| Managing suppliers | Legitimate interests: running our business |
| Sending optional newsletters / insights where you opted in on our website | Consent (Article 6(1)(a)), which you may withdraw at any time |
| Accounting, tax and company law record keeping | Legal obligation (Article 6(1)(c)) |
| Website security and preventing fraud and spam | Legitimate interests: keeping our website and systems secure |
| Establishing, exercising or defending legal claims | Legitimate interests |
We do not use automated decision-making (including profiling) that produces legal or similarly significant effects.
5. Business-to-business marketing
We may send business-relevant communications about our services to work email addresses of people at companies, limited liability partnerships and public bodies ("corporate subscribers"). Under the Privacy and Electronic Communications Regulations 2003 (PECR) this does not require prior consent, but every message will identify us and include a simple way to opt out.
Sole traders and some partnerships are treated as individuals under PECR. We will only email them with marketing if they have consented or, where permitted, if they are existing customers or enquirers who did not opt out of similar marketing ("soft opt-in").
Where we first obtained your details from a public source (such as the Companies House register), we will tell you this and provide a link to this policy in our first communication, and in any event within one month.
You have an absolute right to object to direct marketing. If you object, we will stop and add your details to a suppression list so that we do not contact you again.
6. Who we share data with
We share personal data only where necessary, with:
- Service providers (processors) acting on our instructions under written contracts, including: Formspree, Inc. (website form handling, United States); Cloudflare, Inc. (website hosting, content delivery and security); and our email, cloud storage and productivity software providers;
- Professional advisers such as accountants, lawyers and insurers;
- Authorities and regulators such as HMRC, law enforcement or the courts, where the law requires it;
- A purchaser or successor of all or part of our business, subject to equivalent confidentiality and data protection safeguards.
We do not sell personal data or share it with third parties for their own marketing.
7. International transfers
Some of our service providers process personal data outside the UK, including in the United States. When this happens we ensure an appropriate safeguard is in place, namely:
- UK adequacy regulations (for example for countries in the European Economic Area, or for US organisations certified under the UK Extension to the EU-US Data Privacy Framework); or
- the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment.
Contact us for more information about the safeguard used for a particular transfer.
8. How long we keep data
| Data | Retention period |
|---|---|
| Enquiries that do not lead to an engagement | 24 months from our last contact |
| Prospective client contact records | 24 months from our last contact, or until you object |
| Marketing suppression list | Kept for as long as necessary to respect your objection (minimum data only) |
| Client and supplier engagement records, contracts and invoices | 6 years after the end of the financial year in which the engagement ends (limitation periods and tax law) |
| Website security logs | In line with our hosting provider's standard log retention, typically no longer than 30 days |
9. Security
We use appropriate technical and organisational measures to protect personal data, including encrypted connections (HTTPS), multi-factor authentication on business accounts, access limited to those who need it, and reputable service providers bound by confidentiality and data protection obligations. If you suspect any misuse or loss of your data, please contact us immediately at legal@acuris.uk.
10. Your rights
Subject to certain conditions and exemptions, you have the right to:
- access a copy of your personal data;
- rectification of inaccurate or incomplete data;
- erasure of your data;
- restrict our processing;
- object to processing based on legitimate interests, and to direct marketing at any time;
- data portability, where processing is based on consent or contract and carried out by automated means;
- withdraw consent at any time, where we rely on consent.
To exercise any right, email legal@acuris.uk. We do not normally charge a fee. We will respond within one month, which may be extended by up to two further months for complex requests; we may need to verify your identity first.
11. Complaints
If you are unhappy with how we have handled your personal data, please complain to us first at legal@acuris.uk. We will acknowledge your complaint within 30 days of receipt, investigate it without undue delay and tell you the outcome.
You also have the right to complain to the UK supervisory authority, the Information Commissioner's Office (ICO): Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF; telephone 0303 123 1113; website ico.org.uk/make-a-complaint.
12. Cookies
For information about cookies and similar technologies on this website, see our Cookie Policy. You can change your choices at any time using the "Cookie settings" link in the website footer.
13. Changes to this policy
We may update this policy from time to time. The "Last updated" date at the top shows when it was last changed. Where changes are significant, we will take reasonable steps to tell people we are in contact with.